Privacy policy

1. Controller

The controller responsible for processing personal data in connection with the “KickQuiz” website and app is:

Amanuel Kücükkaplan
Neuhöfer Weg 11
35415 Pohlheim
Germany
Email: support.app.kk@gmail.com

2. Data processed

When you use the website and app, the following data in particular may be processed:

• Account data (such as username and, where applicable, email address used to sign in)
• Age group and acceptance of the terms of use (see section 3c; the date of birth itself is not stored)
• Game and usage data (such as scores, quiz results, friend lists and matchmaking information)
• Technical data (such as device information, app version, error and diagnostic information)
• Push notification tokens (if enabled)
• Advertising and analytics information in connection with Google Mobile Ads and Firebase
• Support and deletion requests that you submit voluntarily

3. Purposes of processing

• Providing and operating website and app functions
• Account management, multiplayer and friend features
• Stability, security and error analysis
• Serving and measuring advertising
• Improving the app and preventing abuse

3a. Advertising, consent and analytics

The app may use Google Mobile Ads (AdMob) and Firebase services to support reach, stability and ad delivery. Where required by law, consent is requested before personalised advertising or comparable processing. Advertising availability may be limited depending on country, platform, account status or technical circumstances.

On iOS, an additional system prompt for app tracking may be required. If consent is withheld or withdrawn, the app can still be used; advertising may then be non-personalised or restricted. Where required in your region, privacy or advertising choices can be reopened through settings or consent controls provided in the app.

Advertising on the website (Google AdSense)

Google AdSense is integrated to provide advertising on the website. Google and participating advertising partners may process your IP address, browser and device details, pages visited, ad impressions and interactions. Cookies or similar identifiers may be used for ad selection, measurement and fraud prevention. The provider of Google's advertising services in the EEA is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Where consent is required, the legal basis is Article 6(1)(a) GDPR and, for storing or accessing information on your device, section 25(1) TDDDG. The consent prompt shown identifies the relevant advertising partners, purposes and storage information. Refusal does not prevent you from using quiz features. Non-personalised advertising is not necessarily free from processing that requires consent.

You can reopen advertising choices via “Privacy settings” on the game pages where the consent platform is available. Withdrawal applies prospectively and does not affect the lawfulness of processing before withdrawal. For assistance, email support.app.kk@gmail.com. See Google's Privacy Policy and its information for partner sites.

Website reach measurement (Google Analytics 4)

After consent through the Google Funding Choices prompt (TCF purposes 1 and 8), we use Google Analytics 4 with measurement ID G-DYNJ2S87VR. This may record page views and data-minimised game events such as mode selection, game start, game complete and sign-up, without names, email addresses or user IDs. Advertising consent is separate. Without this analytics consent, no Analytics cookies are set and no measurement events are stored. Withdrawal via “Privacy settings” stops measurement immediately. The legal basis is Article 6(1)(a) GDPR and section 25(1) TDDDG.

Website guests can appear on the shared leaderboard without a registered account. This uses anonymous Firebase sign-in; the display name is a random “Guest #1234” and does not contain a user ID. Inactive guest entries are removed after 90 days, and expired monthly boards after 12 months.

Website: hosting, sign-in and game features

The website, including quiz data and optimised player images, is delivered through Firebase Hosting. Google processes your IP address and technical request data in particular to deliver content and detect abuse. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is secure and reliable provision of the service.

We use Firebase Authentication for user accounts, Cloud Firestore for profile, friend, message and leaderboard data, and Cloud Functions for server-side game features. Email sign-in processes the credentials required for access. If you choose “Sign in with Google”, account data released for sign-in—particularly the Google identifier, email address and, where applicable, name and profile image—is transmitted. Google also processes the sign-in under its own privacy terms.

We process this data to provide the account and game features you select under Article 6(1)(b) GDPR. Technical measures protecting sign-in and preventing manipulated results serve our legitimate interest in protecting accounts and fair play (Article 6(1)(f) GDPR). Public profile details and leaderboard results are visible to other users; messages are stored for the relevant communication function and shown to their recipients.

