Privacy notice
28 October 2026 · This notice covers the quiz app and this website.
1. Controller
vilow GmbH, Sophienstraße 40, 38118 Braunschweig, Germany. Managing director: Tobias Sell. Email: mail@vilow.de; phone: +49 531 1289 3097.
2. Data in the app
Automatic player account and profile
On first launch, the app creates a Firebase account with a technical user ID without requiring an email address or password. It stores your player name, avatar, language and settings. Your name, avatar and selected game values appear to other players in leaderboards, public player profiles and games. Do not use a name or avatar that reveals private information.
Quiz, friends and submissions
We store your quiz rounds, answers, lifelines used, statistics, badges and virtual wealth. This supports playing against other players’ recorded answers, leaderboards and synchronization. Friend requests and friend lists are stored so you can play and compare results with friends. If you submit a question, we store the question, answer options and hint for editorial review.
Avatars
When you request an AI-generated avatar, your image prompt is sent to the OpenAI image API. The resulting avatar is stored in Firebase Storage and shown to other players. If automatic avatar generation is enabled, we use a standard prompt without text you entered yourself.
Push notifications
If you permit notifications, the app stores a device push token. Firebase Cloud Messaging or the Expo Push Service uses it to notify you of new friend requests. You can disable notifications in your device settings.
Optional usage analytics
If you explicitly agree in the app, we use Google Analytics for Firebase to understand app usage. We record screens opened, rounds started, question levels answered, whether an answer was correct, lifelines used and round outcomes. Technical data such as app version, device type, operating system, approximate region and a pseudonymous app instance identifier may also be processed. We do not send player names, player IDs, question text, answer content or avatar prompts as analytics events. The legal basis is your consent (Article 6(1)(a) GDPR). Collection is disabled until you consent. You can switch it off at any time in your profile; this stops further collection and resets the local analytics identifier. Your choice does not affect gameplay.
Offline storage
The app stores profile and leaderboard data and prepared quiz rounds on your device. Up to 20 rounds may be available offline. Results synchronize when the app next contacts the server. Uninstalling removes local data; server data remains until account deletion.
3. Purposes and legal bases
We process account and game data to provide the quiz, friend features, avatars and leaderboards you use (Article 6(1)(b) GDPR). We process technically necessary security and operational data to protect the service and keep it stable (Article 6(1)(f) GDPR). We process a custom avatar prompt only when you request an avatar. Push notifications require device permission, which you can withdraw.
4. Service providers and recipients
- Google Firebase: Firebase Authentication for the account, Cloud Firestore for game and profile data, Cloud Functions for game logic, Firebase Storage for avatars, Firebase Cloud Messaging for Android push notifications, and – only with consent – Google Analytics for Firebase for usage events.
- Expo: Delivery of iOS push notifications and app updates.
- OpenAI: Generation of AI avatars from a standard prompt or one you enter.
- n8n: Forwarding account deletion requests containing a player ID and contact email to our support mailbox.
Providers receive only the data needed for their respective function. Processing may take place outside the EU/EEA. See the providers’ privacy information for details. The app has no advertising SDKs or in-app purchases. All game money is virtual and cannot be redeemed for cash.
5. Retention
Game and profile data remain stored while your account exists and the data is needed for the game. Push tokens are stored for notification delivery. After a verified deletion request, we remove data attributable to the account unless a legal retention obligation applies. An editorially approved quiz question detached from your account may remain as general game content. Technical logs and backups follow the retention cycles of the relevant providers.
6. Delete your account and data
While signed in to the app, you can permanently delete your account and associated data directly through Profile → “Delete account and data”. Deletion may take several minutes. The online request form remains available after uninstalling the app.
You can request deletion even after uninstalling. The account deletion instructions explain the steps, the data involved and possible exceptions. We need your technical player ID and a contact email address. We forward the request through an n8n webhook to hello@vilow.de and use the contact address to verify your right to request deletion. A player ID alone is not proof of ownership. We remove the contact address from the request record after confirmed deletion. Alternatively, email hello@vilow.de.
7. This website
vilow GmbH uses Firebase Hosting to deliver this website. Technically necessary connection data, including your IP address, time of access and requested page, is processed. The site itself uses no analytics or advertising cookies and loads no external fonts or tracking scripts. If you email us, we process your message to handle your request.
8. Your rights
Subject to the GDPR, you have rights to access, rectification, erasure, restriction, portability and objection. Send requests to mail@vilow.de. You may also complain to a data protection authority, in particular the State Commissioner for Data Protection of Lower Saxony.