Privacy Policy

Last updated: 26 September 2026

This policy explains what Qwestions collects about you, why, who else sees it, how long it is kept, and what you can do about it. It covers the Qwestions app on iOS and Android and the servers it talks to.

1. Who is responsible

Ahmad Abdel-Yaman, trading as Mind Games Boutique, 19 Wythenshawe Road, Sale M33 2JQ, United Kingdom, is responsible for your data (the "controller"). For anything in this policy, write to [email protected].

2. What we collect

When you create an account

• If you sign in with Apple: the identifier Apple gives us for you, and the email address Apple shares, which may be a private relay address if you choose to hide your email. On first sign-in, the name you allow Apple to share becomes your display name.
• If you sign in with Google (Android): the identifier Google gives us for you, your email address, and your name, which becomes your display name.
• If you play as a guest: a random identifier for your guest account. A new account starts with free lives and Sparks, and so that they cannot be claimed again and again by reinstalling the app, we also keep a scrambled form of your device's identifier: a one-way keyed hash that cannot be turned back into the identifier, and that is not linked to your account. It is deleted 24 hours after a guest account was last started on the device.
• Your birth year. We use it to check you are old enough to play and to pick questions suited to your age group. Other players are never shown it.
• The username, display name and avatar colour you choose, and your language settings.

When you play

• The games you host: the team names you type in, each team's age group and language, and the answers, times and scores. Team names are whatever you enter; you do not need to use real names.
• Your Sparks (the game's currency), lives, experience points, level and streak, and a history of how they changed.
• Which questions you have been shown, so the game does not repeat them. This is deleted after 60 days.

When you buy Sparks

• The product, the date, and the transaction record the App Store or Google Play gives your device, which we check to make sure the purchase is real. The store handles payment: we never see your card or bank details.

If you allow notifications

• A push token: an address for your device that lets us send it a notification.

When the app talks to our servers

• Our servers record each request (the time, the address requested and whether it worked) to keep the service running and investigate faults. Your IP address is used only briefly, in memory, to limit abusive traffic, and is not stored. Requests reach us through Cloudflare, which also sees your IP address on the way (section 4).

On your device

• The app keeps your sign-in session and your language choice on the device. Signing out removes the session.

What we do not collect

We do not collect your location, contacts, photos, camera or microphone. There is no advertising, no advertising identifier, no analytics or tracking software, and we do not sell your data or share it for advertising.

We do not track you across other apps or websites, and we do not allow anyone else to track you through Qwestions. So the app works the same way whether or not your device or browser sends a "Do Not Track" signal.

3. Why we use it

• To provide the game you asked for: your account, your games, Sparks and purchases. The legal basis is the contract between us, our Terms of Service.
• To keep it secure and working: checking purchases are genuine, limiting abuse (such as claiming a new account's free lives and Sparks over and over), fixing faults. The legal basis is our legitimate interest in running a safe service.
• To keep records the law requires: purchase records for tax and accounting. The legal basis is legal obligation.
• To send notifications, only if you allow them in your device settings, which you can change at any time.

4. Who else receives it

We share data only with the services that make the app work:

• Scaleway (France) hosts our servers and database in Paris, in the European Union.
• Cloudflare (United States) provides the DNS for our domain and protects our servers from attacks. Requests from the app pass through its network, so it sees your IP address and each request on its way to us. It handles them for us only to deliver and protect the service.
• Apple provides Sign in with Apple and the App Store, and delivers notifications to iPhones.
• Google provides Sign in with Google and Google Play. When you buy Sparks on Android, we send Google the purchase token so it can confirm the purchase.
• Expo (United States) relays notifications to Apple and Google. It receives your push token and the notification's text.

Questions in the game are written with the help of an AI service (Anthropic). No information about you or anything you type in the app is ever sent to it.

Other players: in the current app, nothing you enter is shown to anyone else. Games are played on one device, and only the account that hosts them can see them.

We may disclose data if the law requires it, for example in response to a valid court order.

5. Transfers outside the UK

We are based in the United Kingdom and our servers are in the European Union, which UK law recognises as protecting personal data adequately. Apple, Google, Expo and Cloudflare may process data in the United States, and Cloudflare handles each request in whichever of its data centres is nearest to you, which can be in another country. Where any of them processes data outside the UK and the EU, the transfer is protected either by the UK Extension to the EU–US Data Privacy Framework, where the provider is certified under it, or by standard contractual clauses with the UK's International Data Transfer Addendum.

6. How long we keep it

• Your account and game data: for as long as you have the account.
• Which questions you have seen: 60 days.
• Server request records, which contain no IP address or other identifier: overwritten as new ones are written.
• Purchase records: six years, even after you delete your account, because tax and accounting law requires it and because refunds can arrive later.
• The scrambled device identifier from starting as a guest: 24 hours after a guest account was last started on the device.
• Backups of the database: overwritten within 7 days.

7. Deleting your account

You can delete your account at any time from Profile in the app. It takes effect immediately. Delete your account explains how, including how to ask without the app, and exactly what is removed and what is kept.

8. Your rights

Depending on where you live, you can ask to see the data we hold about you, correct it, delete it, receive a copy in a portable form, or object to how we use it. You can change your username, display name, avatar and languages yourself in the app. For anything else, write to [email protected]; we will reply within one month. You also have the right to complain to the Information Commissioner's Office (ico.org.uk), the UK's data protection regulator, or, if you live in the European Union, to your local data protection authority.

9. Children and teenagers

Qwestions is for people aged 13 and over, and the app will not create an account for anyone younger. If you are under 18, please read this policy with a parent or guardian. If we learn that we hold data about someone under 13, we delete it. A parent or guardian who believes this has happened can write to [email protected].

10. Security

Everything between the app and our servers is encrypted in transit (HTTPS). Access to the servers and database is restricted to the people who run the service. No system is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.

11. Changes to this policy

If we change this policy, the date at the top will change. If the change affects what we collect or how we use it, we will announce it before it takes effect.

12. Contact

Ahmad Abdel-Yaman, trading as Mind Games Boutique, 19 Wythenshawe Road, Sale M33 2JQ, United Kingdom.
[email protected]