Privacy Policy

Classification: active · Version: 2.1.28 · Effective: 2026-11-05
English version controls.

Summary: We use personal data to operate and secure Vuxa, provide requested features, process purchases, and improve reliability. We do not sell personal data or use user prompts to train our own or third-party general-purpose models.

1. Controller and scope

The data controller is Yücel Şanlı, operating the Vuxa service. This notice applies to the Vuxa app, website, support, and related services.

This notice supplies information required by applicable data protection regulations including GDPR, UK GDPR, and US state privacy laws.

2. Data we process

3. Purposes and legal grounds

4. Recipients and international transfers

We disclose only the data needed to providers supporting Firebase hosting, authentication and databases; AI generation by Google Cloud Vertex AI or OpenAI; Google Analytics website measurement; Google reCAPTCHA and Firebase App Check security checks; Cloudflare website delivery, cookieless visit statistics, Turnstile security checks, and the gateway for our ChatGPT plugin, including its Connect page and the connection used to host rooms from ChatGPT; GIPHY GIF search for Vuxa Live questions; Sentry diagnostics; RevenueCat subscription infrastructure; Apple and Google sign-in, stores, and notifications; and professional advisers or authorities where legally required. When you host a room from ChatGPT, the players' nicknames and scores are shown in your Vuxa window in ChatGPT, which loads them directly from Vuxa; they are not sent to OpenAI's model or put in anything ChatGPT's model reads.

Within Vuxa, only authorised personnel can access account data, and only where needed for support, security, fraud prevention, and moderation. That access is limited and logged.

Other players see what a game needs to show: your display name or guest nickname, avatar, country flag, answers where a mode reveals them, scores, and rankings. Your username is shown to your friends and to anyone who searches for it exactly. Anyone who has a Dare link can see that Dare's leaderboard, including guest nicknames and scores.

AI generation uses one provider at a time, Google Cloud Vertex AI or OpenAI. It receives only the topic text and generation settings you submit, never your profile. OpenAI processes this data in the United States, may keep it for up to 30 days for abuse monitoring before deleting it, and does not use it to train its models.

Data may be processed outside the EEA or the UK. We use applicable adequacy mechanisms and safeguards where required, such as the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses. We ensure that appropriate data protection agreements are in place with our service providers to secure these transfers. You can request a copy of the relevant safeguards at [email protected].

5. Retention and security

We retain each category only while needed for its stated purpose, account operation, security, dispute handling, or a legal retention duty. Deletion may be delayed for backups, fraud prevention, legal claims, or accounting records where law permits or requires it. When you delete an account that received the sign-up gift, we keep only a one-way, non-reversible token derived from your Google or Apple sign-in ID, for up to 24 months, solely so the same sign-in cannot claim the gift again. It is not linked to your profile, email, or activity.

Guest profiles and guest game results are kept while needed to show results and leaderboards, operate the games they belong to, and prevent abuse; party lobbies are removed after the game ends. Signing in creates a separate account: guest game history is not moved into it, except that Daily Drop answers given as a guest on the same device may be applied to that day's Daily Drop. Product-interaction data recorded on a device before sign-in is linked to the account that signs in on it, as described in section 2.

Product-interaction and reliability analytics are deleted automatically 90 days after they are recorded, and earlier when you delete your account, including the events recorded on your devices before you signed in. Today feed answer records are deleted automatically 90 days after they are recorded, and earlier when you delete your account.

A Vuxa Live question image you upload but never use is deleted 24 hours after upload. An image used in a game is deleted 30 days after the last game that used it, but is kept while a saved question set still uses it. An image that was reported is kept for at least 30 days after the report. All your Live images and saved question sets are deleted when you delete your account.

For the ChatGPT plugin, hashed ChatGPT identifiers and IP addresses are kept only in usage counters for the current day, which are deleted automatically within two days. When a quiz is refused under our content rules, we log the reason with these hashes and your Vuxa account identifier (or, for a former guest host connection, its guest host key), never the quiz text, and delete the entry automatically after 90 days; repeated refusals within a day pause quiz making for that user for 24 hours. A quiz created through the plugin, together with the hashed ChatGPT identifier and the account identifier (or former guest host key) stored with it, its per-quiz report tallies and its room records, is deleted automatically 30 days after it is made. Report records reviewed by our moderators follow the retention for reports and appeals. For rooms hosted from ChatGPT, daily game counters for guest hosts, accounts, and ChatGPT connections are deleted automatically within two days. A short record of each room (the host key or account identifier, the hashed ChatGPT identifier, the quiz, room code, player and round counts, and reports, with no player nicknames) is kept for 90 days for safety and abuse prevention, then deleted automatically. A guest host who connected before a Vuxa account was needed can still delete their hosting data with "Delete my host data" in the Vuxa window in ChatGPT while that connection lasts: this closes their open rooms, deletes their game counters, and removes their guest host key from the quizzes they made; the room records above stay for their 90 days, and the pseudonymous game counter for the ChatGPT connection is kept for up to two days so that deleting cannot be used to get around daily limits. A Vuxa account created from ChatGPT is kept and deleted like any other Vuxa account. Deleting your Vuxa account closes any open rooms you host from ChatGPT, removes your account identifier and your name from the quizzes you made there, and deletes the challenges you made, like all Dares you made; it does not shorten the 90-day room records or the two-day counters described here. The connection to ChatGPT ends when you disconnect Vuxa in ChatGPT or after 30 days without use. If we block a host for abuse, the block record is kept while it is needed to enforce it. A challenge made from ChatGPT can be played for 24 hours and is then kept and deleted like other Vuxa Dares; it stores no hashed ChatGPT identifier or IP address.

The record of how you found Vuxa is kept while your account exists and deleted with it. If the person whose link brought you deletes their account, the reference to them is removed from your record.

We use access controls, authentication, logging, encryption provided by our platforms, vendor controls, and incident procedures. No service can guarantee absolute security.

6. Your choices and rights

Depending on applicable law, you may request access, correction, deletion, portability, objection, or withdrawal of consent. You may also complain to your local data protection regulator.

Use Settings for export, consent choices, and in-app deletion, or email [email protected]. We verify identity and retain data only where a lawful exception applies. Requests are answered as soon as possible and no later than 30 days.

Guests have the same rights. Because a guest has no account or email, include the guest nickname and the party or Dare code you used when you email [email protected], so we can locate the data; clearing your browser's site data ends the guest session on that device but does not delete data already stored with us. A guest host who connected from ChatGPT before a Vuxa account was needed has no account or email we could verify a request against, so guest host data can be deleted only through ChatGPT while that connection lasts (use "Delete my host data" in the Vuxa window, or ask ChatGPT to delete your Vuxa host data); otherwise it is deleted automatically as described above. If you use Vuxa in ChatGPT with your Vuxa account, including one you created there, you can delete it with the account deletion in Vuxa's settings or by emailing [email protected].

7. Children and teenagers

Vuxa is a general-audience service for people aged 13 or older and is not directed to children under 13. Known under-13 registrations are rejected and discovered under-13 accounts are investigated and deleted unless law requires another response.

The same minimum age applies to guest play. Guest play does not collect a birth year; under our Terms of Use, playing as a guest confirms you are 13 or older. If we learn that a guest is under 13, we delete that guest's data.

Users aged 13 to 17 should use Vuxa with a parent or guardian's awareness. We minimize public profile fields and provide blocking and reporting controls. We do not knowingly sell or share minors' personal data for targeted advertising.

8. Changes and contact

Material changes will be identified by a new version and effective date and, where appropriate, an in-app notice or renewed consent.

Controller: Yücel Şanlı. Privacy contact: [email protected].