Privacy Policy

Scope & who we are

This Privacy Policy describes how Friend Quiz (“we”, “us”) handles information when you use the website at https://friendquiz.org/ (the “Service”). It applies to visitors, quiz creators, and players who interact with the Service directly - not to third-party apps or sites you visit after you leave.

Where local privacy laws apply, they may give you extra rights; we aim to honor valid requests consistent with law. If anything in this policy conflicts with a mandatory rule where you live, the mandatory rule wins for you.

What we intentionally don’t want you to submit

The Service is not designed for confidential, regulated, or high-risk data. Please do not include in quizzes, Verthi Moments, nicknames, Pritvi messages, contact forms, or anywhere on the Service: government ID numbers, payment card data, account passwords, login codes, precise location histories, health diagnoses, genetic data, racial/ethnic origin, political opinions, union membership, religious beliefs, sexual life/orientation (beyond what you casually choose to type), criminal records, or children’s personal data beyond what’s reasonably needed for casual play.

If you submit such information anyway, you understand we may delete it, restrict processing, disable related content, or send it to safety tools as described below. You remain responsible for what you submit.

Categories of information we collect

Depending on how you use the Service, we may collect:

• Quiz & gameplay data: display names or nicknames, quiz prompts and answer choices you configure as creator, responses and scores from players, session identifiers, and related metadata needed to score and display results.
• Verthi Moments data: group names, creator and contributor names, captions and notes, links you add, uploaded photos/clips/screenshots, and technical metadata needed to store, show, moderate, or report a Verthi Moments page. See Section 3.1.
• Consent records: when you choose cookie extras, honor Global Privacy Control, or record (or skip) Terms/Privacy on create or Your data, we store a hashed visitor id, hashed IP, hashed browser string, country code if Cloudflare sends one, the policy version shown, the screen, the choice, and whether a delayed explanation was shown. We do not store raw IP in that log.
• Technical & security data: hashed IP addresses for analytics (not raw IPs in product analytics), approximate location derived from IP where available, browser/device type, language, timestamps, referrer URLs where transmitted, abuse signals, and diagnostic logs. Privacy-center requests store the requester IP for accountability.
• Communications: contents of messages you send via our contact form (for example name, email, subject, body).
• Optional account email: if you add or change an email, we first send a 5-digit code to that inbox and store the address only after you enter it. That lets you log in later from any device with a one-time login code, and lets us send quiz-related emails (for example score alerts) until you unsubscribe or delete the data. Skipping the save-account screen stores no email. The quiz still exists on that browser.
• Optional profile photo: if you upload one, we store a cropped square copy so friends see it on your quiz link and when they start playing. That cropped file is screened with ChatGPT safety tools (when that feature is enabled) before it is shown. We keep a hash/preview in the moderation log, not a second copy of the photo. You can change or remove it from your dashboard. Deleting the quiz also deletes the photo.
• Optional Pritvi chat: if you message Pritvi, we send that text (and a short session of recent turns) to ChatGPT to generate a reply. See Section 3.2. We keep the thread in your browser session, not as a permanent support ticket. Do not paste passwords, login codes, payment details, or other people’s private data into that chat.
• Search visibility: on the last share page you can hide your quiz from Explore and public leaderboards so search engines are less likely to list it. Friends can still play with your link. Play URLs are already noindex.
• Cookies & similar technologies: see Section 6.
• Third-party tools: advertising networks, analytics vendors, push-notification providers (for example OneSignal where loaded after you request alerts), fonts, or embedded widgets may collect data under their own policies when extras are allowed.

Verthi Moments

If you create a Verthi Moments page or add a moment, we store that content so people with the relevant link can see it. Photos, clips, and screenshots are stored on our servers. Some Verthi Moments fields and media files are encrypted at rest. We decrypt them to show the page to viewers and contributors who have access. That is not end-to-end encryption: Friend Quiz can access the content to operate, secure, and moderate the Service.

A view link is typically unlisted: we do not publish Verthi Moments pages as a public feed, but anyone with the view link can open it. Contributor invites are separate. We try to strip precise location (EXIF GPS) from uploaded images before they are shown, but you should not rely on that as a complete metadata wipe. Do not upload content you are not allowed to share. You can report a Verthi Moments page. Creators can remove moments they host.

Pritvi & ChatGPT

Pritvi is an optional in-product guide. When you type a question (other than a starter chip we can answer locally), we send that message and a short window of recent turns to ChatGPT so it can write a reply. ChatGPT is a third-party generative AI service. That provider processes the prompt on its systems, which may be outside your country (including the United States), under its own terms and ChatGPT privacy notice.

