Privacy statement

1. Who we are

Quiz Playground makes party quizzes: guests send in memories, we make a show of them, and everyone plays along on their own phone. We are responsible for processing personal data as this statement describes.

Did your organization sign a data processing agreement with us? Then your organization is responsible for its party’s data, and we process it on its behalf (see chapter 5).

Questions about privacy? Email hello@quizplayground.com.

2. Which data we process

That depends on who you are. We never ask for more than we need.

Who	Which data
Organizers	Name, email address, the party’s details (the guest of honor’s first name, date, kind of party, a photo, your relation to the guest of honor, the show’s tone and the topics that must stay out) and payment details. Payments go through Stripe; we never see full card or account numbers. For every login session your IP address and browser. If you turn on push notifications, also your device’s push address.
Guests who send something in	Name or nickname, your relation to the guest of honor, the contributions themselves (text, photos, voice messages), the confirmation that you’re 16 or older, and when you gave consent. The AI check adds labels: the topic, the period and the names you mention. Your phone gets an anonymous session, with your IP address and browser, so you can find your own contributions later.
Players	Nickname, doodle avatar, answers and points, and an anonymous session on your phone, with your IP address and browser, so you get back to your place after a shaky connection.
People who sign up for updates	Email address, kind of party and month, the site’s language and the country you signed up for, which channel you came from, and when you gave and confirmed consent.
Website visitors	Your IP address and browser, in our hosting’s logs (Vercel). We count visits with Plausible, without cookies and without knowing who you are: which page, which link brought you, your country and your kind of device.
People on the list of names of a holiday show	At Christmas, Sinterklaas and New Year’s Eve: the first names the organizer types in of who’s at the table, also of people who haven’t said anything themselves yet, or that a guest adds. Sometimes with a generation (child, adult, grandparent). Also which phone has which name, who claims a name (That’s really me), who a card is about, whether someone wants the hot seat and whether someone chose Not about me, please.

Organizers: Name, email address, the party’s details (the guest of honor’s first name, date, kind of party, a photo, your relation to the guest of honor, the show’s tone and the topics that must stay out) and payment details. Payments go through Stripe; we never see full card or account numbers. For every login session your IP address and browser. If you turn on push notifications, also your device’s push address.
Guests who send something in: Name or nickname, your relation to the guest of honor, the contributions themselves (text, photos, voice messages), the confirmation that you’re 16 or older, and when you gave consent. The AI check adds labels: the topic, the period and the names you mention. Your phone gets an anonymous session, with your IP address and browser, so you can find your own contributions later.
Players: Nickname, doodle avatar, answers and points, and an anonymous session on your phone, with your IP address and browser, so you get back to your place after a shaky connection.
People who sign up for updates: Email address, kind of party and month, the site’s language and the country you signed up for, which channel you came from, and when you gave and confirmed consent.
Website visitors: Your IP address and browser, in our hosting’s logs (Vercel). We count visits with Plausible, without cookies and without knowing who you are: which page, which link brought you, your country and your kind of device.
People on the list of names of a holiday show: At Christmas, Sinterklaas and New Year’s Eve: the first names the organizer types in of who’s at the table, also of people who haven’t said anything themselves yet, or that a guest adds. Sometimes with a generation (child, adult, grandparent). Also which phone has which name, who claims a name (That’s really me), who a card is about, whether someone wants the hot seat and whether someone chose Not about me, please.

3. What for, and on which legal basis

For each purpose below: the legal basis we rely on and how long we keep the data.

