Privacy notice
Version 1.0 · last updated Nov 13, 2026
This Privacy Notice explains what personal data Conquiza ("we", "us") processes when you visit the website or play the game, why, for how long, who helps us, and what rights you have. It is written to meet the EU and UK General Data Protection Regulation (GDPR), Türkiye's Personal Data Protection Law No. 6698 (KVKK), and similar laws elsewhere.
Short version: we collect as little as possible. Your account is an e-mail address, a password and a generated in-game name. We have no advertising, no analytics trackers, we never sell your data and we do not send marketing e-mails.
1. Controller and contact
Conquiza is the controller of your personal data. Contact us through the Support page of the website and choose the topic "Question about my data" for anything about your data.
2. What we collect and why
| Data | Purpose | Legal basis (GDPR art. 6 / KVKK art. 5) |
|---|---|---|
| Account: e-mail address, password (stored only as a secure hash by our authentication provider) | Creating your account, signing in, essential service e-mails (confirmation, sign-in links, password reset, e-mail change) | Performance of the contract |
| Profile: in-game name (made from preset words and a number), country, colour, emblem, time zone, interface and question language | Running the game, national rankings, showing your tiles on the map | Performance of the contract |
| Game activity: rounds, answers and answer times, tiles, duels, teams, tournaments, badges, statistics, question reports | Running the game and its rules, rankings, your statistics | Performance of the contract |
| Fair-play signals: accuracy and answer-time patterns on hard questions | Detecting cheating; accounts are only flagged for human review | Legitimate interest in a fair game |
| Consent records: which version of the Terms and Privacy Notice you accepted, when and in which language | Proving acceptance | Legal obligation and legitimate interest |
| Subscription: plan, status, billing period, Polar customer and subscription identifiers, and the payment notifications Polar sends us (which can include your e-mail and billing country) | Granting the plan you paid for, handling cancellations and refunds | Performance of the contract |
| Support requests: the topic you choose, the language, and for visitors without an account the e-mail address you give | Answering your request | Performance of the contract / legitimate interest |
| Technical data: IP address, browser and device information in requests | Delivering the website, security, preventing abuse (rate limiting). At sign-up the country of your IP address is used once to pre-select your country; it is not stored | Legitimate interest in a secure, working service |
| Guest play: a random token kept in your browser tab, stored by us only as a hash, linked to the rounds you play before signing up | Letting you try the game and keep your result if you sign up | Legitimate interest / steps before a contract |
We do not ask for your real name, address, phone number, date of birth or payment card details. We do not process special categories of data (such as health or beliefs).
3. What other players can see
Your in-game name, country, colour, emblem, tiles on the map, rankings, badges, team membership and duel results are visible to other players. Your e-mail address is never shown to other players.
4. Automated decisions
We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. Fair-play checks only flag accounts; a person reviews every flag before any action.
5. Who processes data for us
We use carefully chosen service providers who process data only on our instructions under data processing agreements:
| Provider | Role | Location |
|---|---|---|
| Supabase, Inc. | Database and authentication | Data stored in the EU (Stockholm, Sweden) |
| Cloudflare, Inc. | Website hosting, content delivery and security | Global network |
| Polar Software, Inc. | Merchant of record for payments (Polar uses Stripe to process cards) | United States |
| E-mail delivery provider | Sending account e-mails | EU or United States |
Polar acts as an independent controller for the payment itself and its tax and accounting duties; see Polar's privacy policy. We may also disclose data where the law requires it, or to protect the rights and safety of our players and the service.
We do not sell personal data and do not share it for cross-context behavioural advertising.
6. International transfers
Some providers process data outside your country, including outside the EU/EEA, the UK and Türkiye (for example in the United States). Where this happens we rely on appropriate safeguards such as adequacy decisions and Standard Contractual Clauses, as required by GDPR chapter V and KVKK article 9.
7. How long we keep data
| Data | Kept for |
|---|---|
| Account, profile and game data | Until you delete your account. Free accounts that have not been used for 12 months are deleted automatically |
| Consent records | As long as the account exists |
| Visitor e-mail in a support request | Deleted when the request is closed |
| Guest rounds that were never linked to an account | 90 days |
| Payment notifications from Polar | 180 days |
| Rate-limit counters (hashed) | 1 hour |
| Administrative audit log | 24 months |
| Hosting and security logs at our providers | Short periods set by the provider (typically days) |
When you delete your account, your data is deleted immediately from our live database. Polar keeps payment records as required by tax law.
8. Your rights
Depending on where you live (for example under GDPR, UK GDPR, KVKK article 11, the California Consumer Privacy Act or Brazil's LGPD), you have the right to:
- access your data and receive a copy: use Account → Download my data (JSON) or ask us;
- correct it: change your details in Account;
- delete it: use Account → Delete account;
- port it to another service (the JSON export);
- restrict or object to processing based on our legitimate interests;
- learn whether your data is processed, for what purpose, to whom it is transferred, and ask for the consequences of unlawful processing to be remedied (KVKK article 11);
- not be discriminated against for exercising your rights.
Send requests through the Support page (topic "Question about my data"). We answer within 30 days at the latest. We may ask you to confirm the request from your account's e-mail address to protect your data.
You also have the right to complain to a data protection authority, for example the authority in your EU country, the UK Information Commissioner's Office, or Türkiye's Personal Data Protection Authority (KVKK Kurulu).
9. Children
Conquiza is not intended for children under 13 and we do not knowingly collect their data. Players under 18 need a parent's or guardian's acceptance. If you believe a child under 13 has an account, contact us and we will delete it.
10. Security
Data is encrypted in transit (HTTPS). Passwords are stored only as hashes by our authentication provider. Access to the database is restricted by row-level security, only the operator has administrative access, and administrative changes are logged.
11. Cookies and similar technologies
We only use what is strictly necessary to run the site and remember your choices; see our Cookie Notice.
12. Changes
We may update this notice. When we make a material change we will show the new version in the app before you continue playing. The version and date are shown at the top.