Privacy Policy

What we collect, why we collect it, and what you can do about it. No dark patterns, no data brokers, no selling your info.

Last updated: July 29, 2026

This Privacy Policy explains how Unfolding Software Inc., an Indiana corporation doing business as Trivia-Fun ("Trivia Fun", "we", "us") collects, uses, and shares information when you use the Trivia Fun website (trivia-fun.com), the Trivia Fun hosted application (app.trivia-fun.com), the community forum (forum.trivia-fun.com), and any related services (collectively, the "Service").

The short version. We collect the minimum we need to run the Service. Players who join a trivia game through a QR code don't create accounts and we don't track them across the web. We don't sell your data, we don't run ad networks, and we don't share data with third parties except the small set of vendors we need to operate (listed below). If you want your data deleted, email support@trivia-fun.com and we'll do it.

1. Who we are

Trivia Fun is a product of Unfolding Software Inc., an Indiana (United States) corporation operating as a small team. The data controller responsible for your personal information under this Policy is Unfolding Software Inc. (doing business as Trivia-Fun). You can contact us about privacy at support@trivia-fun.com.

2. The information we collect

If you visit the marketing site

When you visit trivia-fun.com, our hosting provider (Cloudflare) automatically logs basic technical information about your request: IP address, user-agent string, the page you requested, and a timestamp. This is standard for any website and we use it for security and abuse prevention. We do not run third-party advertising trackers.

If you contact us (or joined our waitlist)

If you submit the contact form — or joined our early-access waitlist in the past — we collect the information you chose to provide: typically your email address, optionally your name, venue name, and the message you wrote. We use this to reply to you.

If you create a venue account

To use the Trivia Fun host dashboard, you create an account for your venue. We collect:

Account info: venue name, contact email, and a password (which we store as a salted hash — we never see your actual password).
Configuration: the trivia content, branding, and settings you upload to your account.
Game activity: records of trivia games you've hosted, including question stats, leaderboards, and player names typed in by your players.
Billing info (only when paid plans are active): your subscription status, plan tier, and a customer ID from our payment processor. We do not see or store full credit card numbers — those go directly to the payment processor.

If you host or join a trivia game

Players join games by scanning a QR code and typing a name (any string they want — usually a nickname or team name). We do not require players to create accounts or accept cookies, and we don't ask guests for a date of birth. There is nothing to install — the whole game runs in a phone browser. Players who want their scores and stats tracked across game nights can optionally create a free player account; for those accounts we collect an email address, a password (stored as a salted hash), the year of your birth (see "Children's privacy" below — we ask for a full date to check you're old enough, then keep only the year), and the play history the account exists to track. If you choose to sign in with Google instead, we receive your name, email address, and a Google account identifier from Google (governed by Google's privacy policy) — we never see your Google password. If you sign in with Apple, we receive an Apple account identifier and an email address, which may be a private relay address Apple generates for you rather than your real one (governed by Apple's privacy policy); we never see your Apple password, and relay addresses work for account email exactly like any other. Players with accounts can also optionally upload a profile photo as their avatar; see the storage note under "Current subprocessors" below.

During a game we keep, on the venue's behalf, the player nicknames, their answers, and their scores. After the game ends this is part of the venue's history. Venues can delete it at any time from the host dashboard.

For technical reasons (to reconnect a player to the right room and seat if their phone sleeps or the Wi-Fi drops), the player's browser stores a small game-session identifier in localStorage on the player's own device. It identifies the player's seat in that venue's game, is only sent to our servers during play, and can be cleared at any time by clearing the browser's site data (or using the in-game "leave game" button).

Location (only if the venue turns on geofencing). Venues can optionally restrict their self-serve Open Play mode to players who are physically at the venue. If — and only if — a venue enables this, the player's browser asks permission for their location when they join, and the coordinates are used once, in memory, to check the distance to the venue. We do not store player coordinates, and we never use them for anything other than that one check. Declining location access simply means you can't join that venue's geofenced game.