If you use Write a quiz from what you like, we send the words you type to ChatGPT so it can write ten questions and create the quiz. We do not send your email, quiz scores, or photos with that request. The same ChatGPT privacy notice applies. You can skip this option and create a quiz with ready-made questions instead.

We use ChatGPT as a service provider to generate Pritvi replies, to draft quizzes from words you choose to submit, and, when enabled, to screen user text and optional profile photos. That processing is not a “sale” or “share” of personal information for cross-context behavioral advertising. Friend Quiz does not train its own models on your Pritvi chats or quiz-from-words drafts. We do not control ChatGPT’s retention, logging, filtering, uptime, or security. Do not paste anything you would not send to a third-party AI service.

Pritvi is not a human, not customer support, and not a way to open a ticket. Replies can be wrong, incomplete, invented, biased, or out of date. Do not rely on Pritvi for legal, medical, financial, or safety-critical decisions. Do not paste passwords, login codes, payment cards, or other people’s private data into the chat. We may apply fair-use limits, cooldowns, and automated safety screening. Starter chips may be answered locally without calling ChatGPT. If you do not want prompts sent to ChatGPT, do not type in the chat.

We keep the thread in your browser session so the conversation can continue; we do not treat it as a permanent support record. We may log safety decisions (for example a blocked prompt) with a short preview or hash, not as a full chat archive.

Purposes & legal bases

We use information to:

• Operate the Service (create quizzes, including optional ChatGPT-drafted questions from words you submit, host Verthi Moments and moments, calculate scores, show scoreboards, optional email login, and the optional Pritvi AI guide).
• Deliver optional transactional or notification emails you requested, including login codes and score alerts.
• Maintain reliability, debug errors, measure aggregate usage, and plan capacity.
• Detect, investigate, and prevent fraud, spam, abuse, security incidents, and violations of our Terms & Conditions.
• Comply with law, respond to lawful requests, and establish or defend legal claims, including keeping hashed records of cookie extras and Terms/Privacy choices so we can demonstrate what was chosen.
• Show ads or sponsored placements where configured.

For visitors in the EEA/UK where GDPR applies, we rely on one or more of: contract (providing the Service you request, including hosting a quiz you create even if you leave the Terms switch off), legitimate interests (security, anti-abuse, aggregate analytics, service improvement, and demonstrating what cookie/Terms choices were made - balanced against your rights), legal obligation where we must keep proof of a choice, and consent where required (for example certain non-essential cookies or marketing technologies). Cookie extras are optional. You may refuse them and still create and play. You may withdraw extras consent on Your data or using browser/GPC controls. The create-quiz Terms switch is optional; turning it off does not stop onboarding.

Automated decisions

Scoring quizzes is automatic arithmetic based on answers you and players provide; it is not intended to produce legal or similarly significant effects about you under GDPR-style definitions. We do not use your data for automated credit, employment, or housing decisions.

We also use automated screening (a local denylist for text, and ChatGPT safety classifiers when configured for text and optional profile photos) plus human review to refuse or queue user-generated content that appears to violate our Terms - including child sexual exploitation, threats, and other prohibited material. That screening is for platform safety, not for profiling you for ads or credit. A blocked upload or message is not a court judgment. Pritvi’s replies are generated by ChatGPT; they are assistance, not automated decisions with legal or similarly significant effects about you.

Cookies & similar technologies

We use cookies, local storage, pixels, or similar technologies. A banner lets you allow extras or keep necessary only. Both choices work. Global Privacy Control is treated as necessary only. Until you choose, extras stay off. Creating a quiz does not require allowing extras.

• Necessary (always): ci_session, performer, question_id, q_ans_*, fq_owner, fq_login (optional email-login session after you enter a code), fq_consent, fq_cid (links hashed consent records to this browser), fq_terms_v (set only if you record that you agreed to the current Terms and acknowledged the Privacy Policy), fq_wown / fq_pmo_* / fq_pmj_* (Verthi Moments creator and contributor device locks), and short-lived copy/discover cookies needed to create, play, and share.
• Analytics (off until Allow extras): fq_vid and first-party visit/event logging, plus Google Tag Manager analytics if configured.
• Marketing (off until Allow extras): Adsterra and custom-header ad/conversion tags.

You can change extras any time on Your data. Blocking strictly necessary cookies may break create/play/share.

Advertising & “sale / sharing” wording

Third-party ad partners may process identifiers (such as cookie IDs or device signals) to measure delivery, frequency cap, or personalize ads. Their processing is governed by their own notices and choices.

California residents: certain transfers of personal information for cross-context behavioral advertising may qualify as “sharing” or “selling” under the CPRA/CCPA even when no money changes hands. We provide the disclosures and rights described in Section 12. Industry opt-out tools (for example the Digital Advertising Alliance or Global Privacy Control, where recognized) may help limit some uses.

