Queezius Privacy Policy

In short

• No account is needed to play: no email, no phone number, no sign-in. A nickname is optional, and a made-up one works fine.
• No ads, no analytics and no tracking across other apps or websites.
• We never sell your data or share it for advertising.
• The apps never use your camera, your microphone or your device's location.
• Our server deletes the players' data about half an hour after the room goes quiet. Only the TV keeps the names of winners, until you reset it.

For children

You can pick a name to show on the TV, and everyone in your game can see it. Our server forgets it soon after the game, but your phone remembers it for next time, and the TV may remember who won or took an award. You can play without a name, or with a nickname. If anything here is unclear, ask a grown-up.

The short version

Players do not need an account or a sign-in, so there is nothing to register. To put your name on the TV, Queezius has to keep a little data for a short time. Here are the main points.

• A name you choose, if you choose one. It passes through our server to the TV and to the other phones in your game, which do not have to be in the same room.
• A random code your phone makes up for itself, so it gets its seat and its score back if it drops out.
• Your answers while a game is running, because that is the game.
• Our game server deletes the players' data soon after the game — at the latest about half an hour after the room goes quiet. Logs and support email follow their own rules, described below.
• The TV can keep a record book with the names of winners and award-takers, on the TV itself, until someone resets it.
• No Queezius accounts, no ads, no analytics and no tracking across apps or websites. On Apple TV and Android TV you can buy one thing: a one-time unlock of the full TV game, paid through Apple or Google. We never see your card details.
• Cloudflare runs our servers for us. We never sell your data or share it for advertising. We share it only with the other players in your game, the providers described on this page, or when the law requires it.

The rest of this page explains these points in more detail, and tells you who we are and what your rights are.

Who we are

Queezius is made by Helfi Systems AB, a company registered in Sweden, organisation number 559593-9520.

Our address is Snöstorpsvägen 12A LGH 1202, 302 48 Halmstad, Sweden.

We decide what Queezius does with your data, so we are responsible for it. Data protection law calls us the “controller”. If you write to us, we receive your email address, your message and any attachments. We use them only to answer you and to fix what you reported. We delete support email when the matter is closed, and at the latest 12 months after our last reply. You can write to us at:

support@queezius.com

What your phone sends us

While you play, your phone sends us these things:

• The name you pick with “Change name”, up to 24 characters. It is optional — a phone with no name joins as “Player” with a number, such as “Player 3”. Your name is shown on the TV and sent to the phones in your game, and those players do not have to be in the same room. Our server checks every name against a list of rude words in all ten of our languages. The filter catches the most common rude words, but no word list is perfect, and the person at the TV can remove a player. A blocked name is replaced with a “Player” name when you join, or with the name you already had when you change your name. If two players pick the same name, a number is added to the second player's name.
• A session code your phone makes up for itself: a long random string. It does not say who you are, but while the room exists it links your phone to your name, answers and score. It puts you back in your seat with your score if your phone drops out or you reload the page. It also tells our server which phone is the host. If the person at the TV removes you, the room records that this phone's session was removed from that room. “Join as a new player” makes a new session, which can join if the room allows it.
• While a game is running: which answer you tapped, and whether you picked “Safe” or “Bold” on the Big Finish question. Our server notes how quickly each answer arrived, because speed counts in the scores and in the “Fastest finger” award. The TV and the other phones in your game receive each player's score, place and run of right answers, whether they are connected, whether they have answered, and, once a question closes, whether they were right and how quickly they answered. They never receive which answer you tapped. They see your Big Finish pick only with the final result.
• The buttons that steer the game: leaving it and, for the host, ending it or going back to the lobby for the next one.

Like all internet connections, yours carries your phone's IP address — its address on the network. The section on who helps us run Queezius says what happens to it.

Everything travels over an encrypted connection. Neither your name nor your session code is ever put in the web address. They travel through the connection to the room, so neither ends up in a link that could be shared or saved in a browser history. The link you scan holds only the room code.

What our server keeps, and for how long

While a room is open, our server holds the players' names and session codes, the scores, which answer each player picked and how quickly it arrived, each player's Big Finish pick, and which players were removed. It also holds the room's host key, a secret that lets the TV take its own room back. During a game, the server also saves this information to storage, so a restart in the middle of a round does not wipe out your game.

