Privacy policy

Updated 3 November 2026.

oQuiz is run by House of Buttons AB, a Swedish limited company, company number 559607-0911, Nina Einhorns gata 7, 113 66 Stockholm, Sweden. We are the controller for the personal data described here. For questions about personal data, write to hello@oquiz.app.

What we collect

Your account: the id from the sign-in you choose (Apple, Google, Microsoft or your organisation's single sign-on), your name and avatar, and an email address when the sign-in provides one and we need it, for example for a purchase or to tell you that a quiz is ready.
What you make: quizzes, questions, pictures, recordings and comments, and who you share them with. We remove location data from pictures and recordings.
Games: when phones join a game, team names, avatars, answers and scores pass through our server. Games hosted while signed in are saved to the host's account, with a results page that people with the link can open.
Organisations and training: members and their roles; for training, the names and email addresses of the people invited, their answers, results and certificates; and the identifiers that an organisation's identity provider, learning platform, Slack or Microsoft Teams sends.
Purchases: what you bought, payment ids and, for purchases on the web, the email address you gave the checkout. Card details go to Apple or Paddle, never to us.
Messages and forms: what you send us through the forms on oquiz.app, support or email.
Statistics, only after your yes: how the app, the web panel and the site are used, under a random id and without names or anything anyone wrote. With the same yes, the app also sends the content of your own quizzes and games to our server, to improve oQuiz.
Visits and logs: our server counts visits to oquiz.app without cookies, using a code that changes every day, and keeps technical logs with internet addresses.

What you do only in the app stays on your phone unless you sign in, share or turn on statistics.

Some data does not come from you: an organisation gives us the names and email addresses of the people it invites to training, its services send identifiers, and a host's phone sends the team names and the names of people a quiz is about.

Why, and on what legal basis

Contract: to provide what you use: your account, quizzes, games, organisations, oQuiz AI, the voice, purchases, and answers to forms you send.
Consent: statistics in the app, the web panel and, after the cookie box, on oquiz.app, and emails about the launch. In the app, the host's yes also covers the team names and the names of people a quiz is about. You can withdraw a yes at any time in Settings or under "Cookies" on oquiz.app.
Legitimate interest: running games for the teams that join them, counting visits and results-page openings, keeping the service safe from misuse, and improving the questions and oQuiz AI's suggestions with answers and review decisions without names. We also use answers without names in comparison figures across organisations for oQuiz's own tests, built on at least five organisations and one hundred answers; an organisation can opt out. You can object to any of these.
On an organisation's behalf: training, single sign-on, directory sync, learning platforms and chat integrations. Here we are the organisation's processor under our agreement with it (oquiz.app/dpa), and the organisation is responsible for the legal basis.
Legal obligation: answering requests about your data and keeping what the law requires.

You don't have to give us personal data. Without an account you can still play on your phone.

oQuiz AI

When oQuiz AI writes or checks content, what the task needs, such as a topic, a text or document you choose, a quiz's questions or a picture added to a quiz, is sent to Anthropic, which processes it in the United States. Anthropic may not train its models on it and deletes it within 30 days, unless it is flagged as possible misuse. The answers, names and email addresses of the people who take part are never sent. Don't include private details about other people in what you give oQuiz AI.

Who receives data

We do not sell personal data or share it for advertising.

These companies process data for us, under agreements with us:

Cloudflare, Inc. (United States): our servers, database, file storage, email and logs, stored in the EU.
PostHog Inc. (United States): statistics, in its EU cloud in Germany.
Anthropic (Anthropic Ireland, Limited and Anthropic, PBC, United States): oQuiz AI.
Eleven Labs Inc. (United States): text to speech. It gets only the text to read.
Google (United States): our email inbox.

These use data as independent controllers under their own privacy policies:

Apple, Google and Microsoft for the sign-in you choose, and Apple also for SharePlay, Apple Music, Game Center and App Store purchases.
Paddle.com Market Limited (United Kingdom), which sells what you buy on join.oquiz.app.
Klipy (Kikliko, Inc., United States), which receives your search and your device's internet address directly from your device when you search for a GIF or clip, and may use them for advertising. Its policy names no safeguard for the transfer to the United States.
An organisation's own services, such as its identity provider, learning platform, Slack or Microsoft Teams.

Transfers to the United States are covered by the EU Standard Contractual Clauses, the EU-US Data Privacy Framework, or both. Write to hello@oquiz.app for a copy of the safeguards.

Other people see what you share with them: the people in a quiz, an organisation or a game, and anyone with a results link. We give data to authorities only when the law requires it.

How long we keep it

Account and what you make: until you delete them or your account. Quizzes that belong to an organisation stay with it.
Games: your 200 most recent games; results links and replays work for 30 days; data for a running game is deleted within three days.
Training: as long as the organisation exists, and deleted 90 days after its licences end. A person's name and email address are removed two years after their last activity.
Activity in the panel: 90 days.
oQuiz AI: text sent for writing is deleted when the questions are written; unfinished drafts after seven days.
Messages and forms: support messages for 12 months; other forms until we no longer need them or you ask us to delete them.
Statistics: one year; recordings of visits to oquiz.app for 30 days. Quiz content sent with the statistics yes is kept for three years after the phone last sent anything, and deleted at once if you say no.
Technical logs: seven days.
Purchases: with your account, except payment ids we keep so that a refunded purchase cannot be used again. Apple and Paddle keep their own records.

Cookies and storage

oq_session on join.oquiz.app keeps you signed in, for 30 days.
__Host-oq_oauth is used while you sign in, for ten minutes.
oq_lang on join.oquiz.app and oq_sprak on oquiz.app remember your language, for a year.
sidebar_state remembers whether the panel's menu is open, for seven days.
oq_analys keeps your answer about statistics, for six months.
After a yes, PostHog sets cookies and stores an id in the browser, and on oquiz.app it records visits, with what you type in forms hidden.

A team's browser keeps the team's name and avatar in its storage, so that a reloaded page stays in the game.

Children

You must be at least 13 to have an account or say yes to statistics. A child under 13 needs a parent or guardian, who decides for them. Playing on one phone or joining a game needs no account. If you think we have data about a child under 13 without a parent's yes, write to hello@oquiz.app and we will delete it.

Your rights

You can ask for a copy of your data, have it corrected or deleted, restrict or object to its use, take it with you in a machine-readable format, and withdraw a yes at any time without affecting what was done before. Much of this you can do yourself in the app or on join.oquiz.app; for the rest, write to hello@oquiz.app. We answer within a month and may ask you to confirm that the data is yours. We do not make decisions about you by automated means alone that have legal or similarly significant effects.

If you are in the EEA you can also complain to your data protection authority. In Sweden that is Integritetsskyddsmyndigheten (IMY).

Changes

When this page changes, the date at the top changes. The current version is the one at this address.