Privacy policy

QuizHub · last updated 2026-11-13

Nabucodonosor Solutions Kft. (Rákos út 98. 9. em. 58. ajtó, 1155 Budapest, Hungary) operates QuizHub and is the data controller. Contact: quizup-revived-support@googlegroups.com.

What we collect

• Account: your username and, if you use a password, a salted hash of it and a hash of your recovery code. We do not ask for your email, phone number or real name.
• Birth year: asked once when you sign up, to check that you are old enough to play. It is never shown to anyone.
• Sign in with Apple, Google or Facebook: the account identifier that service gives us, so you can sign in again. For Apple we also keep a token that lets us revoke the link when you delete your account. We do not store the email address or name those services may share. With Facebook we copy your profile picture as your starting photo, unless you have already chosen one.
• Friends: your friends and friend requests on QuizHub, and where a request was sent from (a username, a match or your match history). A request nobody answers expires after 30 days. When you decline a request, we note it so that player cannot ask you again for 7 days (30 days after a later decline); the note is deleted 90 days after that period ends, and you can still send them a request yourself. Players under 18, or who have not given a birth year, and adults cannot send each other friend requests; they can become friends only with a friend code one of them shares, or as mutual Facebook friends. A friend code works once, for 24 hours, and is deleted a day after it expires. If you connect Facebook, we receive the list of your Facebook friends who also use QuizHub and add them as friends; we do not keep anyone else from that list.
• Who invited you: if you sign up with, or later enter, another player's invite code, we store which player invited you, when, and which opponents you played (to count toward the invite reward). If either of you deletes your account, the record is deleted or made anonymous.
• Profile photo, if you add one: a selfie or a picture from your photo library that you choose, or, if you sign in with Facebook, your Facebook profile picture. It is shown to other players with your username. You can change or remove it at any time in your profile.
• Profile you choose to add: country and city, if you enter them. Your country appears on your profile and on country leaderboards. Your city stays hidden from other players unless you choose to show it; then it also appears on city leaderboards. We do not read your device location.
• Notifications, if you allow them: a push token for each device you sign in on, your notification switches and the friends you muted. We use them only to tell you about challenges and friend requests. Signing out removes that device's token.
• Gameplay: match results, scores, XP, levels, achievements and match history.
• Safety: players you block, reports you send or that are made about you, and moderation actions. We also look at how quickly you answer: answers consistently faster than a person can read the question can hide an account from leaderboards until a moderator reviews it. Usernames, messages and posts pass an automatic filter for offensive words. In posts, and in chats where either player is under 18 or has not given a birth year, links, contact details (such as phone numbers, emails and messaging-app names) and explicit terms are refused. The same message sent to many friends within an hour is refused. Some phrases that can be used to groom children are noted when an adult, or a player who has not given a birth year, sends them to a player under 18; repeated use, or a message sent to many friends, files an automatic report for our moderators and can pause the sender's contact with players under 18 for up to 7 days until a moderator reviews it. Open reports from three players within a day pause the reported player's friend requests, messages and posts, and one report by a player under 18 about an adult pauses that adult's contact with players under 18, until a moderator reviews it (at most 30 days for contact with minors, 7 days otherwise); duels with friends still work. If most of the friend requests someone sends are declined, their requests pause for 7 days. Reaching a daily limit on two days within a week, or an account active on many devices, is flagged for a moderator. We never ban an account automatically.
• Messages: the direct messages you exchange with friends, kept so both of you can read the conversation. Either of you can report the other; moderators then read the reported conversation. If one of you deletes their account, the other keeps the conversation, with the deleted side shown as "Deleted player".
• Topics and posts: topics you create, posts you write on topic pages and the posts you like. Posts show your username to everyone who follows that topic; the topics you follow are visible only to you.
• Play-later challenges: the questions and the answers you recorded for a friend, kept until they play or the challenge expires after seven days.
• Community questions: questions you submit, any picture you attach to them, and your review votes. Other players see submitted questions and pictures (without your name) while they are reviewed, and in matches once the community approves them. Your individual votes are not shown to anyone.
• Purchases: a random billing identifier, which items and plans you own and your credit balance. We never receive your card details or store password.
• Technical: your IP address is used briefly in memory to limit abuse (rate limiting). We do not store it in your account.

Why we use it (legal basis)

To provide the game you signed up for: accounts, matchmaking, scoring, leaderboards, and the items you buy (performance of a contract, GDPR Art. 6(1)(b)). To keep the game safe and prevent cheating and abuse (legitimate interests, Art. 6(1)(f)). To meet accounting and tax duties for purchases (legal obligation, Art. 6(1)(c)). We do not sell your data, show third-party ads or build advertising profiles.

Who else processes it

• Apple App Store / Google Play handle payments under their own privacy policies.
• Expo (650 Industries, Inc., USA) relays notifications to Apple's and Google's push services. It receives the device token and the notification text, such as who challenged you. Transfers rely on the EU Standard Contractual Clauses.
• Apple, Google and Meta (Facebook) process your sign-in when you choose them, under their own privacy policies. We never post to Facebook.
• Cloudflare, Inc. (USA) carries the connection between the app and our server, protecting it from attacks, and stores our encrypted backups. It processes IP addresses and the traffic passing through; it cannot read the backups. Transfers rely on the EU Standard Contractual Clauses / EU–US Data Privacy Framework.
• RevenueCat, Inc. (USA) verifies purchases on our behalf. It receives your random billing identifier and store transaction data, never your username or password. Transfers rely on the EU Standard Contractual Clauses / EU–US Data Privacy Framework.

What other players see

Your username, profile photo (if you added one), avatar and cosmetics, level, title, country (if set), city (only if you choose to show it), leaderboard positions, match statistics, best topics, number of friends and, to your friends, whether you are online or in a game.

How long we keep it

Until you delete your account. Deleting your account permanently removes your profile, birth year, photo, notification tokens, progress, sessions, sign-in links, friends, posts, topics you created (with the posts in them), play-later challenges, blocks, reports made about you, purchases records held by us, and asks RevenueCat to delete its customer record. Messages you sent stay only in your friends' copies of the conversation, shown as from "Deleted player". Reports you sent stay with the moderators without your name, so they can still act on them. Questions you submitted stay but are anonymized; pictures you attached to them are deleted, and questions that need their picture are withdrawn. Encrypted backups are kept for a limited time; if one is ever restored, deletions made after it are applied again. Purchase records the stores need for tax purposes are kept by Apple/Google.

Your rights

You can access, correct, export or delete your data, object to processing or restrict it. Delete your account in the app under Profile → Account & support → Delete account, or email us from any address with your username and we will verify ownership with you. You may complain to the Hungarian data protection authority (NAIH, naih.hu) or your local authority.

Children

QuizHub is rated 12+ in the app stores and is not directed at children under 13. We ask for your birth year when you sign up and do not let anyone under 13 create an account; if we learn that an account belongs to a child under 13, we delete it. If you are under 16, use it only with a parent's or guardian's permission. New accounts keep their city hidden from other players.