Each part has its own clock:

• The saved copy is deleted when the game goes back to the lobby, when the room rests, and in any case 10 minutes after it was last saved.
• The live list of players lasts until the room rests. A room rests after 15 minutes with nothing happening in the lobby or on the results screen, or after 30 minutes when a game is paused on an answer, waiting for the TV to move on.
• If the TV is gone for 5 minutes, the room ends. The phones then show “This game has ended.”, and the list of players is forgotten when the room rests, as described above.
• A phone that drops out keeps its seat for 5 minutes in the lobby (3 in a class-sized room), and until the game ends during a game.
• The list of removed players lasts as long as the room.
• For 48 hours, the room keeps the ids of the questions it has asked, so the next game does not repeat them, and — if it went to rest — its old host key. They hold no names or answers.
• That small list is why the App Store privacy label shows “Product Interaction” under “Data Not Linked to You”, and Google Play shows “Other actions” under “App activity”. It names no one, but we keep it after the game ends, and the store rules ask us to list data kept like that. So we do, openly.

Once these clocks have run out, our game server holds no record of who played, what they answered or how they scored. Logs and support email follow their own rules, described on this page. We do not build a picture of anyone across game nights.

Our server's log lines record errors and counts — “this many picture questions were skipped” — never player names and never session codes, and they are built to leave out room codes too. Cloudflare keeps them for up to 7 days. The fuller request logs, which would hold the web addresses of rooms, are switched off.

What stays on your phone

The phone controller is a web page, so it keeps a few small values in your browser's own storage, on your phone. Two of them are about you:

• queezius.sessionId — your session code. It stays until you clear this site's data in your browser, or until the browser clears it by itself. If you were removed and tap “Join as a new player”, it is replaced with a new one.
• queezius.name — the name you last chose, so you do not have to type it again next game night. Saving an empty name clears the saved name on this phone. It does not change your name in the current room, and the next room you join gives you a “Player” name.

The rest are settings and reminders. They hold no name:

• queezius.doubleDown — your Big Finish pick, with the room code and the question it belongs to, so a reload does not lose the reminder of what you chose. It is cleared when the room goes back to the lobby, or when you leave.
• queezius.uiLocale and queezius.uiLocaleSeeded — the language of the phone's buttons, and a marker that a one-time settings upgrade has already run.
• queezius.haptics, queezius.wakeLock and queezius.translateWarn — stored only when you switch off “Vibration”, “Keep screen on” or “Translation warning”.

These values stay until they are cleared, subject to the browser's own storage rules. To remove them all, clear this site's data in your browser's settings. We use no cookies or storage for advertising or tracking. Everything stored on your devices is there to make the game work, or to remember a choice you made.

What stays on your TV

The TV can keep a record book across game nights: how many games each person has won, and how often they have received an award such as “Fastest finger”. Names and counts, nothing else. The TV shows the record book in the lobby between games and on the results screen, so whoever plays there later can see the names. It also appears in the TV's idle demo while the lobby waits for players. It is never sent to us, and never sent to the phones.

The “Record book” switch is on to begin with. “Reset records” in Settings on the TV wipes the wins and the awards together, after asking you to confirm. Turning the “Record book” switch off stops new records and hides the book, but keeps the old names until you reset it. “Lobby standings” and “Award ceremony” have their own switches too, and “Idle preview” turns the idle demo off.

The TV's other storage holds no player names or answers, though some of it identifies a room:

• Its settings, such as “Theme”, “Display language”, “Question language”, “Sound” and “Music”, and its place in the lobby music playlist.
• A list of the questions this TV has already shown, so it does not repeat them. The TV sends it to our server when it connects to a room, and the server uses it only while that room is open.
• A resume record — the room code and its host key — so the TV can take its room back if the app restarts. The Apple TV and Android TV apps honour it for only 10 minutes after they last saw the room. The browser TV keeps it only until its tab is closed.

