Privacy Policy

Who we are

TriviaFoundry is operated by Yanshuf Studio, Israel. For anything about your data, write to info@yanshufstudio.com.

By post:

What we store

• Your email address — how you sign in, and how we reach you about your account. If you sign in with Google we also receive your name and your Google account id from them; if you sign in with an emailed code, that address is all we get.
• A free-allowance record — it exists so that one mailbox gets one free allowance rather than a fresh one for every account opened from it. It holds a hash of your email address, not the address: a hash cannot be turned back into the address it came from, but it is not anonymous either — somebody who already knew an address could hash it and see whether it matches. Next to the hash we store a count of free packs and the date the current 30 days began, and nothing else. Aliases of one mailbox produce the same hash, so name+1@gmail.com and name+2@gmail.com share one allowance. Pro subscriptions are not counted here at all.
• Your sign-in code — the six digits we email you, and the link in the same email that carries them. We keep the code hashed, not in the clear, and it stops working once you use it or 15 minutes after we send it, whichever comes first.
• Sign-in session records — a row per signed-in browser, holding an expiry, and the IP address and browser user-agent the sign-in came from. They are how we can end a session, and how you stay signed in without a password.
• A sign-in cookie — set when you sign in, and how your browser is recognised on the next page. It lasts 7 days.
• A device cookie (pq_creator) — only if you used TriviaFoundry before accounts existed. It is no longer set for anyone, and it is now used for exactly one thing: the first time you sign in, it lets us move the packs you made before onto your account. After that it does nothing.
• The quiz content you generate — your briefs and the rounds, questions and answers produced from them.
• Live session entries — the team names and answers people type during a quiz you are running.
• Images you upload to a question.
• Your subscription, if you buy Pro — the customer id and subscription id Paddle gives us for you, the subscription's status (active, cancelled and so on) and when that status last changed. It is how we know whether your account is on Pro. We never see or store your card.
• A log of Paddle's notifications — the id, type and time of each message Paddle sends us about a subscription, so that none is ever applied twice. It holds nothing about you.

Who else processes it

• Google sign-in — only if you choose it. If you sign in with Google we store your name, email address, profile photo link and the sign-in tokens Google gives us. We use them only to sign you in. We tell Google nothing about you, and signing in with an emailed code instead involves Google not at all.
• Resend — sends the sign-in email to your inbox. They handle your email address, the six-digit code and the link that carries it, and nothing else about you.
• Paddle — sells the subscriptions and handles payment and invoicing. Card details go to Paddle, never to us. When you subscribe we pass Paddle's checkout your account's email address, so you do not have to type it, and an id that ties the purchase to your account; Paddle sends us back the ids and the status listed above.
• Vercel — hosts the site.
• Vercel Web Analytics — counts page views, so we can see which pages people read. Vercel says it does not rely on cookies, and on our pages its script sets none and stores nothing in your browser. For each page view it records the page's address (we remove anything after a ? or # before it is sent), the site you arrived from, the time, a country, region and city, and your browser, operating system and type of device (phone, tablet or desktop), with their versions. It tells one visitor from another by a hash of the request, which Vercel discards after 24 hours. Vercel says nothing it records can follow a visit onto other websites or is tied to you or your account. We see totals, not people. Vercel keeps these statistics for at least 12 months, the reporting window on our plan, and says it may keep them longer.
• Turso — runs the database the above is stored in.
• Upstash (rate limiting) — to stop abuse we keep your IP address with short-lived counters, deleted automatically within a day.
• Anthropic — generates the questions. Your brief is sent to the Anthropic API to be answered; nothing personal goes with it beyond whatever the brief itself contains.

Analytics, and no advertising

The only analytics we run is Vercel Web Analytics, described above: page-view counts. On our pages it sets no cookies and stores nothing in your browser, and Vercel says nothing it records ties a visit to you or to your account. We run no advertising, and we do not sell or share your data. Nothing here is used to profile you.

Cookies and browser storage

We set three cookies, and not one of them is for tracking.

• Your sign-in cookie — set when you sign in and needed to keep you signed in. It lasts 7 days, and using the site keeps it current.
• A five-minute cookie during a Google sign-in — set only if you choose Google, and only while you are being sent to Google and back. It is what ties that round trip to your browser so nobody else can finish it, and it expires five minutes later whether the sign-in worked or not.
• pq_creator — only present if you used TriviaFoundry before accounts existed, and no longer set for anyone. It exists so that signing in can bring your old packs with you.

Two more things are kept in your browser's own storage rather than in a cookie, so that a live game survives a reload or a dropped connection:

• The host key — when you start a live game, the key that proves this browser is the one running it, saved against that game's code, so the host desk can reconnect to the game. It stays until you clear this site's data in your browser.
• The team token — when a team joins, the game's code, the team's name and the token that proves the phone belongs to that team, so it rejoins the same team after a reload rather than starting again. It is removed when the team leaves the game, or when the game no longer accepts it.

Both are sent only to us, with that game's own requests.

All of the above are strictly necessary: the service cannot tell your packs from anyone else's, finish a Google sign-in, or keep a host desk or a team's phone connected to its game without them — so there is nothing optional to consent to. We set no tracking or advertising cookies. Teams playing a quiz are not asked to sign in and get none of the cookies; the team token is the only thing we store on a team's phone.

Paddle's cookies during checkout. Paddle's code is not loaded on any page until you press Subscribe. Its checkout then opens inside our page, and it is Paddle's: while you use it, it sets its own cookies, including ones it needs to run and secure the checkout. Those are Paddle's cookies, not ours, and Paddle's own privacy policy covers them.

How long we keep it

Your account, your packs and your subscription record stay until you ask us to delete them. A sign-in session stops working 7 days after it was last used, and a sign-in code 15 minutes after we send it; a code is deleted the moment it is used. Live session entries — team names and answers — stay with the quiz they belong to.

The free-allowance record above outlives the account it was made for, which is deliberate: if deleting an account cleared it, the free allowance could be claimed again and again by deleting and re-registering, which is the abuse it exists to stop. It is kept while any account still uses that mailbox, and it stops counting for anything 30 days after the last free pack was made. Once both are true — its 30 days are over and no account uses the mailbox any more — a daily job deletes it, so the longest it survives past your last account is 30 days and a day.

Deleting your data

To delete your account, email info@yanshufstudio.com from the address you signed in with. We delete your account, quiz packs and game data — including any uploaded images, your sign-in sessions, the subscription ids and status we hold, and the email address and name on the account — from our live database within 30 days. The one exception is the free-allowance record described above, which holds a hash rather than an address and is deleted on a delay rather than with the account: clearing it immediately would turn “delete my account” into a way to collect free packs indefinitely. It goes once its 30 days are over and no account uses that mailbox, which a daily job checks. Encrypted backups kept by our database provider are overwritten on their normal cycle, after which the data is gone. Billing records held by Paddle as merchant of record are theirs to keep or remove; see the refund policy for how to reach them.

If your account has an active Pro subscription, we cancel it at Paddle before we delete the account, so it does not renew. Deleting the account does not by itself refund a payment; refunds follow the refund policy.

Signing out on its own does not delete anything — it ends that browser's session and leaves your account as it was.

Changes to this policy

Changes are reflected in the date at the top of this page.