Privacy policy
The Croatian version of this policy is binding; this is a translation.
In short
- For an account we need your name, email and password. We store the password only as a hash.
- Players do not need an account. The game needs only a team name and answers. We process that data on behalf of the quiz organizer.
- At sign-in we record your IP address and browser, to protect your account.
- We do not sell data or use it for advertising. We share it only with service providers we need to run the app (hosting, database, email, AI); some are in the USA.
- Analytics in the browser, screen recordings with errors and YouTube videos load only with your consent.
- We keep data only as long as we need it; the periods are in the table.
- You can delete your account yourself in the settings. For all other rights, write to hello@sipnscore.eu.
1. Who we are and how to contact us
The controller is [NAZIV], [ADRESA], OIB [OIB]. Contact for all data questions: hello@sipnscore.eu.
We have not appointed a data protection officer because Art. 37 GDPR does not require one from us: we are not a public authority, and our core activities do not involve regular and systematic monitoring of data subjects on a large scale or large-scale processing of special categories of data. [PRAVNIK: confirm]
2. Which part is for whom
| If you are... | Read |
|---|---|
| an organizer or venue member | Account and service, Analytics, Rights |
| a player without an account | Players and organizers, Rights |
| a player with an account | Account and service and Players and organizers |
| a person invited to a team by email | Team invitations |
| a website visitor | Cookies, Diagnostics |
3. What we process, why and on what basis
The legal bases are from Art. 6(1) GDPR: (a) consent, (b) performance of a contract (the Terms of use), (c) legal obligation, (f) legitimate interest. For legitimate interest we say which one.
| Processing | Data | Purpose | Basis | Period |
|---|---|---|---|---|
| Account | name, email, password (hash), email confirmation, plan, role, version and time the terms were accepted | opening and running the account | (b) | while the account exists; inactive account 24 months after the last sign-in or activity, with an email warning 30 days before deletion; unconfirmed 30 days after sign-up |
| Sign-in and security | IP address, browser (user agent), sign-in time, sign-in renewal records | protecting the account from misuse | (f) security of the account and the service | 30 days after the sign-in expires |
| Rate limiting | IP address, account ID | protection against overload and password guessing | (f) security of the service | until the time window ends, at most 1 hour [PROVJERITI: key TTL in Upstash] |
| Quizzes and venues | quizzes, questions, images, audio, links, venue details | the service | (b) | until you delete them or your account; files on S3 are deleted with the account |
| Community | public quizzes with your name, ratings, copies | sharing quizzes | (b) | while the quiz is public or a copy exists |
| Standing teams | team name, image, members | playing in a standing team | (b) | while the team exists; the team image is deleted with the account |
| AI generation | topic, notes and quiz settings, research queries | suggesting questions | (b) | with us: while the quiz exists; with processors: see Recipients |
| Transactional emails | email, name, email content | email confirmation, password reset, email change, account deletion, invitations, quiz rating notice, moderation and account block decisions | (b); rating notice: (f) so you know how your quiz was received; turn it off in the account settings or with the link in the email | logs at the provider: 30 days |
| Notice to administrators | new user's name and email | reviewing new sign-ups and preventing misuse | (f) operation and security of the service | 90 days, then administrators delete them by hand |
| Server-side analytics | see Analytics | (f) | ||
| Diagnostics | see Diagnostics | (f), recordings (a) | ||
| Cookie consent | consent ID, choice, version, time, account ID if signed in; no IP address or browser | proof of consent | (c) Art. 7(1) GDPR | 3 years [PRAVNIK: is the period appropriate]; on account deletion the record is unlinked from the account and kept until the period ends |
| Content reports | report, reporter's account, decision | handling under the Digital Services Act | (c) | 12 months after the decision; a report never decided, 12 months after it was made; on account deletion the report is unlinked from the account and kept until the period ends |
| Connecting Claude | access tokens (name, token hash, scopes, expiry, last use); connected apps (app name and address, the scopes you allowed, renewal token hash, times); tool call records (tool, quiz ID, outcome, time, no question content) | letting Claude create and edit your quizzes once you connect it | (b); call records: (f) security and support | tokens and connections until you revoke them or while the account exists; renewal tokens 30 days after expiry; call records 180 days |
We get the account data from you. We make no automated decisions with legal or similarly significant effects on you (Art. 22 GDPR).