Website: storage on your device

The browser stores scores, completed levels, best results, Daily Duel results, recently played pairings and selected game options in Local Storage. The website code sets no fixed expiry for these entries; they remain until overwritten or until you or your browser clears the website data. Session Storage contains technical session information and is generally cleared when the browser session ends. Firebase may use browser storage, particularly IndexedDB, for sign-in state so that you remain signed in when you return.

Where such storage is strictly necessary for a game, progress or sign-in function you expressly request, it is carried out under section 25(2) no. 2 TDDDG. Associated processing of personal data is based on Article 6(1)(b) GDPR. You can clear stored data in your browser's website settings. This may remove local progress and require you to sign in again. Clearing local data does not delete a server-side user account.

Fonts and software libraries

The Poppins font and the fallback fonts of the browser challenges are served from our own server or bundled with the app; no connection to Google Fonts takes place for them. Firebase software libraries are loaded from www.gstatic.com. Google receives technically necessary connection data, particularly the IP address and browser details. These requests support the account and game features described above. The legal basis is Article 6(1)(f) GDPR, reflecting our interest in an operational website. See Google's Privacy Policy.

Abuse protection (Firebase App Check)

To protect accounts, leaderboards and game features against automated access, bots and manipulated results, we use Firebase App Check. On the website this embeds Google reCAPTCHA Enterprise; in the app the platform device checks are used (Apple App Attest or DeviceCheck and Google Play Integrity). In particular, IP address, browser or device and app information and interaction signals are transmitted to and evaluated by Google or Apple to verify that requests come from a genuine app or website. No puzzle is shown. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is the security of the service and fair play. Where information is stored on or read from your device for this purpose, this is strictly necessary to protect the service you use (Section 25(2) no. 2 TDDDG). For reCAPTCHA, Google's Privacy Policy and Terms of Service also apply.

Friend chat, reports and moderation

Messages in the friend chat and in-game chat are stored in Cloud Firestore with sender, time and read status and are shown only to the participants of the conversation. Chat is available between friends or fellow players of a match. Messages are automatically checked for insults, links, email addresses and phone numbers and removed where necessary. Users can block others and report individual messages; a report stores the reported text, the user identifiers involved and the reason so that we can review it and restrict accounts in case of violations. Chat messages are deleted together with the account; we delete reports once they are no longer needed for the review and abuse prevention. The legal basis is Article 6(1)(b) GDPR (communication feature) and point (f) (protecting users, especially minors, and preventing abuse).

App: usage analytics and crash reports

In the app we use Firebase Analytics only if you are at least 16 and have consented in the consent prompt to storage on your device and measurement (TCF purposes 1 and 8). We record minimal events such as screen views, mode selection, game start and game end without names, chat content or advertising IDs. Withdrawing consent via the privacy options in the settings stops the measurement. The legal basis is Article 6(1)(a) GDPR and Section 25(1) TDDDG. For crash and error reports we use Firebase Crashlytics (device model, operating system, app version, error trace) based on Article 6(1)(f) GDPR to keep the app stable.

3b. Quiz, image and football data

The app contains editorially compiled football quiz questions and player, club, career, statistics, transfer, stadium and competition information. This content may be based on publicly available information, our own research, manually curated datasets, third-party APIs, publicly licensed image sources or other editorial sources. Such quiz and content data generally concerns football facts and is not intended to create profiles of app users.

Historic transfer fees are treated as editorial quiz estimates. They may be derived from publicly available information, multiple sources and our own plausibility checks and are not official or authoritative figures.

Where images or external sources are used, we seek to observe source and licence requirements. If you believe content infringes rights or lacks attribution, email support.app.kk@gmail.com or use the Support page. Further information about editorial use of football facts appears on the Data sources page.

3c. Age information and use by young people

A KickQuiz account is available from age 13. During registration, or once after signing in, we ask for your date of birth. The date of birth is processed only briefly to check your age and is not stored. We store only the age group (under or from 16), for users under 16 the point in time, rounded up to the first day of the next month, from which the group changes, and the version and time of the accepted terms of use. This information is deleted together with the account. The legal bases are Article 6(1)(b) GDPR (providing the account) and points (c) and (f) (protection of minors and evidence of the age check).