Purpose	Legal basis	Retention
Managing your account and your party	Performance of the contract	As long as your account exists. Delete a party and it’s gone at once, photos included. Delete your account and your data is gone at once; photos of parties you didn’t delete first stay in storage until we clear them.
Checking guests’ contributions and making a show of them	The guest’s consent, when sending	30 days after the party, or as long as the Recap page stays up
The list of names of a holiday show: who’s at the table, who wrote which card and who it’s about	Legitimate interest of the organizer, just like the first name of the guest of honor: the organizer chooses who is on the list	30 days after the party, together with the cards. A name that a card on the Recap page or a kept prediction still needs stays until that is gone
The voice that presents the show, when it’s on	Performance of the contract with the organizer, who turns the voice on or off. Words from memories: the guest’s consent, when sending. The first name of the guest of honor: legitimate interest, as in the show itself	30 days after the party, and at once with Verwijder alles (Delete everything). Lines without a name are the same for every show and stay
Playing the show: nicknames, answers, points	Legitimate interest: making the show work	As long as the party exists. Anonymous sessions after 60 days without activity
The Recap page	Performance of the contract with the organizer, and the guests’ consent	7 days, 30 days or 12 months, depending on the pass
Payments and receipts	Performance of the contract and a legal obligation	7 years (tax retention duty)
Updates and waitlist	Consent, confirmed by email	Until you unsubscribe. Unconfirmed: gone after 7 days. We keep the proof of your consent for five more years after you unsubscribe, without a readable email address.
Seintjes and push notifications for organizers	Performance of the contract. Push only with your consent: you turn it on yourself	Seintjes 30 days. A device until you remove it, or after 60 days unused
Measuring whether the show runs well: do answers arrive, do phones stay connected	Legitimate interest: making the show reliable	As long as the party exists, without nicknames or answers
Website statistics: which pages and channels work	Legitimate interest: making the website and the Studio better	Plausible keeps only counts, without IP addresses. The code it uses to recognise a visitor that day is gone after 24 hours.
Preventing abuse, such as bots and guessing room codes	Legitimate interest: keeping the show safe	In our counters your IP address is only stored unrecognizable. A count expires after an hour at most and is cleared at a later check. Cloudflare’s bot check does see your IP address, as a processor.
Error reports	Legitimate interest: fixing errors quickly	90 days at most, with a user id and the page’s address, without names, email addresses or content

Managing your account and your party
Legal basis: Performance of the contract
Kept: As long as your account exists. Delete a party and it’s gone at once, photos included. Delete your account and your data is gone at once; photos of parties you didn’t delete first stay in storage until we clear them.
Checking guests’ contributions and making a show of them
Legal basis: The guest’s consent, when sending
Kept: 30 days after the party, or as long as the Recap page stays up
The list of names of a holiday show: who’s at the table, who wrote which card and who it’s about
Legal basis: Legitimate interest of the organizer, just like the first name of the guest of honor: the organizer chooses who is on the list
Kept: 30 days after the party, together with the cards. A name that a card on the Recap page or a kept prediction still needs stays until that is gone
The voice that presents the show, when it’s on
Legal basis: Performance of the contract with the organizer, who turns the voice on or off. Words from memories: the guest’s consent, when sending. The first name of the guest of honor: legitimate interest, as in the show itself
Kept: 30 days after the party, and at once with Verwijder alles (Delete everything). Lines without a name are the same for every show and stay
Playing the show: nicknames, answers, points
Legal basis: Legitimate interest: making the show work
Kept: As long as the party exists. Anonymous sessions after 60 days without activity
The Recap page
Legal basis: Performance of the contract with the organizer, and the guests’ consent
Kept: 7 days, 30 days or 12 months, depending on the pass
Payments and receipts
Legal basis: Performance of the contract and a legal obligation
Kept: 7 years (tax retention duty)
Updates and waitlist
Legal basis: Consent, confirmed by email
Kept: Until you unsubscribe. Unconfirmed: gone after 7 days. We keep the proof of your consent for five more years after you unsubscribe, without a readable email address.
Seintjes and push notifications for organizers
Legal basis: Performance of the contract. Push only with your consent: you turn it on yourself
Kept: Seintjes 30 days. A device until you remove it, or after 60 days unused
Measuring whether the show runs well: do answers arrive, do phones stay connected
Legal basis: Legitimate interest: making the show reliable
Kept: As long as the party exists, without nicknames or answers
Website statistics: which pages and channels work
Legal basis: Legitimate interest: making the website and the Studio better
Kept: Plausible keeps only counts, without IP addresses. The code it uses to recognise a visitor that day is gone after 24 hours.
Preventing abuse, such as bots and guessing room codes
Legal basis: Legitimate interest: keeping the show safe
Kept: In our counters your IP address is only stored unrecognizable. A count expires after an hour at most and is cleared at a later check. Cloudflare’s bot check does see your IP address, as a processor.
Error reports
Legal basis: Legitimate interest: fixing errors quickly
Kept: 90 days at most, with a user id and the page’s address, without names, email addresses or content