4. Players and organizers
When you play a quiz, the quiz organizer (the venue or person who started the session) decides about your team's data. They are the controller, and we process the data on their behalf under the processing agreement.
What we process in a session: team name, avatar (the look picked in the character creator) and colour, answers (text, numbers, choices, points on a map, drawings and photos), answer time and points, presence (whether the team is connected) and fair-play records. When the organizer uses paper sheet reading, also the photo of the sheet, which can show handwriting and the team name.
You do not need a name or email. If you join as a signed-in user, the session is linked to your account so you see the history of your quizzes, and after the quiz you can add team participants (account or email address).
How long:
| Data | Period |
|---|---|
| Session results, standings and team names | Kept for good |
| Raw player answers, including drawings and photos | 12 months after the session ends, then deleted (scores stay) |
| Anti-cheat records | 12 months |
| Team member email addresses entered in a session | 12 months after the session |
| Live session data (Convex) | 1 hour after the session ends; unfinished sessions after 24 hours |
| Scans of answer sheets | 30 days [PROVJERITI: čeka GI-11] |
Rights of players without an account: contact the organizer or us at hello@sipnscore.eu. Without an account we cannot reliably identify you (Art. 11 GDPR), so we need the session code, team name and approximate time of the quiz. We forward the request to the organizer and help them carry it out.
Fair-play checks
During a question the app records when a player leaves the app or switches browser tabs, and when they send an answer more than once. Only the organizer sees the records. The app decides nothing by itself: the organizer decides on consequences. The records are kept for 12 months.
5. Team invitations
If someone invites you to their standing team, they entered your email address. We send you one invitation email. We use your email only for that invitation, based on the legitimate interest (f) of the person inviting you to add you to the team. The invitation expires after 7 days and is deleted 90 days after the invitation expires. If you do not want invitations, contact us at hello@sipnscore.eu.
6. Artificial intelligence
- Suggesting questions: when you ask for AI questions, the topic, your notes and the quiz settings go to Anthropic (the Claude model). We do not send your name, email or account ID. For topic research, queries derived from the topic go to Tavily, and the app also reads public web pages from the results.
- Reading paper sheets (OCR): the sheet photo goes to Anthropic, which fetches it from our link. The sheet can show handwriting and the team name.
- Under its commercial terms Anthropic may not train models on our data. It deletes inputs and outputs within 30 days; content flagged as breaking its usage policy can be kept for up to 2 years. Anthropic processes the data in the USA.
- Under its privacy policy Tavily may use parts of queries to improve its service. A query contains only terms from the quiz topic, not your data.
[PRAVNIK: Tavily has no public DPA or DPF certification; is the transfer allowed] - Quiz images through Claude (MCP): when Claude makes an image for your quiz with the generation tool, the text description of the image goes to OpenAI (the GPT Image model). We do not send your name, email or account ID, and the description must not contain personal data. The finished image is stored with us like any other quiz image. Such images are made by artificial intelligence and do not show real people. Under its terms OpenAI does not train models on data sent through its API, keeps logs for up to 30 days to detect abuse, and processes them in the USA.
[PRAVNIK: OpenAI is not an active processor yet; the data processing agreement is not signed; this paragraph applies only once generation is switched on] - The organizer checks the AI output. AI makes no decisions about people.
7. Analytics
- Activity days (our database): we record the days you used the app, linked to your account ID. We need them to run and secure the service, for example to know which account is inactive. The basis is legitimate interest (f). The analytics switch does not stop them. Period: 25 months.
- Product analytics (PostHog): we send some actions in the app (for example a quiz started) to PostHog in the EU (Frankfurt), with your account ID, plan and role, without IP addresses. The purpose is to understand how much the app is used and improve it. The basis is legitimate interest (f). You can object with the switch in the account settings ("Do not use my data for product analytics"); after that your actions are no longer sent to PostHog. Period: 12 months.
- In the browser: only with your consent for the "Analytics and error recordings" category (see Cookies).
- Players: we do not track players without an account. On the join and play pages, the TV screen and the presentation, browser analytics never loads. If you join a quiz signed in, we record that you joined a session.