The Apple TV and Android TV apps also keep two small values about the full TV game: how many of the 2 free games this TV has started, and whether Apple or Google has confirmed that this TV may use the unlock. They say nothing about who you are and are never sent to us. On Apple TV they sit in the system's secure storage, the Keychain, kept on this TV only and not synced to other devices. On Android TV they sit in the app's own storage. Settings and records stay until they are cleared, subject to the browser's or the system's own storage rules. The resume record has the shorter limits described above. To remove what the TV keeps: on Apple TV, delete the Queezius app, though the Keychain may keep the two purchase values; on Android TV, clear the app's data or uninstall it; on the browser TV, clear the site's data in the browser. The Android TV app is set up so that its data is left out of Android's cloud backup. We use no cookies or storage for advertising or tracking. Everything stored on your devices is there to make the game work, to count the free games, or to remember a choice you made.

The browser TV and its cookie

The browser version of the TV screen is for testing and classrooms, and it asks for a password. Once the right password is entered, the browser keeps one cookie, __Host-qz_tv, so that it does not ask again. The cookie lasts one year. It stores only proof that the right password was entered, and its expiry date. It holds no name and no email address.

There is no sign-out button. To remove the cookie, clear that site's data in the browser. Apart from its cookie and the resume record described above, the browser TV handles game data like the TV apps.

Why we may use your data

Data protection law asks us to name the legal ground for each use. Every use in the list below rests on our legitimate interests (GDPR Article 6(1)(f)). Put simply, these are uses a player can reasonably expect, and we may rely on our legitimate interests only where the player's own interests and rights do not outweigh ours. One use is not in this list because its ground is different: we keep the stores' sales and order information because bookkeeping law requires it (GDPR Article 6(1)(c)), as the section on who helps us run Queezius explains. Each use in the list, in short:

• Running the game you joined uses your session code, your answers and their timing, your score, your seat and, if you chose one, your name. A name is optional. The session code and your taps are needed to play: without them the game cannot work.
• Remembering your chosen name and settings is why your phone keeps them in its own storage.
• Keeping rude names off a family's TV is why every name goes through our filter.
• Respecting the TV's choice to remove a player is why the room remembers who was removed.
• Keeping the TV's record book of wins and awards is why the TV can keep players' names between game nights.
• Checking the browser TV's password is why the browser keeps its cookie.
• Stopping one internet connection from opening room after room is why we count room openings per connection.
• Finding and fixing faults is why we keep logs, and they hold no player names and no session codes.
• Answering you when you write to us, and fixing what you report, is why we read your email address, your message and any attachments.

For the uses in this list, we rely on legitimate interests, not on consent. You have the right to object to any of them — the section on your rights says how.

Who helps us run it

Queezius uses a few outside providers. Cloudflare, Inc., a company in the USA, hosts our website, our game server and the pictures for picture questions. It works for us under a data processing agreement, which allows it to handle the data only on our instructions. Neon hosts the question bank, which holds questions and answers and no player data. Cloudflare uses its own sub-processors, listed at cloudflare.com/gdpr/subprocessors. Our email reaches us through Cloudflare's email routing and lands in our inbox at our email provider. If you buy the full TV game, you pay Apple or Google, which handles the payment under its own terms and privacy policy. We never see your card details. The app on the TV asks the store only whether the Apple or Google account on that TV may use the unlock, because it bought it or, on Apple TV, through Family Sharing, and it sends nothing about the purchase to our game server. For this, the Android TV app uses Google Play's billing permission. The stores give us sales and order information for our accounts. Swedish bookkeeping law requires us to keep it until the end of the seventh year after the end of the calendar year in which the financial year ended. Apple or Google keeps your purchase history in your account there.

Cloudflare also processes connection and security data — an IP address, a time, which file was asked for — to deliver and protect its network. For that part, Cloudflare decides for itself, as an independent controller. What it keeps, and for how long, is in its own privacy policy at cloudflare.com/privacypolicy. Our own code uses the IP address for one thing only: each time a TV asks to open a new room, Cloudflare counts that request for us against the TV's internet connection (for a newer IPv6 address, against only its first half), and a connection that asks for too many rooms within a minute is turned away for a moment. Our code never stores the address and never logs it.