For users under 16 we do not ask for consent to personalised advertising or analytics (Article 8 GDPR): only non-personalised ads are requested, ad requests are tagged to Google as “under the age of consent”, no tracking prompt is shown on iOS, and Firebase Analytics / Google Analytics is disabled. The same applies as long as no age information has been provided for an account. Guest modes without an account remain available without an age check; the consent prompts described above apply there.

4. Legal bases

Processing is carried out under Article 6(1) GDPR, in particular for performance of a contract (point b), legitimate interests (point f) and, where required, consent (point a).

5. Recipients and third-party providers

We use service providers to operate the website and app, particularly:

• Google Firebase (including authentication, database, Cloud Functions, Crashlytics, notifications and analytics)
• Google AdSense for website advertising and Google Mobile Ads (AdMob) for app advertising
• Google CDN (www.gstatic.com) for Firebase software libraries
• Google reCAPTCHA Enterprise as well as Apple App Attest/DeviceCheck and Google Play Integrity for Firebase App Check
• Apple App Store and Google Play as distribution platforms

Google services may process data outside the EEA, particularly in the United States. For covered transfers to certified US recipients, Google describes reliance on the EU-US Data Privacy Framework and, in its data processing terms, Standard Contractual Clauses. Details of recipients, transfer mechanisms and available contractual terms are provided by Firebase Privacy and Google Privacy. You may also request information about safeguards applicable to your data through our contact address.

6. Retention

Data is retained only for as long as necessary for the purposes stated or as required by statutory retention obligations.

Account, profile, friend and game-progress data is generally stored while the service is actively used so that multiplayer, leaderboards, progress and support cases work. Push tokens may be removed or replaced when notifications are disabled, a device is no longer used or the account is deleted. Crash, diagnostic and analytics information is processed and deleted or anonymised in accordance with the relevant Firebase or platform policies when no longer needed for stability, security or abuse prevention.

Following a confirmed deletion request, we delete or anonymise personal account data unless statutory obligations, security considerations, abuse investigations or legitimate evidence requirements prevent this. Individual aggregated statistics, technical logs or legally required records may remain for a limited time if they no longer directly identify a person or are required for compelling reasons.

According to Firebase's published information, IP data associated with Hosting is retained for several months and logged IP addresses associated with Authentication for several weeks. Other authentication data remains until account deletion is initiated; Google states that subsequent removal from live and backup systems can take up to 180 days. These are service-specific statements by Google, not a general retention period for all KickQuiz data. Current information is available from Firebase Privacy.

Support correspondence is retained to process and appropriately follow up the request. Where it remains necessary to establish, exercise or defend legal claims, further retention follows the applicable limitation periods; statutory retention duties remain unaffected.

7. Your rights

In particular, you have the following rights:

• Access to your stored data
• Correction of inaccurate data
• Erasure or restriction of processing
• Objection to processing
• Data portability
• Withdrawal of consent at any time with future effect
• A complaint to a data protection supervisory authority, particularly in your place of residence, workplace or the place of an alleged infringement

Where processing is based on legitimate interests, you may object on grounds relating to your particular situation. You may object to processing for direct marketing at any time. For our registered office in Hesse, the Hessian Commissioner for Data Protection and Freedom of Information is one competent point of contact.

Providing account data is voluntary. Without data required for sign-in, account-based features are unavailable; you can continue to use guest game modes.

8. Account and data deletion

You can request deletion of your account and associated personal data by emailing support.app.kk@gmail.com.

To help us process your request promptly, include your KickQuiz UID, display name, platform used (website/iOS/Android) and a brief description where possible. General support and deletion information is also available on the Support page.

9. Contact

For privacy enquiries, email support.app.kk@gmail.com. Use this address for access, correction and deletion requests as well.

Any public support page provided in addition serves general enquiries, bug reports and information about the deletion process.

10. Changes

This privacy policy may be updated when functions or legal requirements change.