4. How long we keep data

Loose photos, voice messages and contributions: 30 days after the party.
The voice: your show’s spoken lines, with the guest of honor’s first name or words from your memories, 30 days after the party. Lines without a name (‘It’s all locked in.’) are the same for every show and stay.
The Recap page: 7 days with Proefrondje, 30 days with Feestje and 12 months with Groot feest or Bruiloft. The organizer gets an email seven days before the end.
Anonymous sessions without activity: 60 days.
Your login session, with your IP address and browser: as long as it runs. The login system also keeps a log of when and from which IP address someone logged in.
Seintjes in the Studio: 30 days.
The proof of your consent to updates (when you signed up and confirmed, and which text you saw): five years after you unsubscribe, without a readable email address.
Payment details and receipts: 7 years, because the tax office requires it.
The organizer can have everything deleted sooner with Verwijder alles (Delete everything). It’s gone within a minute, the files themselves too.

Predictions: on New Year’s Eve (and at Christmas if the organizer chooses it) everyone votes in secret on who at the table will, say, move house next year. Only if the organizer chooses Keep the predictions until next year before the show do we keep, per question, the name with the most votes (on a tie, each name tied for the most) and its percentage. Never who voted what. That way next year’s show can open with them. We keep them for 13 months after the party at most; if the organizer doesn’t choose it, they go with the rest of the party. Want your name out? Choose Not about me, please in the Warm-up Deck, ask the organizer to take your name off the list, or email us. Then the predictions with your name are gone at once, a question with your name in it too.

Names and cards at a holiday show

A holiday show (Christmas, Sinterklaas, New Year’s Eve) has a list of names: the first names of everyone at the table. The organizer types them in, also of people who haven’t said anything themselves yet; a guest taps their name in the Warm-up Deck or adds themselves. Just like the first name of the guest of honor, that’s the organizer’s choice, and it belongs to the party.

Every card knows who it’s about: usually whoever wrote it, sometimes someone else, like the drawn name at Sinterklaas. A parent can fill in cards for a child: only the kind cards, and only after ticking that they are the parent or guardian. Such a card is about the child and belongs to the parent.

If someone says a name is theirs while another phone already has it (That’s really me), that’s a claim. The organizer decides who is who; after that the claim is settled.

How long: we keep the list of names, the claims, which phone has which name and who each card is about until 30 days after the party. Then they go with the cards. A name only stays longer if a card about that person is still on the Recap page (as long as the page) or a kept prediction names them (13 months after the party at most); then that name goes too. Once the party was played, we keep the list of names, with who would rather not and who won the title, so the organizer can start next year with the same list: until she does, and 13 months after the party at most. The new party gets only the names, who is a child or a grandparent, who chose ‘Rather not about me’ and who defends the title; no cards, photos or answers. If the organizer deletes the party, everything is gone at once.

Your name off the list: tap Remove my name in the Warm-up Deck, on the phone with your name. Another device? Choose ‘Is your name on the list and do you want it off?’ at Who are you? and confirm with the button in our email. Your name is then gone at once, with the cards about you, what you sent with that name (for someone else too), your claims and the kept predictions with your name. Not during the show itself; afterwards it works again. You can also ask the organizer, or email us.

Deleted is really gone, the files too. Only our database’s backups keep it a little longer, until they expire.

5. Who helps us: processors

We use other companies for a few tasks. We sign a data processing agreement with each of them before they get any of your data. A few are in the US; data only goes there under arrangements the EU approves: the EU-US Data Privacy Framework or standard contractual clauses.

