Legal

Privacy

What we collect, why we collect it, and how to get rid of it.

Last updated 1 September 2026

The short version

We collect what the product needs to work and nothing else. We don't sell your data, we don't run ads, and we don't build advertising profiles.

What we collect

Depending on how you use the site, this is everything that reaches our servers.

  • Account details. Your email address (if you have one on file), and — if you sign in with X or Google — the name and profile picture that provider returns.
  • Question sets you create. Titles, descriptions, questions, options, the answers and the rules you set.
  • Attempts. The display name a participant types, the options they selected, their score, and the timestamp.
  • A participant identifier. Anyone answering without an account gets a random, signed identifier stored in a cookie so the one-attempt rule can be enforced. It's not linked to a name or an email.
  • Device and abuse-control data. We use an anonymous browser device ID, coarse device signals (such as browser family, operating system, screen-size bucket, timezone and language), and a one-way device signature to enforce free-credit and account-abuse limits.
  • Technical data. We use IP addresses for rate limiting. When a free-credit claim needs fraud review, we may retain the IP address with that claim and its risk record.

Cookies and local storage

We use cookies only for things the product can't work without, plus DataFast and Piqo visitor cookies for revenue attribution. Neither service is used for advertising.

  • A session cookie that keeps you signed in after you use a sign-in link, X or Google.
  • DataFast's visitor cookie, which lets us attribute a completed purchase to the marketing channel that brought you here.
  • Piqo's visitor and session cookies, which let us attribute a completed purchase to the visit that led to it.
  • bwd_pid — a signed, random identifier that enforces one attempt per person.
  • bwm_device — an anonymous browser ID used for device and free-credit abuse controls.
  • Browser local storage keeps your unfinished draft on your own device.

How we use it

To run the product: to show you your question sets, to score answers on our servers, to enforce the limits you set, and to email you a sign-in link when you ask for one.

We don't use your questions, answers or attempts to train machine-learning models.

Who else sees it

The people you share a link with see the questions and options — never the correct answers. Your dashboard is visible only to you.

  • Our database host, which stores accounts, question sets and attempts.
  • Our hosting provider, which serves the site.
  • Our email provider, which delivers sign-in links.
  • X or Google, only if you choose to sign in with one of them.
  • The founder, administrators, and authorized developers, only when access is necessary to operate, secure, support, investigate abuse, fix a technical problem, or comply with a legal obligation. Access is limited to the data needed for that purpose.

How long we keep it

Question sets and attempts are kept until you delete them. Deleting a set deletes the attempts recorded against it. Sign-in sessions expire on their own after thirty days.

Account-linked device and abuse records are removed when you delete your account. Anonymous device and security records may be kept for as long as reasonably needed to prevent fraud, keep the service secure, and meet legal obligations.

To delete your account and everything attached to it, use the delete-account option in account settings.

Your rights

You can update your account details or delete your account from account settings.

If you answered someone else's questions and want that attempt removed, ask its creator to remove the set.

Security

Traffic is served over HTTPS. Correct answers never leave the server, scoring happens server-side, and session cookies are signed and HTTP-only. No system is perfect, so please don't put sensitive information into a question.

Children

This site is not intended for children under 13, and we don't knowingly collect their data. If you believe a child has used the site, contact us and we'll remove the account.

Changes

If this policy changes in a way that matters, we'll update the date at the top of this page.