Privacy & data

Privacy and data

What we store, what we don't, who else touches it, and how you and your players can control it.

Last updated 2 September 2026

This page is arranged by who's reading it. Find yourself below and read that section — it should answer everything without sending you elsewhere.

The short version

Players never create an account. We store a nickname, a chosen avatar, a score, progress through the game, and any photos they submit. No real names, emails, phone numbers or ages.
We never see card details. Stripe handles payments; we see the last four digits and the card brand, for display.
We don't sell data to advertisers or analytics companies, and we don't run third-party tracking.
Scavenger hunts need location. Coordinates are compared to a challenge inside the player's own browser, and no GPS trace is ever uploaded.
Data is stored in the United States. Transfers from the EU are covered by Standard Contractual Clauses, and from the UK by the ICO's International Data Transfer Addendum.
If you run games for clients, you're the data controller for your players. We process on your behalf.

Responsibility

Who's responsible for what

Two different relationships, worth separating clearly.

For your planner account — your email, name, company, billing status — VVNEX LLC, trading as Quizpedition, is the data controller.

For the people who play your games, you are the data controller and we are your processor. You decide what a game asks for and who plays it; we store and process that on your instructions.

That has a practical consequence. A player is pseudonymous to us — a nickname and a browser token, nothing that reaches a real person without your own records — so a player asking for their data should contact the organisation that ran the game. We can't identify them on our own, but we will always help you answer.

Where a game includes photo answers, you're responsible not only for the fact that images are collected but for what's inside them — identifiable faces, minors, vehicle plates, whatever a player happens to capture — including any permission needed from people who appear in a photo but never played.

Visiting

If you're just visiting this site

Nothing happens. We run no analytics, use no third-party tracking, and set no cookies for anonymous browsing of quizpedition.com. There's no contact form — just an email address, and if you write to us we keep the email so we can reply.

You can read every page here without us knowing you were on it.

One exception, and it's the obvious one: if you follow the Try demo link and join, you're playing a game. The player cookie described in the next section is set at that point, exactly as it would be for any other game. Demo sessions are cleared automatically — by default about a day after you stop playing.

Otherwise that's the whole section. Nothing below applies to you unless you go on to play a game or open an account.

Playing

If you play a game

No account, no signup. Everything here is about the one game you joined.

What we store

Your nickname, the avatar you pick, your score and progress, how many wrong answers you gave, any photos you submit, and a random token in a cookie that identifies you back to that one game.

We don't store your real name, email address, phone number or age. We never ask for them. Joining two games from the same organiser gives you two independent tokens — there's nothing linking you across games, or across any other site.

Location

Scavenger hunt quests need your location. Your coordinates are compared to the quest's points inside your own browser to work out whether you've arrived — nothing about your movement is sent to us or stored.

You can refuse the permission, but a scavenger hunt won't work without it: the map still loads and you'll see where the challenges are, but they won't unlock as you reach them. The other formats — quiz, escape room, marker hunt and time capsule — never ask for location at all.

Camera

Two things in a game use the camera, and they work differently. Scanning a QR marker asks your browser for camera access, so you'll see a permission prompt. Taking a photo for a photo answer opens your device's own camera or picker through the standard file input. That's an operating-system flow, so any prompt you see there comes from your phone, not from the browser and not from us.

Both happen only when you tap the relevant button — the camera is never opened in the background and never stays on between challenges.

If you refuse camera access, a marker challenge falls back to typing the code printed under the QR. A photo challenge can be skipped like any other. Nothing else in the game depends on the camera.

The microphone is never requested. Even on marker scans, we explicitly disable audio when opening the camera.

Photos you submit

If a game asks for photo answers, those images are stored and are visible to the organiser running the game, to whoever is hosting on the day, and — once the organiser approves them — in that game's photo gallery, which anyone holding the join code can open, the same as the leaderboard. They're deleted when that game is deleted.

The cookie that remembers you

One cookie per game you join — qp_player_<join code>. A random token with no personal information in it, tying you back to that one game. It expires after 90 days, because events can run over weeks.

This token is how we know who you are; there's no account behind it. We keep a copy in your browser's local storage as well, so clearing cookies alone doesn't lose your place.

If you lose your place

If your token is gone — cleared browsing data, a new phone, or opening the link in a different browser — you can ask to recover your nickname.

We generate a short numeric code that the host of that game reads out from their Reclaims panel; you type it back to prove the nickname is yours. The code exists only on our server, is tied to one nickname in one game, and works once: a successful use consumes it, three wrong attempts void it, the host can dismiss it, and generating a new code replaces the previous one. Players a host has removed from a game can't recover access — the removal is deliberate.

