Privacy policy

Paddo Tech PTY LTD runs Trivista from Australia. In this policy, "we" means Paddo Tech PTY LTD. The policy covers the Trivista website and the Trivista apps for iOS and Android.

The website and the apps run on different systems today. The apps use Google Firebase. The website uses its own servers. Each section says which one it covers.

What we collect

On the website

• Guest account. When you first open the home page or a game page, we make a guest account with a random ID. A cookie keeps you signed in to it.
• Account. If you sign in, we keep your email address and the display name you choose.
• Sign-in codes. We store each code until it expires after 5 minutes.
• Play. Your games, answers, scores, answer times and streaks. The names you type in games and challenges. The topics you type for AI quizzes. The questions you report as wrong.
• Session data. Your IP address and browser type, stored with your sign-in session. We use them for security and rate limits.

In the apps

• Account. Email address, username, display name and sign-in method.
• Play. Quizzes, answers, scores, challenges, friends and invite codes.
• Device data. Crash reports, app usage events, a push notification token and an advertising ID.
• Purchases. Which subscription or purchase you have. The app store handles payment details. We do not see your card.

Why we use it

• To run the game: keep scores, leaderboards, streaks and challenges.
• To show your display name and score to the players in the same game or challenge.
• To send sign-in codes by email.
• To apply the free daily limits and to stop abuse.
• To write AI quizzes and draw question art.
• To find and fix crashes and errors.
• In the apps: to show ads, manage purchases and send notifications you allow.

We process data to provide the service you asked for, for our legitimate interest in running it safely, and with your consent where the law needs it, for example for personalised ads. We do not sell your data.

Who else processes it

These providers process data for us. Each has its own privacy policy.

Website

• Neon hosts our Postgres database in the United States. It stores accounts, games, answers and reports.
• Fly.io runs our API servers in the United States.
• Cloudflare serves the website, runs live game rooms (Durable Objects) and stores question images (R2). It sees IP addresses and requests.
• Resend sends sign-in emails. It receives your email address.
• OpenRouter receives the topic you type and the prompts that ask for questions. It passes them to the AI model provider that answers. Do not put personal details in a topic.
• fal.ai receives a short scene description for each question and draws the line art. It receives no account data.
• Better Auth is the sign-in software we run on our own servers. It sets the session cookie.

Apps

• Google Firebase and Google Cloud: Authentication, Firestore database, Crashlytics, Analytics and Cloud Messaging.
• Google AdMob shows ads and can use your device's advertising ID.
• RevenueCat manages subscriptions and purchases.
• Apple and Google process payments in their app stores.

These providers store data in the United States and other countries. We choose providers that protect data under contract.

What other people see

Players in the same game or challenge see your display name and score. Anyone with a challenge or result link can see the leaderboard and the score card. The score card shows a name, a score and right or wrong tiles. It never shows questions or answers.

Cookies

The website uses one kind of cookie: the sign-in session cookie. It is needed for the site to work. The website uses no advertising or analytics cookies.

How long we keep it

• Guest accounts. A guest session lasts 7 days and renews each time you return. We keep guest games while the account exists. We may delete guest accounts that have no activity for 12 months.
• Signed-in accounts. We keep your account and play until you delete the account.
• Quizzes. An AI quiz you make stays while your account exists. When you delete your account, we delete the quizzes that only you played. A quiz that other players also played stays for them, with no link to you.
• Sign-in codes. They expire after 5 minutes.
• Backups and logs. Database backups and server logs can hold deleted data for up to 30 days.
• App accounts. We keep them while they are active. After you delete one, we remove its data within 30 days.

Your rights

You can ask to see, correct, export or delete your data. You can object to how we use it. You can complain to the Office of the Australian Information Commissioner, or to the data protection authority where you live.

• Website. Go to Delete account to download your data as a file or to delete your account. Deleting removes your games, answers and reports at once.
• Apps. Open Settings, choose Support & Legal, then Delete Account.
• By email. Write to support@trivista.ai from the email address on your account.

Children

Trivista is not for children under 13. We do not knowingly collect data from children under 13. If you think a child gave us data, email us and we will delete it.

Security

We send all data over HTTPS. Only the people who run Trivista can reach the database. No system is perfectly secure.

Changes

When this policy changes, we post the new version here and change the date at the top.

Contact

Paddo Tech PTY LTD, Australia. Email support@trivista.ai.