Privacy Policy

CrunchTrivia is operated by Foxbit Software LTD, which is the controller of the personal information described here. This policy covers crunchtrivia.com and everything on it.

It should be read alongside our Terms of Service.

If you host a game

• Your email address and password. These are held by Google Firebase Authentication. The password is never visible to us — Firebase stores a hash of it. Our own database stores no email address; it records only your user ID, a display name, and your default question timer.
• The games you build: titles, questions, answers, point values, and options.
• The results of games you run: your players’ display names, their answers, and their scores.

If you play a game

• The display name you type. You choose it and it can be anything. We suggest a first name or nickname.
• Your answers, your score, and when you submitted.
• An anonymous user ID issued by Firebase so the scoreboard can tell players apart. It isn’t linked to an email address or to any identity, and it doesn’t follow you to other websites.

If you use the support form

• Whatever you put in it — your name, your email address, and your message — so that we can reply.
• A Cloudflare Turnstile check. To tell a person from a bot, Cloudflare receives your IP address and information about your browser. This happens only on the support page.

Automatically, on every page

• Google Firebase Hosting keeps standard server logs of requests to the site, which include IP addresses, timestamps, and browser user-agent strings. These are Google’s operational logs; we use them only to keep the site working.

This list is as much a part of the policy as the one above it, and it is checked against the code rather than aspirational.

• No analytics. No Google Analytics, no product analytics, no session recording, no heatmaps.
• No advertising and no ad tech. Nothing on this site is here to sell you something.
• No cross-site tracking. There are no third-party tracking cookies, pixels, or fingerprinting scripts.
• No location data beyond whatever a general IP address implies in Google’s logs.
• No payment information. The Service is free and we do not process payments.
• No email address for players. Playing never asks for one.

Every use below is one of the reasons we hold the information in the first place. We do not repurpose it.

• To run the Service: signing you in, showing your games to your players, scoring answers, and drawing the scoreboard.
• To keep it secure: making sure only a game’s host can read its answers or write its scores.
• To answer you when you write to us.
• To meet legal obligations where we have them.

We do not use your information to train machine learning models, and we do not make automated decisions about you that have legal or similarly significant effects.

CrunchTrivia sets no cookies of its own, and there is no cookie banner here because there is nothing to consent to. It does use your browser’s own storage:

• Your sign-in session is kept by Firebase Authentication in IndexedDB, falling back to local storage if IndexedDB is unavailable. Without it you’d be signed out on every page you open.
• Your display name is kept in local storage so you don’t have to retype it the next time you join a game. It never leaves your device except when you join.
• Cloudflare Turnstile may set short-lived cookies or storage entries on the support page in order to run its bot check. This happens only on that page.

Clearing your browser storage signs you out and forgets your display name. Nothing else is affected.

We use three service providers, and no others. We do not sell personal information, and we do not share it for cross-context behavioural advertising.

Beyond these, we may disclose information if we are legally required to, or where it is necessary to protect the rights or safety of a person. If CrunchTrivia is ever sold or transferred, information may move with it — and we would say so here first.

Separately from all of this: your host sees your game data. Joining a game means the person running it can see your display name, your answers, and your score, and can put them on a screen. That is what the product is for.

Foxbit Software LTD is based in Canada. The data is held on Google Cloud infrastructure through Firebase, and Google may store and process it in data centres outside Canada, including in the United States. Support form submissions are processed by Crunchforms, and the Turnstile check is run by Cloudflare, both of which may also operate outside Canada.

This means your information may be subject to the laws of those countries, including lawful access by their authorities. Where personal information is transferred out of the European Economic Area or the United Kingdom, our providers rely on the European Commission’s Standard Contractual Clauses or an equivalent safeguard.

Plainly: indefinitely, until someone deletes it. There is no automatic clean-up job, and games from previous years are still in the database. We’d rather say that than publish a retention schedule we don’t actually run.

• Games, questions, answers, and scores stay until the host deletes the game. Deleting a game removes its questions, its players, their answers, and their scores.
• A host account stays until it is deleted. Ask through the support form and we will delete the account and its games.
• Support messages are kept for as long as they are useful for handling your request and any follow-up.
• Server logs are retained on Google’s own schedule, which is measured in days, not years.

Access to the database is controlled by security rules enforced by Firebase on every single read and write. Those rules are the security model: a player cannot read a question’s answer before it is revealed, cannot list the games in the system, and cannot write a score. Only a game’s host can reach its answers.

All traffic to and from the site is encrypted in transit. Passwords are stored by Firebase as salted hashes and are never visible to us.

No system is completely secure. If we ever discover a breach that puts your information at real risk of significant harm, we will report it as required and tell affected people.

Wherever you live, you can ask us to show you the personal information we hold about you, to correct it, or to delete it. Ask through the support form and we will respond within 30 days.

We may need to confirm you are who you say you are before acting on a request — usually by asking you to send it from the email address on the account. We will never charge you for a reasonable request.

In Canada

These rights come from the Personal Information Protection and Electronic Documents Act (PIPEDA) and its provincial equivalents. If you are not satisfied with how we handle your request, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.

In the EEA, the UK, and Switzerland

Under the GDPR and the UK GDPR you also have the right to restrict or object to processing, the right to receive your data in a portable format, and the right to withdraw consent at any time without affecting processing that already happened.

Our legal bases for processing are:

• Contract — running a game you asked to host or join, and keeping your account.
• Legitimate interests — keeping the Service secure, preventing abuse, and blocking spam on the support form. We have weighed these against your interests and kept the data collected to the minimum that works.
• Consent — sending us a support message, which you can simply not do.
• Legal obligation — where the law requires us to keep or disclose something.

You have the right to lodge a complaint with your local supervisory authority, or with the Information Commissioner’s Office in the UK.

In California

Under the CCPA as amended by the CPRA you have the right to know what personal information we collect and why, to delete it, to correct it, and not to be discriminated against for exercising those rights. The categories we collect are set out in the section on what we collect.

We have not sold or shared personal information in the preceding twelve months, and we do not sell or share it now. We do not use or disclose sensitive personal information for purposes beyond those permitted without a right to limit. There is therefore no “Do Not Sell or Share My Personal Information” link on this site, because there is nothing for it to do.

CrunchTrivia is not directed at children under 13, and you must be at least 13 to create a host account.

Playing is a different matter, because trivia gets run in classrooms and youth groups. Playing requires no account and no email address, and the only thing a player supplies is a display name they choose. If you are a teacher or group leader hosting a game for children, you are responsible for that room: tell your players to use a first name or a nickname, and don’t write questions that ask for personal details.

If you believe a child has given us personal information beyond a display name, tell us through the support form and we will delete it.

If this policy changes, we’ll update the date at the top of the page. If the change is significant — a new provider, a new category of data — we’ll make a reasonable effort to tell hosts before it takes effect.

Privacy questions, access requests, and deletion requests all go through the support form. It reaches us directly, and it is the fastest route.

Foxbit Software LTD

Operator of crunchtrivia.com, and the controller of the personal information described in this policy. This policy is governed by the laws of the Province of Manitoba, Canada.