Privacy Notice

What we collect and why

• Account data — email address, password hash (or Google sign-in identifier), display name, email-confirmation status. Used to create and secure your account and to verify you before AI prompts are spent. Legal basis: performance of our contract with you.
• Content you create — quiz briefs, prompts, questions, generated artwork and your chat with the AI producer. Used to provide the service and to show you your own work. Legal basis: contract.
• Live session data — the nicknames, avatars, answers, response times and scores of everyone who joins a game with your code. Players join with a nickname only; we do not ask them for an email address or any account. Used to run and score the game. Legal basis: contract with the host, and our legitimate interest in operating the game for players.
• Prompt and purchase records — how many prompts you have used and which packs were granted, revoked or refunded, plus the provider's transaction identifier. Used for entitlement and fraud prevention. Legal basis: contract and legitimate interests.
• Technical and usage data — IP address, device and browser information, error reports and request logs. Used for security, abuse prevention, debugging and improving the product. Legal basis: legitimate interests.
• Support messages — what you send us when you ask for help. Legal basis: legitimate interests.

We do not require any special-category data and ask you not to put it into prompts. Card details never reach us — they are collected by Paddle.

Who we share it with

• Paddle, our merchant of record, for the sale of prompt packs, payments, invoicing, tax compliance and refund handling. Paddle acts as its own controller for payment data.
• Infrastructure and AI providers — our hosting and database platform, and the AI providers that generate quiz text and images from your prompts. They act as processors on our instructions. Prompt content is sent to the AI provider to produce your quiz.
• Professional advisers (legal, accounting) and authorities, where we are required or permitted by law.

We do not sell personal data and do not share it for third-party advertising.

International transfers

Some of our providers process data outside the EEA, including in the United States. Where that happens we rely on an adequacy decision or on the European Commission's Standard Contractual Clauses together with additional technical safeguards such as encryption in transit and at rest.

How long we keep it

Account data and your quizzes are kept while your account is open, and deleted or anonymised within 90 days of account deletion. Live session records are kept for 12 months so hosts can revisit results. Purchase and refund records are kept for as long as tax and accounting law requires. Logs and error reports are kept for up to 12 months.

Your rights

Under the GDPR you can ask us to give you access to your data, correct it, erase it, restrict or object to our processing, or export it in a portable format, and you can withdraw consent where we relied on it. You can change your email address and password yourself in account settings. We respond within one month. You also have the right to complain to a supervisory authority — in Sweden, the Integritetsskyddsmyndigheten (IMY).

To exercise any of these rights, contact us through the support channel on your account. For anything about an order or invoice, Paddle is the faster route at paddle.net.

Security

We use appropriate technical and organisational measures: encryption in transit, encryption at rest for stored data, row-level access rules so one account cannot read another's quizzes, hashed player tokens, and least-privilege access to production systems.

Cookies and local storage

Tossup uses only essential cookies and local storage: keeping you signed in, holding a player's session token so they can rejoin a game after a dropped connection, and remembering basic interface state. We do not set advertising or cross-site tracking cookies, so there is no consent banner to manage. You can clear this data in your browser settings, which will sign you out.

Children

Tossup accounts are for people aged 16 and over. Players who join a game with a code do not create accounts; hosts are responsible for the rooms they run.