Privacy
Here is, in plain language, what Triviot keeps about you and for how long. We use it to run the game, keep it fair, and fix problems.
Your account
Your email address, the display name you choose (shown on leaderboards), the avatar you picked (and the picture your sign-in provider supplies, if any), and when you joined and were last seen. Your password is handled by our sign-in provider (Supabase); we never see or store it.
Profile photo (optional)
You can pick one of our drawn avatars or upload a photo of your own. It is entirely optional. An uploaded photo is checked, cropped to a square, shrunk to a small 256×256 picture, and stripped of hidden data such as camera details and location before we keep it; we never keep your original file. It is stored privately in our database (not in a public folder) and is only shown to other signed-in players, for example next to your name on leaderboards.
You can change or remove it any time from your profile, a site admin can remove a photo that breaks the rules, and it is deleted when your account is deleted. We note in the activity log that an avatar changed (never the picture itself).
Feedback you send us
If you send feedback from the app (a bug report or an idea), we keep your message, any screenshot you attach, and some context added automatically: the page you were on, your device type, browser and operating system, your screen size, the app version, the game mode if you were in one, the time, and your player profile. No location and no IP address are stored with it.
A screenshot is checked, shrunk and stripped of hidden data such as camera details and location before we keep it; we never keep the original file. It is stored privately in our database and only site admins can see it, so please hide anything personal before you attach it. We don't email you about feedback: if we reply, the reply shows up under My feedback.
Your feedback, screenshots and our notes about them are deleted when your account is deleted.
Your gameplay
The games you play (solo, daily, timed and challenge games), each answer you give and how long it took, your scores, XP, level and badges, which questions you have already seen, and any question reports you send us.
1-on-1 challenges
When you challenge someone we store the challenge itself: who made it, who accepted it, the 10 questions, both players' scores and times, and its status. The person you play sees your display name and photo, your score once they have finished, and your head-to-head record against each other. Nobody sees your email address or phone number, and you never see theirs.
If you type an email address or phone number to invite someone, a text message or email draft opens in your own app. Phone numbers never reach our servers. An email address is only kept as a one-way scrambled code (so we can stop one person being spammed), never in readable form. Challenge links work for 7 days; unplayed challenges then expire.
You can decline, block or report a challenge or player. Blocked players can't challenge you. Admins can see challenges, scores and reports to deal with abuse. If you delete your account, challenges nobody else took part in are deleted; ones shared with another player stay for them, with you shown as a “former player” and no name, photo or invite code kept.
Activity log
We keep a log of what happens on your account so we can spot abuse, help you when something goes wrong, and see which parts of the app are used. Each entry has a time and one of these: signing up, signing in, failed sign-in attempts, password-reset requests, email verification, signing out, being blocked because an account is disabled, starting or finishing a game, sending a report, and visiting the main pages of the app (page name only, never the full address or anything after a ?).
Each entry also records your device type, browser and operating system (for example “mobile · Safari 17 · iOS 17”) and a rough location: country, region and city, worked out by our hosting provider. It is never precise and never uses GPS.
For a failed sign-in we don't keep the email address that was typed, only a masked version such as j***@example.com and a one-way scrambled fingerprint, and never the password.
IP address and how long things are kept
Your IP address is stored only in the activity log, in its own field, and is erased after 30 days (the entry itself stays without it). Only site owners and admins can see it.
Activity log entries are deleted after 13 months. Your account and gameplay data stay for as long as your account exists.
Who can see it
Only the small team that runs Triviot, through a restricted admin area. Helpers can see the activity log but not IP addresses. Every export of the log is itself recorded.
Deleting your data or asking a question
You can ask us to delete your account. Deleting it removes your profile, games, answers, XP, badges, challenges (see above), feedback and screenshots you sent, and your activity log entries; question reports you sent are kept but are no longer linked to you. To ask for this, or with any other privacy question, use the sign-in help page and tell us the email address on your account.