Privacy Policy

Last updated: 2026-09-14 Effective date: Upon app launch on the Apple App Store

This Privacy Policy explains how QuizVibe (“we”, “us”, “the app”) collects, uses, and protects your information when you use our mobile application. We’ve tried to write it in plain English with the legal anchor points clearly marked.

QuizVibe is operated by LoMaCo AB (org. no. 559388-9511), a limited company (aktiebolag) registered in Sweden. For any privacy-related questions or requests, contact us at: info@quizvibe.se.

TL;DR (the short version)

We collect the minimum information needed to make the app work: your player name, avatar choice, birth year, region preference, and game scores.
We use Supabase (EU-hosted in Ireland) as our backend database, and YouTube IFrame Player to play video clips inside the app.
We do not sell your data, do not show ads, and do not track you across other apps or websites.
You can delete your account at any time directly in the app (Profile → tap your name in the top-right → Delete Account).
The app is intended for users 15 years or older.

The rest of this document is the full version.

1. Who we are and how to contact us


Operator	LoMaCo AB (org. no. 559388-9511), registered in Sweden
Contact email	info@quizvibe.se
App name	QuizVibe
Platforms	Apple App Store (iOS)

LoMaCo AB is the data controller for the personal data described in this policy. If our company information changes, we will update this policy and notify users via the app.

For data protection requests, complaints, or questions about how we handle your information, email us at info@quizvibe.se. We aim to respond within 30 days as required by GDPR Article 12.

2. What information we collect

2.1 Information you give us directly

When you register an account or join a game as a guest, we collect:

Player name — the name you chose for the game. You pick it; we don’t generate it from anything else.
Avatar selection — which avatar icon you picked.
Birth year — used to calculate your “Competition Age” (which affects gameplay difficulty calibration) and to enforce age-appropriate restrictions.
Region preference — Sweden / Nordics / Europe / Global, used to filter quiz content. This is not your physical location — it’s your content scope choice.
Email and password (registered users only) — for account authentication.

Guests do not provide email/password. Guests are identified by an anonymous session ID that we delete when you leave.

2.2 Information generated by using the app

Game history — your scores, dates, settings used (Game Era, response time, assistance level). Stored on your device and synced to our backend.
Lobby state — which room codes you’ve joined or created, who else is in the room. Auto-deleted after 24 hours.
Anonymous user ID — guests are assigned a temporary UUID for state persistence. No personal information attached.

2.3 Information we automatically collect

In-app actions for analytics — e.g., “user registered”, “game completed”, “purchase made”. We log event names, not personal content.

2.4 What we do NOT collect

Your physical location (no GPS, no IP-based geolocation for marketing).
Your contacts, photos, microphone, or camera — the app doesn’t ask for these permissions.
Cross-app tracking data — no advertising IDs, no SDK that follows you across apps.
Behavioral profiles — we don’t infer interests, demographics beyond your stated birth year/region, or political/religious/health information.

3. How we use your information

We use the information above for these specific purposes:

Purpose	Information used	Legal basis (GDPR)
Run the game (matchmaking, leaderboards, scores)	Player name, avatar, scores, lobby state	Contract (Article 6(1)(b))
Calculate Competition Age + content age-tuning	Birth year	Contract (Article 6(1)(b))
Filter quiz content to your region/era	Region preference, birth year	Contract (Article 6(1)(b))
Authenticate registered users	Email, password	Contract (Article 6(1)(b))
Improve the app (fix bugs, balance gameplay)	Anonymous analytics events, crash logs	Legitimate interest (Article 6(1)(f))
Process in-app purchases	Apple StoreKit handles this — we only receive purchase confirmations	Contract (Article 6(1)(b))
Prevent abuse (bot signups, profanity in names)	IP address (rate-limit only, not stored long-term), player name	Legitimate interest (Article 6(1)(f))

We do not:

Sell or rent your data to anyone.
Use your data for advertising (we don’t show ads).
Profile you for marketing purposes.
Train AI models on your data.

