Privacy Policy

This Privacy Policy explains how ilzion handles personal data when you use our website and live quiz service at https://www.ilzion.com (also reachable at ilzion.com). It covers people who create an account to host or build quizzes, people who join a quiz by PIN as a player, and visitors to the site.

We have written this policy to align with the principles of the EU/UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA/CPRA). We aim to be honest and specific: we tell you what we actually do, not what sounds reassuring. We do not claim to be certified, "fully compliant", or immune to every risk — but we take reasonable measures and try to collect as little as the service needs.

1. Who we are & the scope of this policy

ilzion is a live multiplayer quiz platform. Hosts (account holders) build quizzes and run live quizzes; players join those quizzes by entering a quiz PIN and a nickname, without creating an account. ilzion is operated by an individual sole operator. In this policy, "ilzion", "we", "us", and "our" all refer to that operator, who acts as the data controller for the personal data described here.

A distinctive fact shapes everything below: ilzion is self-hosted. The whole stack — database, authentication, file storage, realtime messaging, cache, and web server — runs on our own private, dedicated server infrastructure (a single dedicated VPS). We do not rely on a third-party managed cloud database, and as a result our list of external parties who touch your data is very short. This policy works alongside our Terms of Service, Cookie Policy, Acceptable Use Policy, and Security overview.

2. The data we collect

We collect different data depending on how you use ilzion. We have grouped it by situation so you can see exactly what applies to you.

2.1 Account holders (hosts and creators)

If you register an account to host quizzes or build quizzes, we collect:

• Your email address — used to sign in, secure the account, and send essential service messages.
• A display name, and an optional avatar image if you choose to upload one.
• Account metadata — your role, your plan, your account status, and sign-in timestamps.
• Your password, which is never stored in plaintext. We store only a one-way hash created with bcrypt; we cannot read or recover your original password.
• Content you create — the quizzes and questions you build, including any images, audio, or video you upload, and the quizzes you host.

2.2 Players who join a quiz

Players do not create an account. To take part, a player enters a quiz PIN and chooses a nickname. For that quiz session we process:

• The nickname the player chooses.
• The avatar or emoji the player picks.
• The player's answers, scores, response times, and streaks during the quiz.

This is intentionally minimal and tied to the specific quiz session. We do not ask players for an email, a real name, or any account details.

2.3 Streaming-platform connections (optional)

Account holders who use streamer features may choose to connect a streaming account via OAuth to Twitch, YouTube, or Kick. When you do, we receive the access and refresh tokens needed to provide those features. We store those tokens encrypted at rest using AES-256-GCM. Connecting a streaming platform is entirely optional and only happens when you initiate it.

2.4 User-generated content

ilzion is built around content you provide. This includes quiz titles, descriptions, questions, answers, and explanations; uploaded media (images, audio, video); display names; and the nicknames players choose. This content may be visible to other participants of a quiz and is handled under our Acceptable Use Policy and Community Guidelines.

2.5 Cookies and local storage

We use a small number of strictly functional cookies and browser storage items. We do not use cookies for advertising, behavioural profiling, or cross-site tracking. In short:

• Authentication session cookies (Supabase sb-*) — keep account holders signed in.
• OAuth state / PKCE cookies — short-lived (around 10 minutes), httpOnly cookies used only during the streamer-connection flow to protect it.
• Browser localStorage — your theme preference, your current play session (quiz PIN, player id, nickname, avatar), your language, and your notification preferences.
• A device id (ilzion_client_id) — a randomly generated value used only to enforce per-quiz kick and block lists for anti-harassment. It is not used for tracking or fingerprinting, and it resets when you clear your site data.

For the full breakdown, see our Cookie Policy.

2.6 IP addresses and security logs

We process IP addresses transiently for security, rate-limiting, and abuse prevention. For security events, our administrative audit logs (visible to the operator/owner only, never public) may record an IP address and user-agent string. These logs exist to detect and respond to abuse and unauthorised access, not to profile you.

When a player joins a quiz by PIN, we process the player's IP address for security and abuse-prevention purposes (for example, to enforce rate limits and curb harassment). Our lawful basis for this is legitimate interests. A join IP is used only transiently for rate-limiting and is not written into the durable quiz play records of a quiz (such as the per-question answers, scores, or reports described above).

3. How and why we use data, and our lawful bases

We only use personal data for the purposes below. Under the GDPR, every use needs a lawful basis; the table shows which basis applies to which purpose.