If you post on the community forum

The community forum at forum.trivia-fun.com runs Discourse. Posting on the forum is governed by Discourse's standard data collection (account email, posts, replies, basic activity logs). Anything you post publicly on the forum is visible to anyone who visits the forum.

Cookies and similar technologies

We use cookies (and small amounts of localStorage) for these purposes only:

Essential: keeping you logged in to your venue or player account, and storing your light/dark theme preference.
Operational: session identifiers needed to deliver the Service.

We do not use advertising cookies, cross-site tracking cookies, or third-party analytics that build a profile of your behavior across other sites.

3. How we use information

We use the information we collect to:

Operate, maintain, and improve the Service.
Authenticate venue accounts and prevent unauthorized access.
Reply to your support requests, bug reports, and feedback.
Send you transactional emails about your account (account confirmations, billing receipts, security alerts, important changes to the Service).
Send you waitlist or product update emails if you opted into them — and only those. You can unsubscribe from these at any time using the link at the bottom of every email.
Detect and prevent fraud, spam, abuse, and security incidents.
Comply with legal obligations and enforce our Terms of Service.

We do not use your information to train machine-learning models, build advertising profiles, or share with data brokers.

4. Who we share information with

We share information only with the third-party service providers ("subprocessors") that help us operate the Service. They only receive what they need to do their job, and they're contractually required to handle that data securely.

Current subprocessors

Railway — application hosting (United States). Receives: all data needed to run the app server.
Cloudflare — DNS, CDN, and security for the marketing site, plus object storage (Cloudflare R2) for images uploaded to the app, such as player avatar photos (Global). Receives: standard request metadata (IP, user-agent, requested URL) and uploaded image files.
DigitalOcean — hosting for the community forum (United States). Receives: forum data and request metadata.
Resend — transactional and marketing email delivery (United States). Receives: recipient email addresses and the contents of the emails we send.
Sentry — error monitoring (United States). Receives: error reports and limited technical context to help us debug crashes. Before an error report leaves our servers we strip IP addresses, cookies, authorization headers, passwords, password-reset tokens, and location coordinates. What remains is the error itself plus non-identifying context such as the room code involved. Stack traces may still incidentally contain small amounts of identifying information.
Stripe — payment processing for paid plans (United States). Receives: billing email and payment method details. Stripe is a PCI-DSS certified payment processor; we never see or store full card numbers ourselves. See Stripe's privacy policy.
OpenStreetMap / Nominatim — address lookup (Europe). Used only when a venue types its street address while setting up geofencing, to convert it into map coordinates. Receives: that address. Player locations are never sent here.
Google Fonts — web fonts on this marketing site only (Global). Receives: your IP address and browser user-agent when a page here loads. The Trivia Fun app itself serves its fonts from our own servers and makes no request to Google for them.
cdnjs (Cloudflare) — hosts one small QR-code library used by the host dashboard (Global). Receives: the IP address of the host's browser.

We may add or change subprocessors as the Service evolves. When we do, we'll update this list.

Cartoon avatars — not a subprocessor

Your cartoon avatar (the one you get if you don't upload a photo) is drawn with open-source software from DiceBear. We render it on our own servers, so your device never contacts DiceBear and they never receive your IP address or anything else about you. Previously these images were requested by your browser directly from DiceBear's public API; we moved the rendering in-house in July 2026 specifically so that request would stop happening.

Other situations where we may share

Legal requests: if we receive a valid subpoena, court order, or other legal process from a governmental authority, we may be required to disclose information to comply with the law. We will only disclose what is legally required.
Safety: if we believe disclosure is necessary to investigate, prevent, or respond to suspected fraud, security incidents, or threats to anyone's physical safety.
Business transfers: if Trivia Fun is acquired, merged, or sells substantially all of its assets, your information may be transferred to the acquiring entity. We'll notify you by email or a notice in the app before that happens.

We do not sell personal information. We do not "share" personal information for cross-context behavioral advertising, as those terms are defined under California law.