A room's server runs in a Cloudflare data centre near where the room was first opened, so your data can be handled outside the EU and EEA, including in the USA. For the USA, Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework, which the European Commission has found gives adequate protection. For other countries outside the EU and EEA, the EU's standard contractual clauses in Cloudflare's data processing agreement apply. These are the European Commission's model terms for protecting data that leaves the EU. Write to us if you would like a copy of these safeguards.

What we never do

• No accounts and no sign-in for players, and the game never asks for an email address.
• No ads. The only thing for sale is the one-time unlock of the full TV game in the Apple TV and Android TV apps, and Apple or Google takes the payment. A phone never asks anyone to pay.
• No analytics, no tracking across apps or websites, no crash-reporting kit, no third-party scripts. Even the fonts are served from our own site rather than fetched from somebody else's.
• We never sell your data or share it for advertising. We share it only with the other players in your game, the providers described on this page, or when the law requires it.
• No player profiles on our side: our server keeps nothing about anyone from one game night to the next. Only the TV's own record book, described above, keeps a tally between game nights. We make no automated decisions that have legal or similarly significant effects on you. The game's automatic steps are its own, such as scoring, the name filter, the limit on opening rooms, and housekeeping like moving the host or freeing the seat of a phone that has gone away.
• No AI while you play. Questions are written and checked offline, long before anyone plays them; choosing and scoring them is plain arithmetic.
• No chat and no messages between players. The name you choose is the only free text in the whole game.
• No camera. Queezius never asks for it: you scan the TV's QR code with your phone's own camera app, like any other QR code.

Children and families

Queezius is built to be played by a family in a living room, children included. There is no account to make, no chat and no ads. Nothing is ever sold on a phone. The TV app's one purchase, the full TV game, goes through Apple's or Google's own purchase screen, so the purchase settings on that Apple or Google account apply, such as asking for a password or a parent's approval.

The only free text a child can type is the name they want on the TV. It is filtered before it appears, and our server forgets it soon after the game. If the child wins or takes an award, the TV's record book can keep the name until someone resets it. The phone also remembers the name for the next game night, until it is cleared. A nickname works just as well as a real name. If you would rather they typed nothing, they do not have to: a phone with no saved name joins as Player 3, or whichever number comes next.

Your choices

• Change your name in the lobby with “Change name”. Once a game starts, the name stays as it is until the room returns to the lobby. Saving an empty name clears the saved name on this phone. It does not change your name in the current room, and the next room you join gives you a “Player” name.
• Leave a game at any time with “Leave the game” on the phone.
• Clear your session code and your name by clearing this site's data in your phone's browser. Your phone makes a fresh code next time and joins as a new player.
• Wipe the TV's record book with “Reset records” in Settings on the TV, or turn “Record book” off so nothing new is remembered between game nights.
• Play with no name at all. Nothing in the game needs one.

Your rights

You have the right to ask us what we hold about you (access), and to have it corrected (rectification), deleted (erasure) or put on hold (restriction). You also have the right to object to the uses that rest on our legitimate interests (objection). To use any of these rights, write to us at the address on this page.

There are two limits. First, we can find a player only while their room is still on our server, on the clocks described above. To find room data, we may ask for the room code, the name you used and roughly when you played. We may also ask for something that shows the data is yours. Room data cannot be found after it is deleted. Support email is not covered by that limit. Second, the stores' order information that bookkeeping law makes us keep cannot be deleted, and you cannot object to our keeping it, before that keeping period ends. You can still ask us what we hold.

We cannot delete what is stored on your own phone or TV. You can delete it yourself with the steps in the sections above.

Complaints

If you think we have handled your data wrongly, you are welcome to tell us first — we would like to put it right. You can also complain to the data protection authority where you live or work, or where you think the rules were broken. In Sweden that is IMY, the Swedish Authority for Privacy Protection, at imy.se. The list of every EU and EEA authority is at edpb.europa.eu.

Changes to this policy

We update this page when what we do with data changes, and the date at the foot of the page moves. If a change matters to you, we say so on this page before it takes effect. We would rather rewrite this page than quietly increase the data we hold.

Questions about your privacy

If something here is unclear, or you think Queezius is keeping something this page does not describe, write to us. A person reads every message.

support@queezius.com

Go to Queezius Support