Where we rely on legitimate interests, we have considered your rights and freedoms and limited the processing to what is reasonably necessary. Where we rely on consent (such as connecting a streaming platform), you can withdraw it at any time, as described in Section 10.

4. No third-party analytics, advertising, or tracking

We want to be unambiguous about this: ilzion uses no third-party analytics, no advertising networks, and no tracking technologies. There is no Google Analytics, no Meta Pixel, no ad network, no behavioural tracking, and no cross-site tracking on ilzion. The cookies and storage described in Section 2.5 are strictly functional and exist only to make the product work.

5. Who we share data with, and our sub-processors

We do not sell your personal data, and we do not share it for cross-context behavioural advertising.For the avoidance of doubt under the CCPA/CPRA: we do not "sell" or "share" your personal information as those terms are defined in that law.

Because ilzion is self-hosted, our list of external parties who process personal data on our behalf (sub-processors) is minimal:

• Our dedicated server / hosting provider — the infrastructure on which our self-hosted stack runs.
• Streaming platforms (Twitch, YouTube, Kick) — only if you choose to connect one, and only to provide the streamer features you requested. Your use of those platforms is governed by their own privacy policies.

We do not currently use a confirmed third-party email-delivery provider, analytics provider, or advertising provider. If that changes — for example, if we add an email delivery provider to send account messages — we will update this section to name that provider before relying on it. We may also disclose personal data where we are legally required to do so (for example, to comply with a valid legal request), or to protect the rights, safety, and security of ilzion, our users, and the public.

6. International data transfers

ilzion runs on a single dedicated server hosted in the European Union (Germany), provided by Contabo, a German hosting provider. For most processing, your data therefore stays within the EU. Depending on where you are located, your data may be processed in a country different from your own.

Where personal data is transferred outside the European Economic Area (EEA), we aim to rely on appropriate safeguards consistent with applicable data protection law — such as the European Commission's Standard Contractual Clauses (SCCs) or a transfer to a country with an adequacy decision. If you would like more detail about where your data is processed, or a copy of the relevant safeguards, contact us at privacy@ilzion.com.

7. How long we keep data (retention)

We keep personal data only as long as we need it for the purpose it was collected. We retain personal data for the following periods:

• Account data — kept until you delete your account or ask us to delete it. When you delete your account, we permanently remove or anonymise your personal data, with purge completed within about 30 days (subject to backup rotation, below).
• Per-question answer records (the raw per-question answers, response times, and streaks of a quiz) — pruned automatically by a scheduled job about 30 days after a quiz finishes.
• Player nicknames — retained until the quiz or the related account is deleted, or until you ask us to remove them by writing to our privacy contact.
• Aggregate scores and quiz reports(a host's results and summary reports) — retained while the relevant account exists, since these are the results the product is built around. They are deleted or anonymised when the account is deleted.
• Security and authentication logs — kept for a short window of around 14 days, sufficient to investigate and respond to security events, then rotated out.
• Backups — routine backups rotate and are overwritten in the normal course within about 60 days, so deleted data may persist briefly in backups before being overwritten.

Anonymous player-join IP addresses are processed for security and abuse-prevention under our legitimate interests and are kept only transiently (for example, for rate-limiting); they are not written into the durable quiz play records described above. We may keep data longer than the periods above only where we are required to by law, or to establish, exercise, or defend legal claims.

8. Data breach notification

Despite our safeguards, no service can rule out a security incident entirely. If a personal-data breach occurs that is likely to affect your rights, we aim to act in line with Articles 33 and 34 of the GDPR:

• Supervisory authority— where the breach is likely to result in a risk to people's rights and freedoms, we aim to notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it.
• Affected users — where the breach is likely to result in a high risk to your rights and freedoms, we aim to notify you without undue delay.

When we notify you, we aim to describe, as far as we know it: the nature of the breach; the categories of data affected; the likely consequences; and the measures we have taken or propose to take to address it and to mitigate harm. We will also give you a point of contact for more information. You can reach our breach contact at security@ilzion.com.

9. Automated decision-making and profiling

ilzion does not make decisions about you based solely on automated processing — including profiling — that produce legal effects concerning you or similarly significantly affect you, within the meaning of Article 22 of the GDPR. Quiz play scoring is deterministic and rule-based(points follow the quiz's configured rules, correctness, and response time); it is not used to profile you or to make consequential decisions about you outside of the quiz itself.

