Privacy Policy
Last updated: October 3, 2026
Nanizo (nanizo.com) is a free quiz site. You can play without signing up. This policy explains what we collect, why, how long we keep it and what you can do about it. We wrote it in plain English; if anything is unclear, write to us.
Who we are. Nanizo (“we”, “us”) is an independent, early-stage project developed online; its features and content may change. We are the controller of the personal data described here. For questions about the site, privacy and how your data is handled, write to us.
The short version
- You can play every quiz without an account. We never ask for your name, email or phone to play.
- We use a random ID in a cookie to count visits, keep tournaments fair and remember where you stopped. In the EEA we set it only when you agree, join a tournament or make or play a friend’s challenge; in the UK and Switzerland you can turn it off at any time.
- We do not sell your data. We do not show ads yet. When we add ads, we will update this policy first.
- You can see and delete your data on the Your data page: nanizo.com/en/privacy/.
What we collect and why
| data | when | why | legal basis (EEA/UK) |
|---|---|---|---|
| Technical data: country and region (derived from your IP address), network, device type, browser, language | every request | show the right language and quizzes, keep the site secure and fast, count visits by country | legitimate interests (running a secure service) |
| Technical logs: the request as it reached our servers, including your IP address, approximate location and browser details | every request | find and fix errors, protect the site from abuse | legitimate interests (security and reliability); kept for up to 7 days |
Player ID: a random ID in the nz_aid cookie |
first visit (EEA: only after you agree, or when you join a tournament or a friend’s challenge) | count unique players and returns, measure which quizzes work, keep one ranked try per day in tournaments, tell a challenge’s maker from the friends who play it | EEA: consent (analytics) or contract (tournaments, challenges); UK: statistics exception with opt-out |
| Play events: pages viewed, quizzes started and finished, answers, shares | while you play | improve quizzes (too hard? confusing?), understand which topics people like | as for the Player ID; without it (EEA, no consent) we record events without any ID |
How you found us: channel, campaign, referring site (cookie ft); for a visit from an ad, the ad network’s IDs for the campaign, ad and placement and its click ID |
first visit | understand which sharing and marketing channels work | consent (EEA, UK); opt-out (Switzerland and elsewhere) |
| Tournament data: your nickname, the country flag you choose, scores and answer times | when you join a tournament | run leaderboards and fair-play checks | contract (you asked to play) |
| Challenges: the answers of the run you challenge friends with, the name you give the challenge (shown only on its own page), and the results of friends who play it | when you make or play a challenge | show who won and the challenge’s own small leaderboard | contract (you asked to play) |
| Fair-play signals: a one-way hash of your network, browser and language | when you join a tournament | limit ranked tries per device, stop bots | legitimate interests (fair competition) |
| Messages to us | when you email us | answer you | legitimate interests |
| Account data: your email address and an age band (13–15, 16–17 or 18+) worked out from the month and year of birth you enter — we do not keep the month and year | only if you create an account | sign you in with a code sent by email, keep your nickname and results across devices, check the minimum age | contract |
We do not collect precise location, contacts, photos or payment details. We do not knowingly collect personal data from children under 13 (see “Children”).
Analytics we use
- Our own analytics. Events go to our own storage (Cloudflare R2). We analyze them in aggregate.
- Cloudflare Web Analytics counts page views and page speed without cookies. In the EEA it runs only with your consent.
- Google Analytics 4. Our server sends a subset of events to Google Analytics; your browser never loads Google’s scripts. We send a one-way hash of the Player ID, never the ID itself, and never your IP address. In the EEA and the UK we send nothing unless you agree; in Switzerland you can opt out. When you delete your data, we ask Google to delete it too.
Who processes data for us
| provider | what for | where |
|---|---|---|
| Cloudflare, Inc. | hosting, content delivery, storage, security checks (Turnstile), email for sign-in codes, web analytics | global network; see Cloudflare’s data processing terms |
| Neon (Databricks, Inc.) | database (players, tournament results, accounts) | Frankfurt, Germany (AWS) |
| Google LLC | Google Analytics 4 (as described above) | USA |
| The ad network your visit came from (Google Ads, Meta, TikTok, or a native ad network) | only if you arrived through its ad and allowed ads where we ask: we tell it that its click led to a finished quiz — the click ID it gave the link, the time, your browser’s user agent and a one-way hash of your Player ID; never your IP address, and never from quizzes made for children | the network’s own locations |
We share data with authorities only when the law requires it. If Nanizo is sold or merged, data moves with it under this policy.
International transfers. Some providers process data outside your country, including in the USA. We rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission’s standard contractual clauses (and their UK and Swiss equivalents).
How long we keep data
| data | how long |
|---|---|
| Technical logs (with IP address) | up to 7 days, then deleted automatically |
| A visit from an ad (the network’s click ID and your browser’s user agent, to report the conversion) | 90 days |
| Play events | identifiers (Player ID, session, first visit) are removed after 25 months; the remaining anonymous statistics are kept. Play events never contain your IP address |
| Cookies | Player ID and “how you found us”: up to 400 days; session: 30 minutes; “continue” and “recently played”: 30 and 90 days; your consent choice: 12 months (“yes”) or 6 months (“no”) |
| Tournament runs | the detailed run (each answer and its time) is deleted 48 hours after the daily tournament ends; your score stays in the leaderboard history |
| Challenges | 180 days, then deleted together with friends’ results on them; the “a friend played your challenge” note: 30 days |
| Account | until you delete it; sign-in codes expire after 10 minutes |
| Deletion requests | handled within 30 days; backups roll over within 7 days after that |
Your choices and rights
- Privacy choices: change your analytics choice at any time via “Privacy choices” at the bottom of every page.
- Your data page (nanizo.com/en/privacy/): see what we hold for your Player ID and delete it with one tap.
- Depending on where you live, you also have the right to access, correct, delete or export your data, to object to processing based on legitimate interests, and to withdraw consent. Write to us; we answer within 30 days.
- Complaints: you can complain to your data protection authority — in the UK, the Information Commissioner’s Office (ico.org.uk); in the EEA, the authority in your country; in Switzerland, the FDPIC.
- US residents: we do not sell or share personal information for cross-context behavioral advertising. We honor Global Privacy Control signals as an opt-out of any such sharing if we start it later.
Children
Nanizo is for a general audience aged 13 and over. We do not create accounts for children under 13 (or under the age set by law in your EU country, up to 16); younger players can still play as guests, without an account. Public leaderboards show only names from our ready-made list, never a name someone typed. Public leaderboards are not indexed by search engines. If you think a child under 13 has given us personal data, write to us and we will delete it.
Security
We use HTTPS everywhere, keep data in providers with strong security programs, give staff the least access needed and protect admin tools with sign-in and access controls. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.
Changes
We will post any change here and update the date at the top. If a change is significant (for example, when we add ads), we will also tell you on the site before it takes effect.
Contact
For questions about the site, privacy and how your data is handled, write to us.