Privacy Policy
This explains what TriviaBot collects, why, and what you can do about it. It covers two very different groups: the venue operators who subscribe, and the guests who play along on their phones. The short version for guests is that we ask for a display name and nothing else.
1. Who is responsible
TriviaBot.tv, 14712 NE 91st Street STE 400, Redmond, WA 98052, United States, is the data controller for the personal data described here.
We have not appointed a representative in the UK or EU under Article 27 of the UK and EU GDPR. If you are in the UK or EU and want to exercise a right or raise a concern, contact us directly at support@triviabot.tv.
2. Venue operators
If you subscribe to TriviaBot, we hold:
| What | Why |
|---|---|
| Your email address | It is your account identity and how you sign in — we email you a link rather than storing a password. Also used for service notices. |
| Sign-in tokens | Single-use, short-lived, stored hashed so a database copy cannot be used to sign in as you. |
| Session cookie | Keeps you signed in to the portal. |
| Your venue details | Venue name, URL name, timezone, opening hours, and your gameplay and theme settings — this is the product working. |
| Content you upload | Logos, promotional slides, sleep-screen artwork, house questions. |
| A Stripe customer ID and your subscription status | To bill you and to know whether your screens should be playing. We never see or store your card number — Stripe handles it. |
We do not require a phone number, a postal address, or the name of a person. If you type personal details into a free-text field such as a venue name or a promo slide, we hold whatever you typed.
3. Guests who play
Guests are anonymous. There is no signup, no app, no email address, and no account.
| What | Why |
|---|---|
| A display name you choose | So the screen can show who is answering and who is winning. Choose a nickname if you would rather not use your real name. |
| Your answers and score for the session | To run the game and rank the leaderboard. |
| A random token in your phone's local storage | So you keep your place if the page reloads. It identifies a game session, not a person. |
We do not ask for or store guests' email addresses, phone numbers, contacts, location, or device identifiers, and we do not track guests across venues or across the web.
4. Paired screens
Each screen you pair holds a device token, and we record the screen's name and its most recent IP address. The IP address is used for one purpose: to detect a device token being used from two places at once, which usually means it has been copied. When that happens we disable the screen so it can be recovered rather than stolen. During pairing we also briefly hold the pairing device's name and IP address.
5. Website visitors
Our marketing site has no analytics, no advertising pixels and no tracking cookies. Our hosting provider keeps standard server logs, which include IP addresses, for security and troubleshooting.
Typefaces are served from our own servers, not from a font CDN. Loading a page on this site does not cause your browser to contact Google, or any other third party, at all.
6. Why we are allowed to do this
For anyone in the UK or EU, our legal bases under the UK GDPR and EU GDPR are:
- Performance of a contract — account, venue settings, subscription and billing data for operators. Without it we cannot provide the service.
- Legitimate interests — running the game for guests, keeping the service secure, detecting copied device tokens, and preventing abuse of free demos. We have considered the impact and kept the data to a minimum: for guests it is a chosen display name and a score.
- Legal obligation — keeping billing records for the period tax law requires.
- Consent — where we ever ask for it. We do not currently run any marketing, advertising or analytics that would need it.
7. Cookies and local storage
We use no advertising or analytics cookies. What we do use:
| Item | Where | Purpose |
|---|---|---|
| Session cookie | Operator's browser | Strictly necessary — keeps you signed in to the portal. |
| Display token | Paired screen | Strictly necessary — identifies the screen to its venue. |
| Player token | Guest's phone | Strictly necessary — keeps a guest's place in the current game. |
All three are essential to deliver a service you have asked for, so no cookie banner is shown. Clearing your browser storage signs you out or ends the game session.
8. Who else sees the data
We do not sell data. We share only with providers who help us run the service:
| Provider | What they receive | Why |
|---|---|---|
| Stripe | Your email and payment details, which you enter on Stripe's own checkout | Payments and subscriptions |
| Resend | Your email address and the message | Sending sign-in links and service email |
| Hostinger | Everything, as our hosting provider, plus server logs | Running the servers and database |
That is the whole list. In particular there is no font CDN, no analytics provider, no advertising network and no content delivery network in front of our pages — we host our own typefaces precisely so that loading a page does not disclose your IP address to anyone but us and our host.
We may also disclose data where the law requires it, or to establish or defend legal claims. If the business is ever sold, data would transfer with it and we would tell you first.
9. International transfers
Our servers are in the United States (Boston, Massachusetts), and our payment and email providers are US companies. If you are in the UK or EU, this means your data is transferred outside your country as a normal part of using the service. Where that happens we rely on the UK and EU Standard Contractual Clauses (and the UK Addendum) in our agreements with those providers, or on an adequacy decision where one applies.
10. How long we keep it
- Sign-in links — minutes. They are single-use and expire quickly, and expired ones are swept from the database.
- Guest display names and scores — for the session. A guest who goes idle is removed from the game and their row is deleted, freeing the name for someone else.
- Account, venue and content data — while you are a customer, and for a short period afterwards so an account can be revived if closure was a mistake.
- Billing records — for as long as tax and accounting law requires, typically six to seven years.
- Screen IP addresses — only the most recent one per screen is kept, and it is overwritten each time the screen checks in.
11. Your rights
If you are in the UK or EU you have the right to:
- ask what we hold about you and get a copy;
- have inaccurate data corrected;
- have data erased, where we have no overriding reason to keep it;
- restrict or object to processing we do on the basis of legitimate interests;
- receive data you gave us in a portable format;
- withdraw consent, where we relied on it.
Email support@triviabot.tv and we will respond within one month. There is no charge.
If you are unhappy with how we handle it, you can complain to your data protection authority — in the UK, the Information Commissioner's Office (ico.org.uk); in the EU, your national supervisory authority.
A note for guests: because we hold nothing that identifies you beyond a display name you chose, we usually cannot connect a request to a specific record. Closing the player page or letting the session lapse removes it anyway.
12. California residents
We do not sell or share personal information as those terms are used in the CCPA/CPRA, and we have not done so in the past twelve months. California residents may request access to or deletion of personal information, and will not be discriminated against for asking. Use the same address: support@triviabot.tv.
13. Children
TriviaBot is sold to businesses and is not directed at children. We do not knowingly collect personal data from children. Because guests play anonymously with only a display name, we do not know the age of anyone playing. If you believe a child has provided us with personal data, contact us and we will remove it.
14. Security
Traffic is encrypted in transit with TLS. Sign-in tokens are stored hashed. Access to production systems is limited to those who need it. Each venue's data is separated so one venue's screens and players cannot see another's. No system is perfectly secure, and we will tell affected users and the relevant authority without undue delay if a breach occurs that requires it.
15. Changes
We will update this page when our practices change, and the date at the top always shows the current version. If a change is significant, we will email account holders.
16. Contact
TriviaBot.tv
14712 NE 91st Street STE 400, Redmond, WA 98052, United States
support@triviabot.tv
TriviaBot.tv is a sole proprietorship owned and operated by Aaron Roberts. Contracts made under this name are made with him.