We do not knowingly sell personal information of minors under 16 without affirmative authorization where required by law. Sending Pritvi prompts or optional profile photos to ChatGPT as a service provider is not a sale or share for advertising.

How we share information

We may disclose information to:

• Vendors & service providers that host infrastructure, send email, provide security tools, analytics, customer-support tooling, ChatGPT (for Pritvi replies and, when enabled, safety screening of user text and optional profile photos), advertising networks including Google AdSense (when enabled, Google’s crawler may sign in with a dedicated, non-personal site account so it can view pages that normally require a quiz-owner cookie, such as the share page, and review ad placements; that account cannot change or delete quizzes), or payment-related services if ever offered - under contractual confidentiality and processing terms.
• Professional advisers (lawyers, accountants, insurers) where bound by duties of confidentiality.
• Authorities & others when we believe disclosure is required by law, regulation, legal process, or governmental request; to enforce our terms; to protect rights, safety, or security; or to detect/prevent fraud or abuse.
• Business transfers: an acquirer or successor in a merger, asset sale, financing, or restructuring, subject to applicable notice requirements.

We may publish or share aggregated or de-identified information that cannot reasonably identify you.

International transfers

We may process and store information in countries other than your own, including where our hosts, email provider, payment provider, advertising partners, and ChatGPT operate (which may include the United States). Where transfers from the EEA/UK/Switzerland require safeguards, we aim to implement appropriate mechanisms (such as standard contractual clauses) as required by applicable law. By using Pritvi or uploading a profile photo that is screened, you understand that prompt or image data may leave your country for that processing.

Retention

We retain personal information only as long as necessary for the purposes above, including security backups, dispute resolution, and legal obligations. Retention periods vary by data type; some logs roll off automatically. Hashed cookie extras and Terms/Privacy choice records are kept for up to six years so we can demonstrate what was chosen, then deleted. Deletion may lag in backups or cached systems for a limited period. We may retain minimal records where needed to prevent re-registration by banned actors or to defend legal claims. Truncated copies of submitted text and automated safety decisions may be kept for a limited period so we can review abuse and improve protections.

Security

We implement reasonable administrative, technical, and organizational safeguards appropriate to the nature of the Service: hashed admin passwords, hashed analytics IPs, hashed consent-log IPs, owner tokens for new quizzes, hashed one-time login codes, PIN proof for inbox-linked access/deletion, content screening, and payment checkout off our servers (Dodo). No method of transmission or storage is completely secure. ChatGPT and other vendors have their own security. We cannot guarantee absolute security and we do not claim the product is finished. Backups can lag behind a deletion. You use the Service at your own risk as described in our Terms. We keep improving these measures over time.

Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, restrict or object to certain processing, withdraw consent, appeal our responses, or receive a portable copy of information you provided.

California residents: you may have rights to know categories/sources/purposes of collection; request deletion; correct inaccuracies; and opt out of certain sales/sharing for cross-context behavioral advertising, subject to verification and exceptions (for example completing transactions or detecting security incidents).

EEA/UK/Switzerland: you may lodge a complaint with your local supervisory authority.

Use Your data to: (1) download or delete inbox-linked records with an 8-digit PIN emailed to that address, or (2) download or delete the quiz this browser owns without email. A device download can include hashed consent records for this browser. Optional account login uses a separate 8–7 letter-and-number code sent to the same inbox. We do not tell the screen whether an inbox was found. Confirmation emails include one generic anonymous feedback link with no tracking token. Public lifetime quiz counts are not reduced by deletion. Paid-badge payment IDs may be retained in anonymized form for dispute records. Hashed consent records may be kept for the retention period above even after a quiz delete. You may still use the contact page for other requests. We may deny requests that are fraudulent, excessively repetitive, or manifestly unfounded under applicable law.

Children

The Service is not directed at children under 13 (or the minimum digital-consent age in your jurisdiction). We do not knowingly collect personal information from children below that threshold without appropriate parental consent where required. Do not create a quiz, Verthi Moments page, or Pritvi chat for a child under that age. Parents or guardians who believe we have collected a child’s information should contact us promptly; we will take appropriate steps, which may include deletion.

Third-party links & embedded content

Links to social networks or other sites are not endorsements. Embedded players, widgets, or scripts may collect data independently; please review their policies.

Changes

We may update this policy from time to time. We will revise the “Last updated” date above and, where required by law or reasonably appropriate, provide additional notice (for example a banner or email for material changes affecting previously collected data).

Contact

For privacy inquiries or to exercise rights, use the contact page. We do not publish a direct inbox address here to reduce scraping.