Privacy Policy

This page explains what information Challenger Quiz (the "Service"), operated by Elliot McDonald, collects and how it's used.

1. What we collect

Depending on how you use the Service, we hold:

• Host accounts: a username and a hashed password. We never store your password in plain text.
• Quiz data: quiz, team, season and score information a host enters or imports, including files exported from third-party quiz software.
• Team access: a team name and an access code, used to view that team's own results. No personal details or password are needed.
• QR code logins: a host can show a team a QR code that logs it in. The link in it works once, within 10 minutes. We store only a fingerprint of the link (a SHA-256 hash), with the team, the host login that created it and when it was created and used. The team's access code is never in the link.
• Quiz feedback: a team's 1 to 5 rating of a quiz night and any comment it adds, for that quiz's host. If the team ticks "Send without our team name", the rating is stored with no team attached, and the host can't see which team sent it. We keep only a code made from the team and the week with a secret key, so the same team can't rate that week twice; it isn't shown to anyone.
• App feedback: the message you send about the Service, the page you sent it from, and your account or team. Only the operator reads it.
• Spotify connection: if a host connects Spotify to fill music rounds, we store their Spotify user id, display name and the access and refresh tokens Spotify issues, with the tokens encrypted. We only read the playlists the host owns or collaborates on. Disconnecting Spotify, or deleting the login, deletes all of this.
• Team comparison: within a quiz, a regular team's topic and round type results (the share of questions it got right) are visible to the other regular teams in that quiz, who can compare them with their own. The host can turn team comparison off for the quiz.
• Usage events: basic activity records (for example, a page was viewed or a team logged in) tied to a quiz, team or account, used to understand how the Service is used. They aren't shared or sold.
• Usability analytics: which kind of page was viewed and for how long, whether on a phone, tablet or computer, and steps such as a QR code login or a guided tour. For a logged-in host or team, a random journey key kept in the existing session cookie links these so a visit can be followed page by page. Visitors who aren't logged in are only counted, with no ids. No IP address or browser details are stored, and no outside analytics service is used. The detailed records are deleted after 12 months; daily totals are kept.
• Request access: the email address you enter on the landing page and when you entered it, used only to contact you about access.
• Cookies and browser storage: see "Cookies and third-party requests" below.

2. How it's used

Your data is used only to operate the Service for you: running your quizzes, showing standings, generating analytics and keeping your account secure. We don't sell it, and we don't use it for advertising.

3. Data isolation between hosts

Each host's data is scoped to that host and isn't visible to other hosts using the Service. The person who operates the Service can access data across hosts where necessary for support, maintenance, or the usage and usability figures described above.

4. Cookies and third-party requests

The Service sets two cookies. The session cookie keeps you (or a team) logged in, and lapses after 30 days without a visit. The team cookie (cq_guest) keeps a team logged in for up to 400 days: it holds the team and a fingerprint of the team's access code, signed so it can't be altered. Logging out deletes it, and a new team code from the host ends every team cookie for that team. The team welcome tour also saves a flag in your browser's storage so it only shows once on that device.

None of these track you, advertise to you or follow you across other sites, so there's no cookie consent banner. The Service doesn't load fonts, styles or scripts from any third party: everything the page needs is served directly by us.

5. Subprocessors

The Service runs behind Cloudflare, which handles the network connection between your browser and our server (including TLS/HTTPS) and so sees your IP address and connection metadata. It doesn't see your account password, and isn't given any quiz data beyond what passes through as part of normal page delivery.

When a host connects Spotify, the Service sends Spotify the requests needed to sign in and list that host's playlists. When a host pays for Pro, Stripe handles the payment and holds the card details; we store only the Stripe customer and subscription ids and the subscription's status. No other third party processes your data.

6. Data retention

Data is kept for as long as your account or quiz is active. Deleting a quiz or team through the Service removes the associated data immediately, including its quiz feedback and notifications. Deleting your account through the Service removes your login and its Spotify connection; if you're the only login on your account, this also removes every quiz and all associated data under it. If your account is shared with a teammate, deleting your own login leaves the shared quiz data in place for them. Activity records that can't be usefully deleted outright (for example, a record that a login happened) are anonymised instead: the record is kept, but no longer linked to you. Detailed usability analytics are deleted after 12 months. Routine backups may keep a copy for a limited period afterwards; see the operator's backup schedule for how long.

7. Your choices

You can delete your own account at any time from your dashboard, and download a copy of your account's quiz data there too. A host can disconnect Spotify, turn team comparison off for a quiz, and give a team a new code, which ends every team cookie for that team. For anything else, such as correcting data, a request about a team access code, or removing your email from the access list, contact [email protected] or the person who manages your account.

8. Changes to this policy

This policy may be updated from time to time. Continued use of the Service after a change means you accept the updated policy.

9. Contact

Questions about this policy can be directed to [email protected].

See also our Terms of Service.