8. Diagnostics and errors
Sentry (EU region) receives three kinds of data even without your consent, on every page, the TV screen and the presentation included:
- errors: what the error was, where it happened and the page address without parameters,
- release health: a random browser session ID, the app release and whether the session ended in an error,
- performance: for about 10% of page views, how long loading, navigation and requests took, with addresses without parameters.
If you are signed in, your account ID goes with it. We do not send cookies, headers, your browser (user agent), the page you came from or request content. Before consent Sentry stores nothing on your device (no cookies, no local storage). Sentry sees your IP address when data is sent, but it is set not to store it.
The basis is legitimate interest (f): keeping the service secure and working. [PRAVNIK: is this allowed without consent] Period: 30 days [PROVJERITI: setting in Sentry].
Screen recording with an error (Sentry Replay) runs only with your consent for "Analytics and error recordings" and only in the browser session where an error happened. Text, inputs and images are masked in the recording. The TV screen is never recorded.
9. Security records
With every sign-in we store the IP address and browser, so we can detect misuse of the account and block suspicious sign-ins. Administrators see them shortened (the network part of the address). You can see and sign out your active sign-ins in the account settings. Period: 30 days after the sign-in expires.
10. Cookies and embedded content
Necessary cookies and local storage keep you signed in and remember your language and cookie choice. Optional ones (analytics and error recordings, embedded YouTube video) load only with consent. On the quiz run screen and in the question preview, YouTube videos load from youtube-nocookie.com only on a click or with consent; they do not play on the TV screen or in the presentation. The list is in the Cookie policy. You can change your choice at any time through "Cookie settings" in the page footer.
Maps: map questions load maps and address search from Mapbox directly from your browser, so Mapbox sees your IP address and keeps it for 30 days. This is necessary for that question type. For some of that data Mapbox is an independent controller under its policy. [PRAVNIK: Mapbox's role]
11. Recipients
We do not sell data or share it for advertising. We give it only to service providers who process it on our instructions (processors): hosting, database, files, email, AI, rate limiting, maps, error tracking and analytics. The list with location and purpose:
| Provider | Purpose | Data | Location | Transfer | Policy |
|---|---|---|---|---|---|
| Neon (Databricks) | Database | All account, quiz and session data | EU (Frankfurt) | EU | databricks.com |
| Convex | Live quiz sessions | Team names, answers, drawings and photos, presence, fair-play records | [PROVJERITI: our deployment region (Convex offers EU, Ireland)] | SCC | convex.dev |
| Vercel | Web app hosting and proxy to the API | IP address, request data | [PROVJERITI: function region (default USA, iad1)] | EU-US DPF | vercel.com |
| Render | API hosting, logs | IP address, request data, logs | [PROVJERITI: service region (Render offers Frankfurt)] | EU-US DPF | render.com |
| Amazon Web Services (S3, CloudFront) | File storage and delivery | Images, audio, scans of answer sheets; IP address on delivery | EU (Stockholm); CloudFront delivers from edge locations worldwide | EU-US DPF | aws.amazon.com |
| Resend | Sending transactional emails | Email address, name, email content | [PROVJERITI: sending region (Resend offers EU, Ireland)] | EU-US DPF | resend.com |
| Anthropic | AI question generation and reading answer sheets (OCR) | Quiz topic and notes, photos of answer sheets | USA | SCC | anthropic.com |
| Upstash | Rate limiting | IP address, user ID | [PROVJERITI: database region (Upstash offers Frankfurt and Ireland)] | EU-US DPF | upstash.com |
| Mapbox | Maps and address search for map questions | IP address, address query | USA | EU-US DPF | mapbox.com |
| Google (YouTube) | Embedded video, only with consent or on click | IP address, browser data | [PROVJERITI] | EU-US DPF | policies.google.com |
| Sentry | Error tracking, release health (cookieless sessions) and performance tracing for 10% of page loads, without consent; screen recording of an error only with consent | User ID, technical error data | EU (Frankfurt) | EU | sentry.io |
| PostHog | Product analytics | User ID, in-app events, plan, role and signup week; with consent also an anonymous browser id, pages visited without parameters and masked clicks | EU (Frankfurt) | EU | posthog.com |
| Tavily | Research for AI generation | Query derived from the quiz topic | USA | [PROVJERITI] | tavily.com |
Where the law requires it, we give data to competent authorities.