Along with each request we keep a truncated SHA-256 hash of the requester's IP address, so a host can tell whether several requests are coming from the same source. The hash is salted with the game's own identifier — the same IP produces a different hash in a different game, so nothing about it can be used to link a player across games. Even so, a hashed IP can in principle be brute-forced back to the original, so we treat it as pseudonymised personal data rather than anonymous.

The code and the hashed IP are deleted the moment the request is used, dismissed or voided, or when the game ends — whichever comes first.

How long your data lasts, and your rights

Everything above lives until the organiser deletes the game or their account — then it goes with it. If you want a copy of your data, or want it removed sooner, contact the organisation that ran your game; they decide, and we'll help them act on it. You can also complain to the data protection authority in your own country.

Running games

If you run games

What we hold

Your account: email address, name, a hashed password, your plan and billing status. Company name and profile picture if you choose to add them.

What you build: game settings, quests, challenges, scoring rules, branding — logo, colours — and any media you upload.

Your players: the data listed in the player section above, per game.

Insights: aggregated statistics for your Insights tab — scores, timing, drop-off — calculated from your players' data.

What we never store

Card numbers, security codes, expiry dates. All payment data lives with Stripe. We see the last four digits and the card brand so you can tell which card is on file.
Players' real names, emails, phone numbers or ages. The nickname a player picks is the only identity we hold.
GPS traces. Location is compared to a point in the player's browser, never uploaded.
Anything linking a player across games, or across other websites.

What Stripe sees: your email address, name, company name and subscription details. Card data goes from your browser straight to Stripe and never passes through our servers, which is why we can show you the last four digits but nothing more.

Your account security

Your password is stored using scrypt and is never recoverable in plain text. Your session is a signed qp_session cookie — HttpOnly, Secure, SameSite=Lax — which expires seven days after you sign in and does not extend as you use the app. A week after your last sign-in you'll be signed out and asked to sign in again.

The fixed window is deliberate. Because it doesn't slide, a leaked cookie stops working within a week no matter what the holder does with it.

Changing your password, or deleting your account, signs out every outstanding session immediately, on every device. Multi-factor authentication isn't available on planner accounts today.

Cookies

A small number of strictly necessary cookies, all first-party, plus one copy of the player token in local storage. No advertising or analytics cookies, which is why you won't see a consent banner here.

qp_session is your login, described above. qp_player_<join code> is the player token, described in the player section. qp_test_<join code> is set when you preview your own game from the editor, so your test plays don't count toward analytics, billing or the leaderboard. It expires after an hour, or is replaced the next time you preview that game.

Three more appear only in particular circumstances. qp_qul_<join code> is set when a player enters a codeword, so they don't have to retype it on every page. host_<join code> is set when someone unlocks the host console with the game PIN. qp_sandbox_pending is set briefly during signup to remember that a sandbox game needs creating once your email is verified, and clears within minutes.

How long we keep it

Player data — until you delete the game, or delete your account.
Test plays and demo plays — the preview data you create when you walk through your own game using the Test button, and the sessions created by anyone trying the public demo. A background job clears both automatically, by default about a day after the session was last active. Clear test data in the game editor removes your own test rows immediately, and they also go when you delete the game or your account. That button removes test rows only — live player data is never affected.
Your account — 30 days after you ask us to delete it, or immediately if you'd rather not wait. See below.

Getting your data out

Export a Players CSV from any game's Insights tab — the final leaderboard, per-player scores and timing. The same file is offered when you delete a game that has real player data, so you can keep the results.

Deleting a game

Deleting a game takes everything with it: player records, per-challenge progress, photo submissions. Media library items stay, since they may be used by other games — delete those separately from the library.

Deleting your account

Before you can

If any of your games is currently live, deletion is blocked until it finishes — we won't let an account close in a way that strands players in the middle of an event. Draft games don't block deletion. You can download everything first: one click exports your games, quests, challenges, media and tags as a single archive.

Straight away

Your account and games become invisible immediately, and every session is signed out — so if a login cookie had ever leaked, it stops working the moment you click delete. Your subscription is cancelled at the same time.

The next 30 days

We hold everything in case you change your mind. Restore it from the link in your deletion email, or just try to log in — we'll offer to bring it back. Everything returns intact, though your subscription isn't restarted automatically; that's a deliberate step from Billing. Your email address can't be used to open a new account during this window.

At day 30

Everything goes. Uploaded media and every player photo are deleted from storage, any custom domain is deregistered, your Stripe customer record is deleted, and every row in our database — games, quests, players, progress, photos, the account itself — is removed.

If you'd rather not wait

Immediate deletion, with no grace period and no restore, is available from the same confirmation screen.