5. How long we keep information

We keep information only as long as we need it for the purposes described in this Policy:

Venue accounts: until you delete your account. We may also delete accounts that have been inactive for an extended period (typically 24+ months), after attempting to notify you.
Game history: for as long as your venue account is active. You can clear game history and remove individual players' history from the host dashboard at any time.
Waitlist signups: until you unsubscribe, or until we determine your waitlist segment is no longer being marketed to.
Contact form messages: typically up to 24 months, longer if needed to resolve an ongoing issue.
Server logs: typically 30 days for security and debugging purposes, longer if part of an active investigation.
Billing records: as long as required by applicable tax and accounting laws (typically 7 years).

You can request earlier deletion by emailing support@trivia-fun.com.

6. Your rights

Depending on where you live, you may have the right to:

Access the personal information we hold about you.
Correct information that is inaccurate or incomplete.
Delete your personal information ("right to be forgotten").
Export your information in a portable format.
Object to or restrict certain processing.
Withdraw consent for processing that is based on consent (such as marketing emails — just unsubscribe).
Lodge a complaint with a data protection authority in your jurisdiction.

To exercise any of these rights, email support@trivia-fun.com from the email address associated with your account. We'll respond within 30 days. We won't charge you for exercising your rights, and we won't discriminate against you for doing so.

7. Children's privacy

Trivia Fun is a tool for adult-oriented venues like bars, breweries, and restaurants. The Service is not directed to children. You must be at least 13 years old to play, and at least 18 to create a venue account — see section 1 of our Terms of Service.

How we check. When you create a player account we ask for your date of birth. This is a neutral age screen — we ask for the date rather than asking you to confirm you're old enough. If the date shows you're under 13, we refuse the registration, create no account, and keep nothing. If you're 13 or over, we store only the year, not the full date, because the year is all we need to show the check was made. We don't ask guests who join a game without an account for a date of birth.

If you signed in with Google or Apple, we don't receive a date of birth — those providers apply their own minimum age requirements to the accounts they issue.

We do not knowingly collect personal information from children under 13. If we learn that we have, we will delete it. If you believe a child has provided us information, please contact us at support@trivia-fun.com.

Hosts are responsible for ensuring that their trivia events comply with local laws regarding minors and that any players under 18 have appropriate permission from a parent or guardian.

8. International users and data transfers

Trivia Fun is operated from the United States, and our subprocessors are primarily in the United States. If you access the Service from outside the United States, your information will be transferred to, processed, and stored in the United States. By using the Service, you understand and consent to this transfer.

If you are in the European Economic Area, the United Kingdom, or Switzerland, we rely on appropriate safeguards (such as Standard Contractual Clauses) for international transfers where required by law.

9. Security

We take reasonable technical and organizational measures to protect your information against unauthorized access, alteration, disclosure, or destruction. These include encryption in transit (HTTPS everywhere), salted password hashing, scoped access tokens, rate limiting, and regular security review of our subprocessors.

However, no system is perfectly secure. We cannot guarantee absolute security, and we do not warrant that the Service is free from vulnerabilities. If you discover a security issue, please report it responsibly to support@trivia-fun.com.

10. California residents

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the CPRA, gives you specific rights regarding your personal information. These rights include the right to know what personal information we collect about you, the right to delete your personal information, the right to correct inaccurate personal information, the right to opt out of the "sale" or "sharing" of personal information, and the right to non-discrimination. As stated above, we do not sell or share personal information for cross-context behavioral advertising.

To exercise your California rights, email support@trivia-fun.com.

11. Changes to this Policy

We may update this Privacy Policy from time to time. When we do, we'll update the "Last updated" date at the top of this page. For material changes that affect how we use your information, we'll make a reasonable effort to notify you by email or by a prominent notice in the app before the changes take effect. Your continued use of the Service after the changes take effect means you accept the updated Policy.

12. Contact us

Questions, complaints, or requests about your privacy? Email support@trivia-fun.com. We read everything and we'll get back to you.