Privacy Policy

Last updated: 29 September 2026

This Privacy Policy explains how HELUSSIVE EOOD (UIC 202657819) ("Quizzja", "we", "us") collects, uses, and shares information when you use the Quizzja crossword apps and website (the "Service"). HELUSSIVE EOOD, Georgi Dimitrov 16, 3458 Gorna Luka, Chiprovtsi Municipality, Montana Province, Bulgaria, is the controller of that information.

1. Information We Collect

Account information. When you first open the app we create an anonymous account tied to a randomly generated device identifier, so you can play without signing up. If you create a full account you also provide an email address, a display name, and a password (which we store only as a salted hash). If you sign in with Apple, Google, or Facebook, we receive a provider-specific identifier and, where you choose to share it, the email address associated with that provider. The app sends us a short-lived OpenID Connect identity token so we can verify the sign-in; it does not send a social-network access token, and we do not use the token to read your contacts, posts, or other social data.

Gameplay data. We store your puzzle progress, completed crosswords, hint usage, hint balance, purchased entitlements, and your language and app preferences (interface locale, content language, sound, haptics, theme). Progress is synced across your devices so you can continue where you left off.

Purchases. Purchases and subscriptions are processed by the relevant app store or payment provider (Apple App Store, Google Play, Samsung Galaxy Store, or Stripe). We receive a transaction identifier, product identifier, purchase state, and entitlement status to deliver and restore what you bought. We do not receive or store full payment-card numbers. Where offered, Lifetime Pro is a one-time, non-consumable purchase that removes ads and grants unlimited hints; it does not unlock puzzle packs, renew, or expire, and it is not a subscription.

For Samsung Galaxy Store purchases, we send Samsung an obfuscated identifier derived from your Quizzja account to bind the purchase to that account. We use Samsung receipt lookups and refund notifications to verify and update the corresponding entitlement.

Technical and usage data. We collect information necessary to operate the Service, such as device platform, app version, language, IP address, and server logs used for security, debugging, and abuse prevention.

Communications. If you verify your email, reset your password, or request a data export, we send transactional email through our email provider.

Feedback and support. If you report a bug or request a feature through the website, we collect the description you submit and, only if you choose to provide them, your name and email address. The submission is stored as an issue in our private GitHub repository so we can investigate it and contact you about it. Do not include passwords, payment details, or other sensitive information in the description.

Measurement. If, and only if, you switch it on, Google Analytics records normalized screens and a fixed list of product actions, such as opening, starting and completing a puzzle, using a hint, sharing, completing sign-in or sign-up, and opening the store or checkout. The properties are broad categories: platform and app version, interface and puzzle language, difficulty, grid-size range, where the action began, and ranges for solve time and hints. We do not send puzzle or account identifiers, email addresses, search text, titles, answers, clues, purchase identifiers, prices, error messages or other free-form content. Google also receives your IP address, the approximate location derived from it, device/browser information, and a random identifier stored on your device. Measurement is off until you turn it on; switching it off stops it immediately and deletes its first-party identifier. We configure the property so that Google may not use this data for advertising, and we do not build advertising profiles of players from it.

On Android, Google Analytics for Firebase is disabled until you separately turn on Usage measurement. Its consent is independent from Google UMP/AdMob advertising consent. Firebase automatic screen reporting, Advertising ID collection, analytics advertising storage, ads personalization and Signals remain disabled. Withdrawing stops collection immediately and resets Firebase's local analytics state.

On iOS and macOS, measurement is unavailable until a production destination is configured and remains off until you separately turn on Measurement. Neither Apple app uses a third-party analytics SDK or sends an advertising identifier for measurement; both send the same categorical product data described above directly to Microsoft Azure Application Insights as custom events, without a stable account, installation, device, session, puzzle, product or transaction identifier. There is no automatic instrumentation, no first-open or session event, and no stored queue: events are held in memory only. Withdrawing detaches the sender and drops unsent events immediately, without restarting the app, and deleting your account also forgets the Measurement answer on that device.