12. Transfers outside the EEA
Some providers process data in the USA or have access from the USA. Transfers rely on the adequacy decision for the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795) where the provider is certified, or on standard contractual clauses (Art. 46(2)(c) GDPR). The mechanism for each provider is in the table above. You can ask for a copy of the safeguards at hello@sipnscore.eu.
13. Retention periods
Periods marked [PROVJERITI: čeka GI-11] are not enforced automatically yet; until then that data is not deleted by itself.
| Data | Period |
|---|---|
| Session results, standings and team names | Kept for good |
| Raw player answers, including drawings and photos | 12 months after the session ends, then deleted (scores stay) |
| Anti-cheat records | 12 months |
| Team member email addresses entered in a session | 12 months after the session |
| Live session data (Convex) | 1 hour after the session ends; unfinished sessions after 24 hours |
| Sign-ins (IP address and browser) | 30 days after the sign-in expires |
| Sign-in renewal records | 30 days after expiry |
| Tokens for email confirmation, password reset and account deletion | 7 days after expiry |
| Team invitations | 90 days after the invitation expires |
| Scans of answer sheets | 30 days [PROVJERITI: čeka GI-11] |
| Accounts with an unconfirmed email | 30 days after sign-up |
| Inactive accounts | 24 months after the last sign-in or activity, with an email warning 30 days before deletion |
| Account activity days | 25 months |
| Analytics events (PostHog) | 12 months |
| Cookie consent records | 3 years [PRAVNIK: is the period appropriate] |
| Content reports | 12 months after the decision; a report never decided, 12 months after it was made |
| Tool call records (Claude connection) | 180 days |
| Renewal tokens of connected apps (Claude.ai) | 30 days after expiry |
| Emails to administrators about new users (name and email) | 90 days, then administrators delete them by hand |
| Errors and logs (Sentry) | 30 days [PROVJERITI: setting in Sentry] |
| API logs (Render) | 7 to 30 days, by plan [PROVJERITI: our Render plan] |
| Sent email logs (Resend) | 30 days |
| Database history for restore (deleted data is gone once it expires) | 6 hours |
When data is deleted from the database, it also disappears from backups when the restore window ends.
14. Your rights
All rights are free of charge. We answer within one month (Art. 12(3) GDPR); for complex requests the period can be extended by two further months, and we tell you if so.
| Right | How |
|---|---|
| Access and portability (Art. 15 and 20) | data export in JSON in the account settings ("Download my data"); or by email |
| Rectification (Art. 16) | change your email and password in the account settings; anything else by email |
| Erasure (Art. 17) | "Delete account" in the account settings, confirmed by email. What stays: results and participation records in other organizers' sessions, without a link to your account; consent records, unlinked from the account, until the period ends; copies of your public quizzes that others made |
| Restriction (Art. 18) | by email |
| Objection (Art. 21) | for analytics, a switch in the account settings; anything else by email |
| Withdrawing consent (Art. 7(3)) | "Cookie settings" in the footer; withdrawal does not affect processing before it |
For a request by email, write from your account's address; if it is not clear that it is you, we ask for confirmation (Art. 12(6) GDPR).
15. Complaint to the supervisory authority
If you think we process your data against the rules, you can complain to the Croatian Data Protection Agency (Agencija za zaštitu osobnih podataka, AZOP), Ulica Metela Ožegovića 16, 10000 Zagreb, Croatia, azop@azop.hr, azop.hr. You can also complain to the supervisory authority of the country where you live or work (Art. 77 GDPR). We would be glad if you contacted us first.
16. Children
An account can be opened by a person aged at least 16. We do not ask players without an account for their age; the organizer is responsible for their quiz night. [PRAVNIK: obligations when children under 16 play]
17. Security
All traffic uses HTTPS. We store passwords as a hash (scrypt). The number of requests is limited. Only people who need it have access to data. The database is in the EU (Frankfurt), files in the EU (Stockholm). We track errors to find them quickly. Details are in the annex to the processing agreement.
18. Changes to this policy
The version and date are at the top of the page. We announce material changes by email to account holders and with a notice in the app before they take effect. Earlier versions are available on request. [PROVJERITI: where the version archive is published]