Privacy Policy

Your privacy matters. This page explains, in plain language, what QuizLemon does and doesn’t collect. Short version: you can play every quiz without an account; an account is only needed if you want to save results, follow people or take part in communities.

What we collect

Quiz counts and result distribution. When you finish a quiz we record that it was played and which result came up, so result percentages on the page are real. Your individual answers are not part of this counter.
Your answers, only when you save them. If you turn on personalisation or create an account, the answers you picked for a quiz are stored so we can compute your Lemon DNA, recommend quizzes, and show you how you compare with other players. Without that, your answers are not stored: they are used once, to work out and count your result.
Account basics, if you choose to make one. A username and a password. We do not ask for an email address, phone number, address or date of birth, and we never ask for payment details.
Standard server logs. Like most websites, our hosting provider may keep technical logs (such as IP address and browser type) for security and reliability.

What we don’t do

We don’t require an account, an email address or a phone number to use the site.
We don’t sell your data, and we don’t share it with advertising networks.
We don’t store passwords as text — only a salted scrypt hash, which cannot be turned back into your password.
We don’t ask quizzes to collect personal details: community quizzes may not request names, ages, schools, addresses or photos. The only photo anyone uploads is their own optional profile picture.
We don’t run face recognition, and we don’t identify or tag people from a profile photo.
We don’t read your private messages for advertising, and there is no admin inbox to browse them. The only thing that looks at a message before it is delivered is our own automatic safety filter — a set of word and pattern rules that runs on our server. Message text is never sent to a third-party AI or moderation service.

Your QuizLemon account

Creating an account stores: your username, your display name and avatar choice, an optional bio, your password hash, your quiz completions and Lemon DNA, your interests, follows, favourites, achievements, communities, comments and notifications. Passwords are hashed with scrypt; when you sign up we show a one-time recovery code instead of emailing a reset link — because we never have your email. If you lose both the password and the code, the account cannot be recovered (that is the trade-off for not storing your email).

Each sign-in creates a session that lasts 30 days. For your security we record the IP address and browser used for that session, so a stolen session can be recognised and revoked. Logging out or deleting your account removes them.

Profile photo

A profile picture is optional — you can stay on an emoji forever. If you upload one: your browser crops it to a square first, our server re-encodes it as a small 320×320 JPEG, and that re-encoding throws away the original file, including EXIF data such as GPS position and the date and time the photo was taken. The picture is stored in our own database and served from its own address (/photos/av-…), so treat it the way you treat your username and bio: anyone who has the link can see it. We don’t run face recognition, we don’t identify people from photos, and we don’t give the image to advertisers.

Upload only a photo you may legally use: yourself, or someone who agreed to appear, and never a photo of a child. Before saving, you tick a box confirming that — we record the date and the version of this policy you confirmed, not the photo’s metadata. Replace or remove the photo any time in Settings → Profile (picking an emoji deletes the file), and deleting your account deletes it too. If you are a person in someone else’s photo, or their parent or guardian, email [email protected] and we take it down.

Private messages

Direct messages between two accounts are visible to those two people — and, for a moment, to our own automatic safety filter: a set of word and pattern rules that runs on our server. Unlike public text (comments and community quizzes), message text is never sent to a third-party AI or moderation service. Messages are not end-to-end encrypted; they are stored so both of you can read them later on any device. There is no admin inbox and no advertising use.

You can delete any message you sent. Blocking someone hides the conversation on both sides and stops new messages. Reporting a message can hide it. If a message is blocked before delivery, we keep a safety record (date and time, IP address, browser, username and the text that was blocked) for 90 days, for the same abuse-prevention reasons as community content. When either person deletes their account, the whole conversation is deleted for both — we don’t keep one person’s copy of a private chat. Your data export contains the messages you sent.

If you mute someone, we store that choice with your account so their messages don't trigger notifications or unread badges for you. They are not told. The chat bubble setting is stored the same way. Both are deleted with your account.