On Windows, Microsoft Azure Application Insights is unavailable until a production destination is configured and remains off until you separately turn on Measurement. The app uses only custom events: automatic instrumentation, host/device detection, diagnostics, crash reporting, offline retry storage and advertising identifiers are disabled or absent. It sends the same categorical product data described above, without a stable account, installation, device, puzzle, product or transaction identifier. Withdrawing immediately disconnects the exporter, cancels in-flight export and drops unsent in-memory events.

Advertising. A Web release configured for advertising may request contextual, non-personalized ads from Google AdSense, and the iOS and supported Android apps may request ads through Google AdMob. Advertising is off until the applicable consent controls permit an ad request. Web advertising is a separate choice from optional storage and measurement, and a browser Global Privacy Control signal keeps it off. Android and iOS use Google's User Messaging Platform (UMP) for the choices required in the player's region. A current, trusted server entitlement for Premium or Lifetime Pro prevents all ad requests. Remove Ads prevents in-feed and interstitial requests; when the verified hint balance is zero, the player may still voluntarily choose a rewarded ad for one hint.

On the Web, allowing advertising enables Google's Privacy & messaging consent service after Quizzja verifies ad eligibility on a supported content screen. Google may ask for additional purpose and vendor choices; its controls must also permit the request before the AdSense publisher tag loads. Optional storage, measurement, acceptance of our Terms, and a purchase are not substitutes for advertising consent. You can refuse advertising and still play the core game.

The formats differ by app. A Web release explicitly enabled for advertising may show labelled in-feed cards on Today and in the crossword archive or catalogue, only alongside loaded puzzle content in supported advertising languages. Ads are disabled until publisher approval and the required account configuration are in place. The Web player has no rewarded-hint offer or completion ads in this release. iOS may show labelled sponsored cards on Today and Browse, an interstitial after a frequency limit of three distinct completed puzzles, and an optional rewarded ad in the Store when the verified hint balance is zero. Google Play Android may show labelled native cards on Today and Browse after every seventh puzzle row, an interstitial after three distinct completed puzzles and dismissal of the celebration, and an optional rewarded ad for one hint when the verified hint balance is zero. The Samsung Android build contains the same gated placements but requires separate Samsung app and ad-unit configuration before release. Native macOS and Windows contain no advertising integration. Linux and Huawei Android do not have a release-ready advertising path.

When an ad is requested, Google may receive the IP address and approximate location derived from it, browser or device and operating-system information, the page or app context, ad impressions and interactions, diagnostic/performance information, and device or advertising identifiers where the operating system, Google consent state, and applicable law permit them. Quizzja requests contextual/non-personalized advertising and does not combine account, email, puzzle, purchase, or measurement data with Google's advertising profile. Third-party vendors, including Google, use advertising cookies to serve ads; where publisher and user settings permit personalized advertising, Google and its partners may base ads on visits to this or other sites. You can opt out of personalized Google advertising in My Ad Center. Google and its partners may use cookies, local storage, SDK storage, and network identifiers for ad delivery, frequency control, fraud and abuse prevention, security, and aggregate reporting. Non-personalized advertising can still use cookies and process personal data. See the Cookie Policy for the Web identifiers and controls.

Choosing a rewarded ad is optional. For the iOS and supported Android rewarded-hint flows, Quizzja sends Google the Quizzja account identifier and a one-use reward-attempt identifier so Google's signed server callback can verify that one hint was earned. Those values are used for reward verification and fraud prevention, not personalization. A cancelled, unavailable, failed, or unverified ad grants no hint.

2. How We Use Information

To provide, maintain, and sync the game and your account.
To process purchases and grant entitlements.
To send transactional messages (verification, password reset, data export links, important notices).
To respond to feedback, investigate bugs, and plan improvements you request.
To secure the Service, prevent fraud and abuse, and debug problems.
To understand which parts of the Service are used, where you consent to measurement.
To fund the free Service with contextual advertising, where you separately allow it, and verify an optional rewarded hint.
To comply with legal obligations.