Processor	What for	Where
Supabase	Database, login and storage of contributions, photos and voice messages. For every login session the login system keeps your IP address and browser.	EU (Frankfurt). Supabase itself is in the US: standard contractual clauses.Supabase’s data processing agreement
Vercel	Hosting the website and the app	EU (Frankfurt). Vercel itself is in the US: standard contractual clauses.Vercel’s data processing agreement
Anthropic	AI that checks contributions and turns them into quiz questions	US: standard contractual clauses. Gone after 30 days at most, and never used to train AI.Anthropic’s data processing agreement
Stripe	Payments with iDEAL \| Wero and card, and receipts	EU (Ireland) and US: EU-US Data Privacy Framework and standard contractual clauses.Stripe’s data processing agreement
Resend	Sending email	Sent from the EU (Ireland); account and logs in the US: EU-US Data Privacy Framework and standard contractual clauses.Resend’s data processing agreement
Sentry	Error reports, with a user id and the page’s address (which can hold the key of an invitation link). No names, email addresses or content.	EU (Frankfurt); company in the US: EU-US Data Privacy Framework and standard contractual clauses.Sentry’s data processing agreement
ElevenLabs	The voice that presents the show, when it’s on; the organizer can turn it off. Gets the guest of honor’s first name and the lines we write from your memories. Never a guest’s nickname, and never who wrote what.	US: EU-US Data Privacy Framework and standard contractual clauses. We turn off ElevenLabs’ use of it to train AI.ElevenLabs’s data processing agreement
Cloudflare	Checking that a person is there and not a bot (Turnstile): when you start as a guest, when you log in or sign up to the Studio, and when you pair a TV	Worldwide network, company in the US: EU-US Data Privacy Framework and standard contractual clauses.Cloudflare’s data processing agreement
Google Workspace	The mailbox of hello@quizplayground.com: what you mail us, with your email address, such as a question or a request to see or remove your data	Google Cloud EMEA in Ireland; stored worldwide, company in the US: EU-US Data Privacy Framework and standard contractual clauses.Google Workspace’s data processing agreement
Plausible	Website statistics: which pages are visited and where visitors come from. No cookies: your IP address and browser only go into a code that changes every day. Links to the warm-up deck and the memory page go there without their key, and nothing is counted during the show.	EU: company in Estonia, servers in Germany.Plausible’s data processing agreement

Supabase: Database, login and storage of contributions, photos and voice messages. For every login session the login system keeps your IP address and browser.; EU (Frankfurt). Supabase itself is in the US: standard contractual clauses.Supabase’s data processing agreement
Vercel: Hosting the website and the app; EU (Frankfurt). Vercel itself is in the US: standard contractual clauses.Vercel’s data processing agreement
Anthropic: AI that checks contributions and turns them into quiz questions; US: standard contractual clauses. Gone after 30 days at most, and never used to train AI.Anthropic’s data processing agreement
Stripe: Payments with iDEAL | Wero and card, and receipts; EU (Ireland) and US: EU-US Data Privacy Framework and standard contractual clauses.Stripe’s data processing agreement
Resend: Sending email; Sent from the EU (Ireland); account and logs in the US: EU-US Data Privacy Framework and standard contractual clauses.Resend’s data processing agreement
Sentry: Error reports, with a user id and the page’s address (which can hold the key of an invitation link). No names, email addresses or content.; EU (Frankfurt); company in the US: EU-US Data Privacy Framework and standard contractual clauses.Sentry’s data processing agreement
ElevenLabs: The voice that presents the show, when it’s on; the organizer can turn it off. Gets the guest of honor’s first name and the lines we write from your memories. Never a guest’s nickname, and never who wrote what.; US: EU-US Data Privacy Framework and standard contractual clauses. We turn off ElevenLabs’ use of it to train AI.ElevenLabs’s data processing agreement
Cloudflare: Checking that a person is there and not a bot (Turnstile): when you start as a guest, when you log in or sign up to the Studio, and when you pair a TV; Worldwide network, company in the US: EU-US Data Privacy Framework and standard contractual clauses.Cloudflare’s data processing agreement
Google Workspace: The mailbox of hello@quizplayground.com: what you mail us, with your email address, such as a question or a request to see or remove your data; Google Cloud EMEA in Ireland; stored worldwide, company in the US: EU-US Data Privacy Framework and standard contractual clauses.Google Workspace’s data processing agreement
Plausible: Website statistics: which pages are visited and where visitors come from. No cookies: your IP address and browser only go into a code that changes every day. Links to the warm-up deck and the memory page go there without their key, and nothing is counted during the show.; EU: company in Estonia, servers in Germany.Plausible’s data processing agreement

For part of a payment, such as preventing fraud, Stripe is responsible itself. Stripe’s privacy policy applies to that.