When you create an account, and when you upload a profile photo, we store one small record: that you confirmed the age and rights statement, which version of these policies you were shown, and when. It sits next to your account, is never shown publicly, contains no IP address, and is deleted with your account. It exists because the law asks us to be able to show that you consented, not just to say you did.

Games, challenges and friend features

The games on /play store as little as they can, and only what the feature needs to work:

Scores and votes without an account (today's questions, Friday Night Quiz, tier lists, hot takes, Ask the community, duels): if you have no account and haven't saved your results, we tell players apart with a short code made from your IP address and browser that is scrambled with a secret that changes every day and is kept only in memory. It can't be turned back into your IP address, and it can't link your activity across days. It only stops one person from voting twice on the same day. If you have an account (or saved your results), your account is used instead.
Aggregate counters: This or That picks, tier list averages, story endings, the result map (“where people get this result”, counted per country using the country code our CDN, Cloudflare, adds to each request) and “N people are taking this right now”. These are totals only. The live counter lives in server memory for about 90 seconds and is never written to disk. No IP address is stored for any of them.
Invites: opening someone's invite link sets a qv_ref cookie for 30 days. If you then create an account, we record who invited you so they get their invite badge. Nothing else is shared with them except your username.
Squads: members of a squad can see each other's result on the squad quiz and the squad's “most …” titles, which are worked out from members' Lemon DNA. You see this before joining and can leave at any time.
“How others see me”: friends rate you with numbers only (no text). You see averages, and only after at least 3 people have answered, so no single rating can be traced back. We never show you who rated you.
Duels and party mode: the nickname you type and your score are visible to the other players. Duel links expire after 7 days; party rooms after 6 hours.
Streak freezes, profile frames, monthly Wrapped: stored with your account. Wrapped share cards contain only the numbers shown on your Wrapped page; the card is drawn from the link itself, so nobody can look up someone else's Wrapped.

All of this is included when you download your data and removed when you delete your account (anything you posted publicly, like an Ask question or a tier list, is taken down).

Cookies we set

qv_session — signs you in. Sent only to QuizLemon, unreadable by page scripts (httpOnly), expires after 30 days.
qv_u — stores just your username, so menus can show “Profile” without waiting for the server. It is not a secret and contains no session token.
qv_aid — the anonymous “this device” key used for personalisation and for saving results before you have an account. It is created only when you tap “Save my result” (or otherwise opt in), is unreadable by page scripts (httpOnly) and lasts up to 365 days. Signing up or logging in moves its history to your account and removes it. Turning personalisation off, or “Forget this device” on your Lemon DNA page, deletes it together with the quiz history stored against it.
qv_pz — remembers that you turned personalisation off, so we don’t start saving anything again. Lasts 365 days.
qv_tz — your time zone, so “today” on the Daily Lemon page (and your streak) matches your own day. Set only when you open that page; lasts 365 days.
qv_ref — set only when you open someone's invite link: the inviter's username, so they get credit if you sign up. Deleted when you create an account; otherwise it expires after 30 days.

Cookies and Google Analytics

We use Google Analytics to understand how visitors use QuizLemon: which pages are popular, how people arrive and which devices they use. Google Analytics sets cookies (such as _ga) and receives technical information like your browser, approximate location and the pages you view. We don’t send your quiz answers or any personal details to Google.

In the European Economic Area, the United Kingdom, Switzerland and Türkiye, analytics cookies stay off until you choose Accept in the cookie banner. Elsewhere, measurement is on unless you choose Decline (necessary only); declining also deletes any Google Analytics cookies already set. Your answer is kept on your device in localStorage as qv-consent: it is not a cookie and it is never sent to us. Withdrawing is as easy as agreeing — — and you can also opt out everywhere with the Google Analytics opt-out browser add-on. More detail in how Google uses data from sites that use its services.

Share buttons link to third-party sites (X, Facebook, WhatsApp, Reddit) which have their own privacy policies.

