Privacy policy
What JoltQuiz collects, why, who else sees it, how long we keep it, and what you can ask us to do about it. We have tried to write it so that it says exactly what the software does and nothing it does not.
Last updated: 28 September 2026
1. Who we are
JoltQuiz is run by Spooky Digital Ltd, a company registered in England and Wales, company number 17479524, registered office 12 Oak Close, Bedworth, CV12 9AJ. In this policy "we" and "us" mean Spooky Digital Ltd. We are registered with the Information Commissioner's Office as a data controller.
Questions about your information, or any request under section 9: email [email protected].
2. Two kinds of people use JoltQuiz
- Hosts have an account. They write quizzes and run them for a room, a club, a class or a website's audience. For host accounts we decide how the information is used, so we are the controller.
- Players join a host's quiz on their phone. They have no account. The host decides who plays and what the quiz asks; we run the quiz for them. For the player information in a host's quiz we act as the host's processor under the data processing terms in our Terms, and the host is the controller. If you played a quiz and want your information dealt with, ask the host first; we will help them, or you can write to us directly.
3. What we collect from hosts
| What | Why | Lawful basis |
|---|---|---|
| Email address, password (stored only as a one-way hash), organisation name, optional display name | To create and secure your account and sign you in | Contract |
| When you signed up, verified your email and last signed in | Account security and support | Legitimate interests |
| Your quizzes, themes, branding, uploaded logos and pictures, and the hosts you invite | To provide the service | Contract |
| Plan, subscription status and a Stripe customer reference. We never see or store your card number — Stripe does | To bill you and apply your plan | Contract; legal obligation for tax records |
| Emails you send us, and the details on our "register interest" form (name, email, venue, message) | To answer you | Legitimate interests |
The register-interest form is not saved on our website: it arrives as an email in our inbox and nowhere else, and we will delete it if you ask.
4. What we collect from players
| What | Why |
|---|---|
| The nickname and team name you type (up to 20 characters, checked against a list of offensive words) | To show you on the leaderboard and big screen |
| Your answers, how long each took, and your score | To mark the quiz and give the host its results |
| A device check: a code made from your browser type, screen size, time zone and a random value. We keep only a scrambled (hashed) version | To warn the host if the same phone joins a quiz twice |
| Whether you left the quiz screen mid-question and for how long (capped at an hour) | Shown to the host only, as a possible sign of looking answers up. It never changes your score by itself |
| If you joined from a website's link (for example a shop running a prize quiz): the website's own reference for you and the name it sent | So the host can tell which of its customers won. The reference is shown only to the host, never on screens or other players' phones |
We do not ask players for an email address, phone number, date of birth or account. The lawful basis is the host's: usually their legitimate interest in running the quiz you chose to join.
Players' chat. If the host switches chat on, messages go to the other players' phones and the host only — never the big screen. They are held in temporary memory, never written to our database, and wiped when the quiz ends.
Camera. A host can broadcast live video of themselves. It is relayed live through Cloudflare and is not recorded by us. Anyone with the quiz's join code can watch it. Hosts must tell people in the room if they are on camera.
5. What is visible to whom
Nicknames, team names and scores appear on the big screen, on players' phones and on the watch page for that quiz, which anyone with the join code can open. The host sees everything in section 4. Don't use a nickname you would not want shown.
6. Cookies and similar storage
JoltQuiz uses no advertising or analytics cookies and no tracking of any kind. What it does store is needed for it to work:
jq_session— one cookie that keeps a host signed in (30 days, or 3 hours for a demo). It is removed when you sign out.- In your browser's local storage: your sign-in (hosts), your seat in a quiz so a dropped connection does not lose your score (players, 12 hours), the device check in section 4, whether you chose to watch the host's camera, and a phone-remote pairing (24 hours).
Because nothing here is used for tracking or advertising, we do not show a cookie banner.
7. Who else handles the information
We use these companies to run JoltQuiz. Each only gets what it needs, under a contract that requires it to protect the information:
- Railway — hosts our servers, database and short-lived server logs (which include IP addresses).
- Stripe — takes card payments and runs subscriptions; receives your organisation name and billing email.
- Resend — sends our account emails, such as confirming your address and resetting a password.
- Cloudflare — our domain's DNS, and the live camera relay.
- Google Fonts — our pages load typefaces from Google, which sees your IP address when it sends them.
- Google (Gmail / Google Workspace) — our email inbox, where support emails and register-interest forms arrive.
If a host puts pictures in a quiz that are hosted on another website, your phone loads them from that website. We never sell personal information, and we do not use it for advertising.
Some of these companies are based in, or store information in, the United States or elsewhere outside the UK. Where they do, the transfer is covered by UK adequacy regulations (including the UK–US data bridge) or the UK's approved international data transfer terms.
8. How long we keep it
- Host accounts — while the account is open. You can delete it yourself from Quizzes & settings → Account & billing → Delete account, which removes it, its quizzes, its results and its uploaded pictures straight away. If you ask us by email instead, we do it within 30 days. Copies in our hosting provider's backups expire on their normal cycle. Billing records are kept as below.
- Quiz results and player information — kept with the quiz so the host can look back at past nights, until the host deletes the quiz or closes the account. A quiz's join code stops working 24 hours after it ends.
- Players' chat — wiped when the quiz ends. Live quiz state expires within 12 hours.
- Billing records — six years, because UK tax law requires it.
- Server logs — short-lived, kept by our host for fault-finding.
- Try-it demos — deleted automatically about three hours after they start. They collect no name or email.
9. Your rights
Under UK data protection law you can ask us to: give you a copy of your information; correct it; delete it; restrict or object to how we use it; or give it to you in a portable format. Email [email protected]. We reply within one month and there is no charge. Hosts can also export their quizzes and every quiz's results from the admin panel at any time, and delete their own account there.
If you are unhappy with how we have handled your information you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would like the chance to put it right first.
10. Children
Host accounts are for people aged 18 or over. Players do not need an account and JoltQuiz only asks them for a nickname, so a school or club can run a quiz for young people; the school or club is responsible for doing that appropriately, including telling parents where it needs to.
11. Security
Passwords are stored as salted bcrypt hashes. Sign-in links, player seats and big-screen links are stored only as one-way hashes. Everything travels over HTTPS. Accounts in different organisations are kept apart at the database level, and repeated wrong passwords are blocked.
12. Changes
If we change this policy we update the date at the top. If a change matters to how your information is used, we will email account holders before it takes effect.