Legal
Last updated 18 August 2026.
Organization accounts: name, work email, hashed password, organization name. Event players: display name, avatar, optional team name, and answers they submit. We hash client IP with a salt for abuse investigation and do not store raw IPs on the participant record.
To run your events, keep tenants isolated, send one-time email codes for signup and password reset, and show a live leaderboard. We do not sell personal data. We do not use player answers for advertising.
Signup and forgot-password flows send a short-lived one-time code to the address you typed. The code is stored hashed, expires in minutes, and is limited in attempts. We never email the live answer key.
Signed-in hosts and admins receive an HTTP-only session cookie. Players receive a separate participant cookie after joining. Cookies are SameSite=Lax so a QR scan can complete a join.
Event data stays with your organization until you delete it or the organization is closed. Audit logs record security-relevant actions. You can ask us to export or delete an organization by contacting support.
Players may be students in a supervised classroom. Organization admins must have authority to run the event. Do not create an organization account for a child under 13.
Privacy questions: use the contact page. This policy describes the QuizBot product operated by WishOrbitworks.