What other people can see

Your profile page (/u/yourname) and your activity are controlled by switches in Settings → Privacy: whether your profile, Lemon DNA, interests, quiz history, favourites, created quizzes, follows and achievements are visible, and whether your profile may appear in search engines. Everything defaults to the private choice where it could be sensitive. Followers and people in the same community can see your username, avatar and comments; the Lemon Twin feature only ever suggests you to others if you explicitly switch on Twin visibility.

Comments you post on a quiz, community or poll are shown to everyone along with your username and avatar, and are moderated automatically before publication. Deleting your account removes your comments.

Community quizzes (content you create)

When you publish a quiz in the community section we store the quiz text itself for 48 hours, then delete it automatically. We also keep a safety record of the action: the date and time, your IP address, your browser (user agent), the nickname you typed and the title of the quiz. Records of blocked attempts are kept too. This log is kept for 90 days and is used only to prevent abuse, investigate reports and meet legal requests. It is not used for advertising and it is never shown publicly.

Automated safety checks. Text that passes our own rules is also sent to free third-party safety services so we can catch harassment, sexual content and anything involving children in languages our rules don’t cover: Google Gemini, Cloudflare Workers AI / Llama Guard and, if configured, OpenAI Moderations. Your text is processed by these services, which may be located in the United States, on our legitimate interest in keeping the site safe. These safety services run on free plans, which means a provider may keep the text it receives and use it to improve its own models — one more reason our rules forbid personal information. Text rejected by our own rules is never sent anywhere. You can avoid all of this simply by not publishing anything.

AI quiz drafts. If you press “Generate with AI”, the one-line idea you typed is sent to our AI provider (Google Gemini, when a key is configured) and the returned draft is checked by the same safety rules before it is saved as your draft. Drafts are never published automatically, and the idea is not used to train models by us.

Creating communities. When you found a community we store its name, description and the fact that you founded it, together with the same safety record described above. Community names and descriptions go through the same automatic checks.

Getting your data out, or deleting it

Download. Settings → “Download my data” gives you a JSON file with your profile, privacy switches, completions, DNA, interests, favourites, follows, communities, drafts, comments and notifications.
Delete. Settings → “Delete account” removes your account and everything attached to it (sessions, DNA, completions, follows, drafts, comments, notifications). Quizzes you published as a creator stay live but stop being attributed to you; community quick quizzes expire on their own schedule anyway.
Turn off personalisation if you want to keep playing without any stored history. Without an account, that (or “Forget this device” on your Lemon DNA page) deletes the anonymous key and everything stored against it immediately. With an account, Settings → Personalisation stops new history from being saved, and “Turn off and delete my interest profile” also removes your interests; deleting the account removes the rest.
Ask us. For anything else — an early deletion of a safety record, or a question about what we hold — email [email protected].

How long we keep things

Community quizzes and posts: 48 hours, then automatically deleted.
Abuse/safety log (IP, browser, nickname, what was blocked): 90 days.
Login sessions: 30 days (or until you log out).
Anonymous personalisation key: up to 365 days, or until you turn personalisation off.
Account data: until you delete the account.
Profile photo: until you replace it, remove it (or pick an emoji), or delete the account.
Private messages: until you delete a message, either account is deleted, or a report leads us to hide it.
Consent record (what you agreed to and when): while the account exists.
Game scores and votes: while the account exists; without an account they are tied only to the daily scrambled code described above.
Duel links: 7 days. Party rooms: 6 hours. Live “taking this now” counter: about 90 seconds, in memory only.

Children

QuizLemon is not aimed at children. Quizzes can be played by anyone without an account, but creating an account requires ticking a box that you are 16 or older (or the age of digital consent where you live, if that is higher) and that you accept the Terms. We keep the date of that confirmation, we don’t ask for a date of birth or ID, and we can’t verify age beyond your word — which is exactly why accounts are not allowed to collect or publish personal details about anyone. Community quizzes, comments and profile photos may not involve or depict minors, and content that sexualises or endangers them is blocked, logged and reported.

Contact

Questions about this policy? Email [email protected].