We do not make decisions about you by automated means that produce legal or similarly significant effects. Quizzja does not build a marketing profile from your account or measurement data, and measurement never receives your account, email address, puzzle progress or content, purchases, or other free-form data.

3. Legal Bases (EEA/UK)

Where the GDPR or UK GDPR applies, we rely on: performance of a contract (operating your account and the game, delivering purchases, and verifying a rewarded hint you request), legitimate interests (security, abuse prevention, improving the Service), consent (optional storage on your device, measurement, advertising where consent is required, and any optional notifications), and legal obligation (keeping purchase and tax records).

Measurement rests on consent alone. Advertising storage and access also rests on consent where applicable law requires it, including for non-personalized ads. You may refuse either choice and still use the game. On the Web, open You → Privacy and data → Cookie settings and choose Essentials only to withdraw all optional choices, or change individual categories and select Save. When available, Advertising privacy choices opens Google's purpose and vendor controls. Android and iOS expose Google's Ad privacy choices where required by UMP.

Withdrawing stops future requests for the category you switch off and removes the recognized first-party identifiers under our control. It cannot recall data already sent or necessarily stop an ad already being presented. Google-domain cookies and consent records are managed through Google's controls and your browser or app settings. Processing that lawfully occurred before withdrawal is not affected.

4. How We Share Information

We share information with the following providers as needed for the features you use and the purposes described in this Policy:

Authentication providers — Apple, Google, Facebook (for sign-in).
Payment / store providers — Apple, Google, Microsoft, Samsung, Stripe (for purchases).
Hosting and infrastructure — our cloud hosting provider Google Cloud.
Email delivery — our transactional email provider.
Issue tracking — GitHub, which stores bug reports and feature requests in our private repository.
Measurement — Google, as our processor for Google Analytics on Web and Android, and Microsoft, as our processor for Azure Application Insights on Windows, iOS and macOS; each client sends measurement only with your separate consent.
Advertising — Google and its authorized advertising partners for AdSense on Web and AdMob on Android and iOS, only when the applicable advertising controls allow a request. Depending on the processing and applicable law, Google may act as our processor or as an independent controller. Google explains how it uses information from sites and apps that use its services.

We may also disclose information to comply with the law, enforce our terms, or protect the rights and safety of our users and the public. We do not sell your personal information for money. Google and its advertising partners receive the advertising data described above; whether a disclosure is considered a sale or sharing under applicable privacy law depends on that processing and the law's definitions. Web advertising respects Global Privacy Control. We do not provide Google with your email address, puzzle progress, purchases, or measurement events for advertising. The mobile rewarded-hint exception sends the account and one-use attempt identifiers described in section 1 for verification and fraud prevention, not ad personalization.

5. International Transfers

We may process and store information in countries other than your own. Google Analytics, Google advertising services, and GitHub process data in the United States and elsewhere. Windows, iOS and macOS measurement is sent to the approved Azure region recorded in the release privacy review. Where required, we use appropriate safeguards (such as Standard Contractual Clauses, and the EU–US Data Privacy Framework where the recipient is certified under it) for these transfers. You can ask us for a copy of the safeguards that apply to you.

