KnowBout privacy policy

KnowBout is a real-time trivia game (package app.knowbout). This policy explains what personal data we collect, why, and the choices you have. We keep it short because we collect little: no ads, no tracking across other apps, and we never sell or share your data with third parties for their own purposes. We use privacy-respecting analytics and crash reporting, hosted in Europe, to keep the game working well — details below.

Who we are. KnowBout Ltd (“we”, “us”), a company registered in England & Wales (company no. 17325238), is the data controller for the personal data described here. Contact us any time at admin@knowbout.app.

What we collect, and why

Data	Why we use it	Required?
Email address (from your Google sign-in on Android, or Apple sign-in on iOS — Apple may give us a private relay address if you choose “Hide My Email”)	To create and manage your account, sign you in, and contact you about your account	Required to save progress
Email address (if you join the mailing list on knowbout.app)	To send the newsletter you asked for — quiz questions, launch news and occasional offers. Consent-based; every email has an unsubscribe link, and re-joining after an unsubscribe renews your consent.	Optional
Username (a name you choose — not your legal name)	To identify you on leaderboards, in bouts and on challenge links	Required
Gameplay data (bouts, scores, XP, levels, streaks, daily results, challenges, match history, recorded “ghost” runs, content flags/reports)	To run the game, track your progress, power matchmaking and leaderboards, and keep questions fair	Required
Push notification token and your device’s timezone	To send challenge and result notifications, and to make sure reminder-style notifications arrive in your local evening and never overnight — only if you turn notifications on	Optional
Purchase & subscription state (whether you have KnowBout Plus, your trial/renewal status, and which cosmetic packs you own) — never your payment details, which stay with your app store	To unlock what you’ve paid for on any device you sign into, and to handle store refunds correctly	Required for purchases
Product analytics events (e.g. “a bout finished”, “the paywall was viewed”), linked to your account ID — not your name or email	To understand which parts of the game work and which don’t, so we can improve it. No advertising use, ever	Required (pseudonymous)
Crash & diagnostic data (what went wrong in the app, your device model and OS version), linked to your account ID	To find and fix bugs and crashes	Required (pseudonymous)
Referral relationships (who invited whom, when an invite code is used)	To credit referral rewards to the right players	Only if you use an invite code
Your choices: a 13+ confirmation, an optional marketing opt-in, and a “fan-made / not affiliated” acknowledgement	To meet legal requirements and respect your preferences (each stored as a simple yes/no with a timestamp)	13+ required; marketing optional

What we do not collect

No precise or approximate location (your timezone is a region name like “Europe/London”, used only for notification timing).
No date of birth — only a yes/no that you are 13 or over.
No payment details — your card never touches us; Google Play or the Apple App Store handles all billing.
No photos, contacts, messages, files or health data.
No advertising IDs and no advertising SDKs; our analytics do not track you across other apps or websites.
We do not store your Google or Apple display name or profile photo.

Legal bases (UK GDPR)

Performance of a contract — your account, sign-in, gameplay data, and purchase/subscription state: we need these to provide the game (and the paid features) you asked for.
Consent — marketing emails (only if you opt in; you can withdraw at any time) and push notifications (only if you enable them).
Legitimate interests — pseudonymous product analytics and crash reporting, to keep the game working and improve it. We’ve balanced this against your privacy: events are linked to a random account ID rather than your name or email, hosted in Europe, never used for advertising, and never shared for anyone else’s purposes. You can object at any time (see “Your rights”).
Legal obligation — confirming you are 13 or over.

Who we share it with

We do not sell your data or share it with third parties for their own purposes. We use a small number of service providers who process data only on our instructions to run the app:

Supabase — secure database, authentication and hosting (United Kingdom, London region).
Google — “Sign in with Google”, and (on Android) delivery of push notifications via Firebase Cloud Messaging.
Apple — “Sign in with Apple”, and (on iOS) delivery of push notifications.
Expo — the push-notification delivery service that relays your notifications (US-based).
RevenueCat — manages purchase and subscription state between the app stores and your account (US-based). They never see your payment details either.
PostHog — product analytics, hosted in the EU.
Sentry — crash and error reporting, hosted in the EU.

We may also disclose data if required by law.

International transfers

Most of your data stays in the UK and EU. Where a provider processes data in the United States (Expo, RevenueCat, and Google/Apple services), we rely on appropriate safeguards — the UK Extension to the EU–US Data Privacy Framework where the provider is certified, or the UK International Data Transfer Agreement / standard contractual clauses otherwise.

Other players and “ghost” bouts

Your username is visible to other players on leaderboards and in bouts. When no live opponent is available, KnowBout may replay a recorded “ghost” run from another player — always clearly badged as a recording. We never present a recording as a live human. If you delete your account, your ghost runs are anonymised (detached from you) so other players’ game history still works but no longer identifies you.

Security & retention

Your data is encrypted in transit (HTTPS/TLS). We keep your data for as long as your account exists, and delete it when you ask us to (see below). Guest accounts that have never played and have been inactive for around 30 days are deleted automatically. Our analytics and crash-reporting providers also apply their own limited retention windows to event data.

Your rights

Under UK GDPR you can:

Access & export your data — in the app: Profile → Account & settings → Export my data (a downloadable JSON file).
Delete your account and data — in the app: Profile → Account & settings → Delete my account, or by request. See our account deletion page.
Correct your data — e.g. change your username in the app.
Withdraw consent — turn off marketing or notifications at any time.
Object to processing based on our legitimate interests (such as analytics), and ask us to restrict processing while we consider it.
Portability — the in-app JSON export gives you your data in a machine-readable format you can take elsewhere.

To exercise any right, email admin@knowbout.app. If you’re in the UK and think we’ve mishandled your data, you can complain to the Information Commissioner’s Office (ICO).

Children

KnowBout is for users aged 13 and over. We ask you to confirm this at sign-up and do not knowingly collect data from children under 13. If you believe a child under 13 has given us data, contact admin@knowbout.app and we will delete it.

Changes to this policy

If we make material changes, we’ll update this page and the “last updated” date below, and where appropriate let you know in the app.