4. Third-party services

QuizVibe uses these external services to function:

4.1 Supabase (backend database and authentication)

We use Supabase (https://supabase.com) to store account data, game history, and lobby state. Our Supabase project is hosted in the EU (Ireland, eu-west-1), so your data stays in the EU.

Supabase has its own privacy policy: https://supabase.com/privacy

4.2 YouTube API Services (video playback)

QuizVibe uses YouTube API Services — specifically the YouTube IFrame Player — to play embedded video clips inside the app. By using the parts of QuizVibe that play these clips, you are also agreeing to the YouTube Terms of Service (https://www.youtube.com/t/terms), and the way Google handles your data is described in the Google Privacy Policy (https://policies.google.com/privacy).

When a video plays, your device communicates directly with YouTube’s/Google’s servers to stream the content. This means Google receives information about your device (such as IP address, browser-like device info, and the video being watched) per Google’s own data collection practices. The embedded player runs in a sandboxed web view inside the app.

What QuizVibe collects, stores, and uses via YouTube API Services: nothing. We do not send YouTube any of your QuizVibe account information, and we do not receive, store, or log any YouTube user data, viewing history, or Google account data. All such data is collected by Google directly, not by us.

Revoking access: you can review and revoke any access that Google-connected apps and services (including YouTube) have to your Google account at Google’s security settings page: https://myaccount.google.com/permissions.

4.3 Apple StoreKit (in-app purchases)

In-app purchases (credit packs, themed packages, subscriptions) are processed entirely by Apple StoreKit. We never see your credit card, Apple ID password, or billing address. Apple sends us only a transaction confirmation indicating which product you bought.

Apple’s Privacy Policy: https://www.apple.com/legal/privacy/

4.4 GitHub (source code, hosting this Privacy Policy)

Our app’s source code and this Privacy Policy document are hosted on GitHub (https://github.com). This doesn’t process user data from the app itself — it’s just where the code lives.

GitHub’s Privacy Policy: https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement

4.5 Spotify (optional track playback)

Some questions can be played from Spotify. When you choose to play a track, QuizVibe simply opens the Spotify app on your device via a standard link (a deep link).

QuizVibe does not connect to, sign in to, authenticate with, or exchange any data with Spotify. There is no Spotify account linking, no login, and we do not receive or store any Spotify tokens, listening history, or account information. QuizVibe never learns anything about your Spotify account.

Once the Spotify app opens, any personal data is handled by Spotify under Spotify’s own Privacy Policy: https://www.spotify.com/legal/privacy-policy/

5. How long we keep your data

Data type	Retention period
Registered user account (profile, game history, and your email address — which is personal data)	Until you delete it. Delete in-app via Profile → tap your name → Delete Account. Email info@quizvibe.se if you need help.
Guest anonymous session	Until you leave the game (immediate) or 30 days of inactivity.
Lobby state (room codes, player list)	Auto-deleted 24 hours after the lobby was created.
Analytics events (anonymized)	90 days, then aggregated and de-identified for long-term retention.
IP addresses (rate-limit tracking)	1 hour, then automatically purged.
In-app purchase records	7 years (Swedish accounting law requirement — Bokföringslagen).
Backup copies of the above (personal data in backups)	Backups are rotated and any personal data in them is deleted within 30 days, so deletions propagate to backups within that window.
YouTube API data	We do not cache or store YouTube API data. To the extent any YouTube API data were ever stored, it would be deleted within 30 days, as required by the YouTube API Services Terms of Service.

If you are in the EU, EEA, or UK, you have the following rights regarding your personal data:

Right to access — request a copy of all data we hold about you.
Right to rectification — correct inaccurate data.
Right to erasure (“right to be forgotten”) — delete your account and associated data. You can do this yourself in-app: Profile → tap your name in the top-right → Delete Account. Server-side data is removed automatically. Email info@quizvibe.se if you need help.
Right to restrict processing — pause our use of your data.
Right to data portability — get your data in a machine-readable format (JSON export).
Right to object — object to processing based on legitimate interest.
Right to withdraw consent — where we rely on consent (currently we don’t, but if that changes you can withdraw).