6. Data Retention

We keep your information for as long as your account is active or as needed to provide the Service:

Account and gameplay data — until you delete your account.
Data export archives — a download link expires after 24 hours; we erase the archive when the link is used, after expiry, or when the account is deleted. We retain export request, delivery, and download audit events for 90 days.
Purchase and billing records — 7 years after the transaction, because tax and accounting law requires it.
Security and server logs — 90 days, unless a specific incident requires keeping them longer.
Feedback submissions — while the report is being handled and for 24 months after it is closed, unless we need it longer to address a recurring issue or legal claim.
Measurement data — 14 months in Google Analytics, after which the user-level records are deleted and only aggregate reports remain.
Advertising and rewards — advertising data is retained by Google under the settings and periods applicable to AdSense or AdMob; Quizzja does not receive a user-level advertising profile. Browser identifiers under our control are removed when you withdraw advertising consent. Quizzja retains one-use reward attempts and granted-hint ledger entries as needed for account integrity, fraud prevention, audit, and the applicable account or legal retention period. You may also use Google's advertising privacy controls.
Windows, iOS and macOS measurement data — the retention period approved and published for the production Azure Application Insights resource, after which it is deleted or retained only as non-identifying aggregate reports.

When you delete your account we erase or irreversibly anonymize your personal data — your email address, display name and sign-in credentials — and revoke every session. The financial ledger the account references is retained for the period above, because refund and audit integrity requires it.

7. Cookies and Data Stored on Your Device

The Service stores a small amount of data on your device. Some of it is strictly necessary — keeping you signed in, remembering the settings you chose, and holding the crossword you are currently solving. The rest, such as remembering what this device has played, keeping puzzles available offline, measurement, and advertising storage, is enabled only if the applicable consent control permits it. Optional first-party storage, measurement, and Web advertising are separate choices. Android and iOS keep their applicable UMP advertising choice in app-private SDK storage.

On Web, change or withdraw those choices under You → Privacy and data → Cookie settings. On Android, change measurement under Settings → Privacy and data → Usage measurement and open Ad privacy choices when Google requires that entry point. On iOS, use You → Privacy and data → Measurement and Ad privacy choices when shown. On Windows and macOS, use You → Privacy and data → Measurement. Withdrawal disables measurement immediately and resets or removes the local analytics state the platform permits us to remove. Our Cookie Policy lists the browser items, their purposes, and who controls them.

8. Your Rights and Choices

Depending on where you live, you have the right to access your personal data, to have it corrected, to have it erased, to restrict or object to processing, and to receive it in a portable, machine-readable format.

Take a copy of your data from You → Privacy and data → Download my data. For an account with a verified email address, we assemble a JSON archive of profile, settings, puzzle completions and progress, purchases, subscriptions, entitlements, and hint history. We email a one-time download link to that address. The link expires after 24 hours, and you can request one export per 24 hours. Web, Android and Windows guests can still download data visible to their device; any guest can add and verify an email to use the server export.
Delete your account at any time from within the app (You → Privacy and data → Delete Account) or through the public /delete-account entry, which erases your personal data as described in section 6.
Withdraw consent for device storage, measurement, advertising, or notifications at any time; withdrawing does not affect processing carried out before you withdrew.
To exercise any other right, or to request records outside the self-service archive (such as server logs or provider-held records), contact us at privacy@quizzja.com. We respond within one month, as applicable law requires, and we do not charge for it.

If you believe we have handled your personal data unlawfully, you have the right to lodge a complaint with your local data protection authority. In the EEA this is the supervisory authority of your country of residence, work, or of the alleged infringement; in the UK it is the Information Commissioner's Office.

9. Children's Privacy

The Service is not directed to children under the age of 14, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us and we will delete it.

10. Security

We use reasonable technical and organizational measures to protect your information, including encryption in transit, hashing of passwords, and session cookies restricted to a single endpoint. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

11. Changes to This Policy

We may update this Policy from time to time. We will revise the "Last updated" date above and, where appropriate, notify you in the app. If a change introduces a new purpose that relies on your consent, we will ask you again rather than treat an earlier answer as covering it.

12. Contact Us

Questions about this Policy? Contact HELUSSIVE EOOD at privacy@quizzja.com or Georgi Dimitrov 16, 3458 Gorna Luka, Chiprovtsi Municipality, Montana Province, Bulgaria. Our data protection officer, where one is appointed, can be reached at the same address.