What survives, and why

A dated record that a deletion happened — when, whether it was immediate or after the grace period, the reason you gave if you gave one, and the email address and name you had at that moment. The link back to your account is removed at day 30, but the audit row itself is kept. We keep this to be able to show the request was honoured.
Stripe's own invoice records. Stripe retains these to meet its financial-record obligations, under its own policy. Once your customer record is deleted we can no longer see them either.
Routine service logs at Cloudflare and Resend, which age out on their own schedules — typically 30 to 90 days.

Custom domains

With the white-label add-on, players reach your games on your own domain and never see the quizpedition.com hostname. Setup is three DNS records at your own provider. The certificate is issued and renewed by Cloudflare, which terminates HTTPS at its edge — neither you nor we ever hold the private key, and customer-supplied certificates aren't supported. We don't operate a mail server on your domain.

On a custom domain your players never encounter quizpedition.com, so your own privacy notice is the only one they'll see. You're welcome to link to this page or lift from it.

Your rights

Portability is self-service — you don't need to ask. The full account archive and the per-game Players CSV described under Getting your data out above are both one click, in open formats, at any time.

You can also ask us for a copy of the data we hold about you, ask us to correct it, ask us to delete it, or object to how we use it. Email privacy@quizpedition.com and we'll respond within 30 days. You can also complain to the data protection authority in your own country — for EU residents your national supervisory authority, and in the UK the Information Commissioner's Office.

Reviewing

If you're reviewing us

For legal, privacy and IT reviewers. Everything a security questionnaire usually asks, in one place.

Where data is stored

Game and player data is held in a Postgres database hosted on Railway in the United States (US West). Uploaded images, including any photos players submit, are stored on Cloudflare's global storage network, which selects a storage region automatically. Data at rest is encrypted in both places.

If a game runs on a custom domain, its requests additionally pass through a reverse proxy we run on a virtual server in the European Union. That server routes traffic; it isn't where data comes to rest, and it keeps no access logs — no request paths, query strings or player IP addresses are written to disk there. On our own hostnames it isn't in the path at all.

International transfers

If you're in the EU or the UK, that means data is transferred to the United States. Those transfers are covered by the European Commission's Standard Contractual Clauses, with the UK Information Commissioner's International Data Transfer Addendum applied to transfers from the United Kingdom. If you need a data processing agreement for your own records, email privacy@quizpedition.com.

Who else touches it

Seven, and no more.

Service	What for	What they see
Stripe	Billing and subscriptions	Your payment details. Players never interact with Stripe.
Railway	Hosting the app and database	Everything we store, as our infrastructure provider.
Cloudflare	Image storage and delivery; edge and HTTPS termination for custom domains	Uploaded images, and a player's IP as their browser loads one. On a custom domain, that game's traffic as HTTPS terminates at its edge.
Hetzner	Virtual server running our reverse proxy — custom domains only	Traffic for games on a custom domain, in transit, and IPs briefly. No access logging is enabled — nothing per-request is written to disk.
OpenFreeMap	Map tiles on outdoor quests	A player's IP briefly, as their browser requests tiles.
Komoot	Address search in the map editor — planners only	The place name a planner types when positioning a challenge, and their IP as their browser sends it. Players never reach this service.
Resend	Signup confirmations, password resets, receipts	Your email address, for delivery.

We don't sell planner or player data to advertisers or third-party analytics companies. We give advance notice before adding or replacing a sub-processor, so you have time to object or make your own arrangements. The notice period is set out in our data processing agreement.

Security

All traffic is HTTPS. Passwords are stored using scrypt. Rate limiting is applied across every write path a bad actor might abuse — sign-in, sign-up, password reset and change, account restore, host PIN entry, quest and challenge unlocks, codeword and marker entry, photo upload and custom-domain verification among them. Access to production systems is limited to a small number of named people with multi-factor authentication enforced, and dependency vulnerability scanning is enabled and monitored.

We hold no SOC 2 or ISO 27001 certification and have not commissioned a third-party penetration test. We'd rather say so here than have it surface later in your review.

If something goes wrong

If we become aware of a personal data breach affecting your data, we'll notify you without undue delay, with what we know at the time: what happened, what data was involved, what we're doing about it, and what we recommend you do. Where the information isn't all available at once we'll send it in stages rather than delay the first notice.

Changes to this page

If we change how we handle data we'll update this page and change the date at the top. For anything material we'll email account holders rather than relying on you to check.

Contact

Data protection questions, data requests and data processing agreements: privacy@quizpedition.com. Anything else: info@quizpedition.com.

Quizpedition is operated by:

VVNEX LLC
225 Roy St
Seattle, WA 98109
United States