To exercise any of these rights, email info@quizvibe.se with the subject “GDPR Request” and describe what you want. We will respond within 30 days.

You also have the right to lodge a complaint with a supervisory authority. In Sweden, that’s the Integritetsskyddsmyndigheten (IMY): https://www.imy.se

7. Age restrictions and children’s privacy

QuizVibe is intended for users 15 years of age or older.

The app enforces this by limiting the birth-year picker in registration to dates corresponding to a minimum age of 15. Users cannot register or play as a guest with a birth year that would make them younger than 15 at the time of registration.

We do not knowingly collect personal information from children under 15. If you are a parent or guardian and believe your child under 15 has somehow registered (e.g., by misrepresenting their age), contact info@quizvibe.se and we will delete their account and associated data.

For users between 15 and 16 in the EU: under GDPR Article 8 (and Swedish implementation), processing of personal data based on consent for users under 16 requires parental authorization. QuizVibe currently relies on Contract and Legitimate Interest as legal bases (Article 6(1)(b) and (f)) — not Consent — for its core processing. This means parental authorization is not strictly required to use the app’s normal features. However, we still recommend that parents are aware of and approve of their teenager’s app usage.

8. How we protect your data

We use these security measures:

HTTPS/TLS for all data transmitted between the app and our backend (Supabase enforces TLS 1.2+).
Password hashing via bcrypt (handled by Supabase Auth) — we cannot see your password.
Row-Level Security (RLS) in our database — users can only access their own data via authenticated queries.
Per-IP rate limiting on anonymous signups to prevent bot abuse.
No raw user data in source code — the app is open source, but credentials and data live in the backend.

Despite these measures, no system is 100% secure. If a data breach occurs that affects your personal information, we will notify you and the supervisory authority (IMY in Sweden) within 72 hours as required by GDPR Article 33.

9. International data transfers

Our backend (Supabase) is hosted in the EU (Ireland). Your data does not leave the EU for storage.

The YouTube IFrame Player communicates with Google’s global infrastructure, which may include servers outside the EU. Google relies on Standard Contractual Clauses (SCCs) for these transfers under GDPR. We have no control over Google’s infrastructure, but their compliance is documented at https://policies.google.com/privacy

GitHub (where this Privacy Policy document is hosted) is operated by Microsoft and includes US-based infrastructure. GitHub relies on Standard Contractual Clauses for EU data transfers.

10. Cookies and tracking technologies

The app does not use cookies (it’s a mobile app, not a website). We do not use:

Advertising identifiers (IDFA, AAID).
Third-party analytics SDKs that track behavior across apps.
Cross-site tracking pixels.

We use AsyncStorage on your device to persist your preferences (login session, profile, game history). This is local-only and is not transmitted to us unless required for app functionality (e.g., syncing scores).

One exception is outside our control: the embedded YouTube player runs in a web view, and Google may set its own cookies or similar technologies while a clip plays. Those cookies are controlled by Google (not by QuizVibe), are governed by the Google Privacy Policy, and are described in Section 4.2. QuizVibe itself sets no cookies.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we do:

The “Last updated” date at the top of this document will change.
For material changes (changes that affect your rights or how we handle your data), we will notify you via an in-app message and require you to acknowledge before continuing.
For minor changes (typo fixes, clarifications), we will not actively notify but the updated version will be available at the same URL.

Your continued use of the app after a policy change constitutes acceptance of the new policy. If you don’t agree with the changes, please delete your account before continuing.

12. Disputes

If you have a dispute with us about privacy that we cannot resolve through email, the dispute will be governed by Swedish law and subject to the jurisdiction of Swedish courts (Stockholms tingsrätt as the court of first instance).

13. Contact

For all privacy-related inquiries:

Email: info@quizvibe.se Subject line: Please prefix with “Privacy:” for faster routing (e.g., “Privacy: data export request”)

For non-privacy support (gameplay questions, bug reports, feature requests), the same email works — just use a different subject line.

This Privacy Policy is provided in English. A Swedish translation may be added in a future version.