Privacy Policy

• Account information: your display name, username, password (stored only as a cryptographic hash) and — if you register with a username or Google — your email address.
• Google sign-in: if you register with your Google account, we receive only your name, email address and public profile picture from Google (scopes: openid, email and profile). We never have access to your Google password.
• Phone number: stored only if you choose SMS registration, to send a one-time code (in preparation — coming soon).
• Game data: scores, level and experience, stage progress, wins and losses, leaderboard ranks and in-game activity.
• Technical information: standard server logs (such as browser type) to keep the service stable and secure.

You can play without providing any personal information. In this mode only a random username and your game progress are stored. You can upgrade a guest account to a full account (Google, SMS (coming soon) or username) at any time; your progress and scores are preserved.

• Creating and maintaining your account and signing you in securely
• Sending a one-time code for SMS login (only if you choose that method) (in preparation — coming soon)
• Showing your score, rank and progress in the game and on leaderboards
• Checking the validity of in-app purchases and crediting them
• Supporting users and answering requests

In-app purchases are processed through the official stores (Cafe Bazaar and Myket). We never access, receive or store your banking information or card number; only the purchase result and receipt identifier are recorded with us for validation. Refund rules are described in theRefund Policy.

To keep you signed in we use a session cookie, and to remember your last account on a device we use the browser’s local storage. This data exists only for your convenience and never includes your password. Full details live in theCookie Policy.

• Google sign-in: signing in with Google is performed by Google and your profile information is processed according to Google’s Privacy Policy.
• SMS: one-time codes are sent through domestic SMS providers (such as Kavenegar or SMS.ir) (in preparation — coming soon).
• Hosting and database: the service runs on secure cloud infrastructure (Vercel and Supabase) and your data is kept with them.

We never sell your personal information and never use it for advertising. Your data is shared only with the providers required to run the service (Section 6): Google for sign-in, the SMS provider for one-time codes (in preparation — coming soon) and the hosting infrastructure.

Your password is never stored in plain text (only a cryptographic hash). All service traffic uses HTTPS, and administrative access to data is limited and controlled.

You can request complete deletion of your account and data at any time; simply contact us from inside the game or through the email below.

The game is designed for all age groups and does not collect any specific sensitive information (such as national ID numbers or location). Parents are responsible for supervising their children’s use; if needed, contact us and your child’s account will be deleted.

Child-safety commitments: the game has NO free-text chat with strangers; competitions run only through invite codes/links or system-chosen automatic opponents, and no free text is ever exchanged between players. Adding a friend works only with the 5-digit code you deliberately give to your friend. No targeted advertising is shown and data is never sold for advertising. To delete your child’s account or raise any other safety concern, contact support@quizofkoko.com.

Support email: support@quizofkoko.com

To improve the game, only a limited, fully internal set of events is recorded; no third-party analytics tool is used and the game contains no advertising trackers. This recording happens at two separate levels:

• Technical logs — log only, never stored in the database: through /api/events a few limited events — such as session start, abandoning a quiz midway and pressing the back button — along with optional details (locale, quiz id, answer count and timing) are written ONLY to the server log and are never stored in the database.
• Product counters — visible to admins only: through /api/analytics, simple product events — such as landing-page views, the entry choice (register or guest), showing/dismissing the account-claim prompt, enabling notifications and entering the cup — plus server-side records of successful registration, guest-account creation and account claim — are stored in the analytics_events table, which only admins can access.

The player identifier in these statistics is derived only from the session cookie (an HttpOnly cookie that scripts cannot read) and is never accepted from your browser.

Data retention: event logs are removed according to the hosting platform’s log-retention policy; analytics rows are kept only for product improvement and will be deleted on request via support@quizofkoko.com.

If this policy changes, the new version will be published on this page and the update date at the top of the page will be refreshed.