Seintjes and push notifications

Organizers get seintjes in the Studio: short messages about their party, such as new contributions. We keep a seintje for 30 days. The content of a memory is never in it. A seintje can name a guest; at a holiday show that’s a name from the list of names, never what someone wrote. On the lock screen, a push message of a holiday show names nobody.

Push notifications on your phone or computer are off until you turn them on yourself. If you do, each message goes through your browser’s push service: Apple’s, Google’s, Microsoft’s or Mozilla’s. They receive it encrypted and only see that a message went to your device, and when. A device unused for 60 days drops off the list.

Business customer? You can sign a data processing agreement with us. Print or save it, fill it in and email it to hello@quizplayground.com.

6. AI and your stories

We use AI to turn contributions into quiz questions, and to check contributions for topics that don’t belong in a show, such as looks, weight, health, money and exes.

The AI decides nothing about you. The organizer can see, change or remove every question before the show starts. Only the short sentences players fill in on arrival reach the lobby on the TV as soon as the AI check finds them safe, without the organizer seeing them first. There is no face recognition; only the guests say who is in a photo.

The voice that presents the show is a computer voice from ElevenLabs. It only speaks lines we write for your show, with words from your memories and the guest of honor’s first name. Never a guest’s nickname, and never who wrote what. While it speaks, the TV shows ‘AI voice’.

For the questions, our AI processor is Anthropic. Anthropic doesn’t use your data to train AI, and deletes it after 30 days at most, unless someone breaks their usage rules.

7. Children

Anyone can play, with just a nickname. We ask nothing else about players. Sending in contributions is for 16 and older; we ask for a confirmation.

At a holiday show a child is on the list of names with their first name if the organizer puts it there. A parent or guardian fills in cards about a child, only the kind cards. The parent can have the child’s name removed as chapter 4 describes.

8. Security

Links to the Warm-up Deck and the Recap page contain a key that can’t be guessed. We store photos again, without location and other metadata. Only those allowed can reach the data.

Our own logs and error reports contain no names, email addresses or memories.

Julian of Quiz Playground can reach all data as the administrator, and can log in as a user to help. He only looks at a contribution or an account when someone asks for help or reports something.

If something goes wrong with personal data anyway, we report it to the Dutch Data Protection Authority within 72 hours when required, and tell the people involved.

9. Your rights

You may see your data, have it corrected or deleted, object, and take it with you. This is how:

Organizer: in the Studio you delete everything at once. If you want a copy of everything, email us.
Guest: until the show is locked, you remove your own contribution on the phone you sent it from. After the party, you do it on the Recap page: on that phone with Remove, on another device with a request you confirm with the button in our email. Within 24 hours of your confirmation, it’s gone. Otherwise, ask the organizer or email us.
On the list of names of a holiday show: remove your name with Remove my name in the Warm-up Deck, or ask from another device and confirm with the button in our email. It’s gone at once, with what belongs to it (see chapter 4).
Everyone: email hello@quizplayground.com. You’ll get an answer within a month.

If you gave consent, you can always withdraw it, as easily as you gave it.

Not happy with how we handle your data? You can file a complaint with the Dutch Data Protection Authority.

10. Cookies

The website uses no tracking cookies. We count visits with Plausible, without cookies and without personal data. During the show, on the TV and the phones, no website statistics run.

We only use cookies the site needs: to keep you logged in to the Studio, and to keep a guest who plays in their place.

And a few that remember a choice of yours: your language (NEXT_LOCALE), whether the Studio’s menu is open (sidebar_state), whether the Studio shows its menu at the top or on the side (layout-style) and which team you chose last (last-selected-team). These cookies need no consent.

If you arrived through a link with a campaign code, for example from our Instagram bio, your browser remembers it until you close the tab. Only when you sign up do we store which channel you came from.

11. Changes

If we change this statement, you’ll see it in the date at the top. For big changes we email organizers with an account.

Version 1.10, 10 October 2026. We send earlier versions on request.