9.1 Data Protection Impact Assessments

For processing that may involve a higher risk to people's rights and freedoms — for example, processing that involves minors — we aim to carry out a Data Protection Impact Assessment (DPIA) in line with Article 35 of the GDPR, to help us identify and reduce that risk before and while we process the data. We aim to keep these assessments under review and revisit them periodically as the service changes.

10. Your rights

10.1 If you are in the EU/UK (GDPR)

You have the right to:

• Access — get a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — ask us to delete your data ("right to be forgotten").
• Restriction — ask us to limit how we use your data, by emailing privacy@ilzion.com.
• Portability — receive your data in a portable, machine-readable form.
• Objection — object to processing based on legitimate interests, by emailing privacy@ilzion.com.
• Withdraw consent — where we rely on consent (such as a streaming-platform connection), withdraw it at any time without affecting prior lawful processing.
• Complain to a supervisory authority — lodge a complaint with your local data protection authority if you believe we have mishandled your data.

10.2 If you are in California (CCPA/CPRA)

You have the right to:

• Know what personal information we collect, use, and disclose.
• Delete the personal information we hold about you.
• Correct inaccurate personal information.
• Opt out of the sale or sharing of your personal information — note that we do not sell or share your personal information, so there is nothing to opt out of.
• Non-discrimination — we will not treat you differently for exercising your privacy rights.

10.3 How to exercise your rights

Account holders can review and update much of their information directly in their account settings. From there you can also request a copy of your data (data export) or request deletion of your account; you can also start deletion at data deletion or delete your account. Deletion permanently removes or anonymises your personal data, subject to the short recovery window and backup rotation described in Section 7.

Alternatively, you can exercise any of the rights above by emailing privacy@ilzion.com. Players without an account — if you joined a quiz by PIN and never signed up — can request your data here instead. We may need to verify your identity before acting on a request. We aim to respond to a data-subject request within 30 days. Where a request is complex or you have made a number of requests, we may extend this by up to a further two months as the GDPR allows; if we do, we will let you know within the first 30 days and explain why. You may use an authorised agent where the law allows.

10.4 Supervisory authority, DPO, and representative

If you are in the EU or UK, you have the right to lodge a complaint with your local data protection authority (DPA) if you believe we have mishandled your personal data. We would appreciate the chance to address your concern first at privacy@ilzion.com, but you may contact your DPA at any time.

At our current scale, ilzion has not appointed a Data Protection Officer (DPO) or an EU/UK Article 27 representative, as we do not believe we currently meet the thresholds that make either mandatory. We keep this under review and will appoint and name one here if that changes. For any privacy or data-protection matter, our contact point is privacy@ilzion.com.

11. Children and families

ilzion is available to a general audience of all ages. Players join quizzes anonymously by nickname without creating an account, so children can take part without us collecting personal account data from them — we only process the nickname and quiz play data described in Section 2.2.

You must be at least 13 (or the minimum digital-consent age in your country, whichever is higher) to create an account. Account creation (to host or build quizzes) should be done by someone old enough to agree to our Terms of Service in their country, or with the involvement of a parent, guardian, or teacher. ilzion does not knowingly collect more personal information from children than the nickname and quiz play data described above. A parent, guardian, or school can contact us at privacy@ilzion.comto review or delete a child's data.

12. How we protect data (security overview)

We take reasonable technical and organisational measures to protect personal data. These include hashing passwords with bcrypt (we never store plaintext passwords), encrypting OAuth tokens at rest with AES-256-GCM, running on dedicated server infrastructure under our control, restricting administrative access, and keeping security audit logs. No service can promise to be unbreakable, and we do not make that promise — but we work to reduce risk and respond to issues responsibly. For more detail, and how to report a vulnerability, see our Security overview or email security@ilzion.com.

13. Changes to this policy

We may update this Privacy Policy from time to time — for example, if we add a sub-processor or change how a feature works. When we do, we will revise the "Last updated" date at the top of this page, and we will provide a more prominent notice for material changes where appropriate. Please review this page periodically.

14. Contact us

You can reach the right inbox for your purpose:

• Privacy and data requests (access, export, deletion): privacy@ilzion.com
• General support: support@ilzion.com (or our Support page)
• Legal notices: legal@ilzion.com
• Security disclosure: security@ilzion.com
• Copyright / DMCA: dmca@ilzion.com (see our DMCA Policy)

You can also visit our Contact page. For the rules of using ilzion, see our Terms of Service; for cookies, our Cookie Policy.