Privacy Policy

Last updated: August, 2026.

This Privacy Policy explains how Masterquiz ("we", "us", "the Site" accessible at masterquiz.dev) collects, uses, and protects your personal data, in accordance with the European Union’s General Data Protection Regulation ("GDPR").

In short:

• We collect only the information needed to create your account and save your game progress.
• We do not use analytics or advertising trackers.
• We do not sell your personal data.
• You can request deletion of your account at any time.

1. Data controller

The data controller responsible for your personal data is:

If you have any questions about our Privacy Policy, the data we hold on you, or you would like to exercise one of your data protection rights, please do not hesitate to contact us using the email listed above.

2. What data do we collect?

We collect the following data:

• Personal identification informations: first name, last name, username, email, password;
• Logic game history: played puzzles, completion times, ratings you submitted.

3. How do we collect your data?

You directly provide us with most of the data we collect. We collect data and process data when you sign up for an account or play a logic game.

4. How do we use your data?

We do not use your data for marketing, profiling, or advertising.

We process your account data (name, username, password, email) on the basis of contractual necessity (Art. 6(1)(b) GDPR), as it is required to provide the account and game features you requested. Technical security logs collected by our hosting providers (see Section 5 for the details) are processed on the basis of our legitimate interest in maintaining site security (Art. 6(1)(f) GDPR).

5. Who do we share your data with?

We do not sell or rent your personal data. Your data is processed by the following service providers, acting as data processors on our behalf:

These providers process personal data on our behalf only as necessary to provide their respective services. Where required by applicable law, processing is governed by contractual safeguards, including Data Processing Agreements (DPAs) and, where applicable, the European Commission's Standard Contractual Clauses (SCCs).

Vercel operates a global cloud infrastructure. Although this website is configured to execute application logic in the European Union (cdg1 region, in Paris), certain technical data, such as IP addresses and request metadata, may be processed by Vercel as part of operating its infrastructure. Where personal data is transferred outside the EEA, Vercel relies on appropriate safeguards, including the EU-U.S. Data Privacy Framework and/or the European Commission's Standard Contractual Clauses, as applicable.

Our hosting providers may automatically collect technical information, such as IP addresses, timestamps, browser information, and request logs, for security, debugging, and abuse prevention purposes. These logs are retained only as necessary under the providers' standard operational policies.

6. How long do we retain your data?

We retain your data for as long as your account remains active.

Unless we are required by law to retain certain information, you can, at any time, request deletion of your account and all associated personal data from within your profile page. Note that some technical backups may temporarily contain deleted data until they are automatically overwritten in accordance with our hosting provider's backup retention policies.

7. How do we keep your data safe?

We use reasonable technical and organizational measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. Passwords are hashed using industry-standard password hashing algorithms and are never stored or logged in plaintext. Data transmitted between your browser and our servers is encrypted using HTTPS/TLS.

Although we strive to protect your information, no method of transmission or storage can be guaranteed to be completely secure.

8. What are your data protection rights?

We would like to make sure you are fully aware of all of your data protection rights. Every user is entitled to the following:

• The right to access: You have the right to request us for copies of your personal data.
• The right to rectification: You have the right to request that we correct any information you believe is inaccurate. You also have the right to request us to complete the information you believe is incomplete.
• The right to erasure: You have the right to request that we erase your personal data, under certain conditions.
• The right to restrict processing: You have the right to request that we restrict the processing of your personal data, under certain conditions.
• The right to object to processing: You have the right to object to our processing of your personal data, under certain conditions.
• The right to data portability: You have the right to request that we transfer the data that we have collected to another organization, or directly to you, under certain conditions.

To exercise any of these rights, contact us at the email in Section 1. We will respond within the timeframe required by GDPR (generally one month).

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), Piazza Venezia 11, 00187 Rome, Italy - www.garanteprivacy.it - or with the supervisory authority of your own EU country of residence.

9. Cookies

Cookies are text files placed on your computer to collect standard Internet log information and visitor behavior information. When you visit our websites, we may collect information from you automatically through cookies or similar technology

For further information, visit allaboutcookies.org.

10. How do we use cookies?

We use NextAuth.js for authentication, which sets the following strictly necessary cookies. Because they are strictly necessary, no cookie consent banner is required under applicable ePrivacy/Garante guidance — but we disclose them here for transparency.

These are required for login to function and are not used for tracking, advertising, or analytics.

11. Children's privacy

This website can be used without creating an account. However, creating an account is intended only for users who are at least 16 years old.

We do not knowingly allow users under the age of 16 to register an account or provide us with personal data. If we become aware that an account has been created by a person under 16, we will take reasonable steps to delete the account and its associated personal data as soon as practicable.

If you believe that a person under the age of 16 has created an account, please contact us using the details provided in Section 1.

12. Changes to this Policy

We may update this Privacy Policy from time to time, for example if we add new features or change hosting providers. The "Last updated" date at the top reflects the most recent revision.