Privacy Policy
1. Introduction
This Privacy Policy explains what information Individual Auto Design LLC d/b/a Spontyx (“Spontyx,” “we,” “us”) collects when you use spontyx.com and the Spontyx game (the “Service”), how we use and share it, how long we keep it, and the choices and rights you have. It forms part of our Terms of Service.
The short version: we collect what we need to run a trivia game and your account, we do not sell your information, we do not show advertising, we do not use third-party analytics or tracking, and you can delete your account yourself from your profile.
2. Who Is Responsible
The data controller for the Service is:
14261 SW 120th St, Ste 108-528
Miami, FL 33186, United States
play@spontyx.com
For privacy questions or to exercise your rights, email play@spontyx.com with the subject “Privacy”.
3. Information We Collect
3.1 Information you give us
| What | When |
|---|---|
| Email address, password (stored only as a one-way hash by our authentication provider) | Creating an account with email |
| Name, email address, provider account identifier and profile picture URL from Google or Apple | Signing in with Google or Apple. Apple may give us a relay address instead of your real one if you choose “Hide My Email”. |
| Display name, handle (@username), avatar (a photo you upload or a colour style you pick) | Setting up or editing your profile |
| Quizzes and questions you write, topics and settings you enter to generate AI quizzes, lobby names | Creating content |
| Support messages, question reports, and any screenshot you attach, plus the page you were on and your browser and device type | Contacting support or reporting a question |
| Notification and newsletter preferences | Changing settings |
| Email address you enter on the waitlist | Joining the waitlist |
3.2 Information created when you play
| What | Why it exists |
|---|---|
| Every game you play: mode, questions served, answers chosen, whether they were correct, response times, scores, streaks, outcomes, opponents | Scoring, results screens, history, leaderboards, fair play |
| Coins, XP, level, ranks, ratings, missions, chests, frames, trophies, AI credits, and a ledger of every change to them | Progression, and the ability to audit and correct it |
| Daily and weekly activity, best scores, personal bests | Daily Challenge, missions, leaderboards |
| Notifications we sent you and whether you read them | Your inbox in the app |
| Emails we sent you (recipient, subject, content, delivery status) | Support and deliverability — so we can see what you were sent |
3.3 Billing information
If you subscribe, Stripe collects your card details and billing address directly. We receive and keep: a Stripe customer identifier, your plan, subscription status and renewal date, and a record of each payment (amount, currency, date, Stripe identifiers). We never see or store your full card number.
3.4 Technical information
| What | Detail |
|---|---|
| IP address | Seen by our hosting and database providers in request logs. For rate limiting we store only a truncated one-way hash of it, which cannot be turned back into the address. |
| Browser and device information (user agent, screen size, platform) | Recorded with error reports and support tickets so we can reproduce problems, and with push subscriptions so we can remove dead devices |
| Push notification subscription (an endpoint URL and encryption keys issued by your browser) | Only if you turn on push notifications. Lets us send notifications to that device. |
| Error reports (what went wrong, on which page, your account id if signed in) | Fixing bugs |
| Page views (page path, the site that referred you on your first page of a visit, screen width, country, campaign tags in the link you followed, your account id if signed in, and a visitor identifier that is a one-way hash of your IP address and browser which changes every day) | Our own count of how many people visit and from where. Recorded by our own server; no third-party analytics service is involved, and the IP address itself is not stored. |
| Cookies and local storage | Keeping you signed in and remembering settings — see the Cookie Policy |
3.5 What we do not collect
We do not collect your precise location, contacts, photos other than an avatar you choose to upload, government identifiers, or payment card numbers. We do not run advertising or third-party analytics scripts, and we do not build profiles of you for advertising. Our only traffic measurement is the first-party page-view count described above.
4. How We Use Information
- To run the game — create and secure your account, serve questions, score games, match you with opponents, show leaderboards, award and cap coins and XP, run missions.
- To bill you — process subscriptions through Stripe, send receipts and renewal reminders, handle failed payments.
- To communicate — sign-in codes, confirmations, password changes, account deletion notices, support replies, and (if you have not opted out) newsletters.
- To keep the game fair and secure — detect bots, multiple accounts, collusion and exploits; rate-limit abuse; investigate reports; enforce the Terms.
- To generate content you ask for — send the topic and settings you enter to an AI provider to produce a quiz (Section 6).
- To fix and improve the Service — diagnose errors, count visits and see which pages and modes are used, balance rewards. We use aggregate counts for this, not advertising profiles.
- To meet legal obligations — tax and accounting records, responding to lawful requests, protecting our rights.
5. Legal Bases (EU / UK)
Where the GDPR or UK GDPR applies, we rely on:
- Performance of a contract — everything needed to provide the account, the game and the plan you chose.
- Legitimate interests — security and anti-abuse, error diagnosis, service improvement, and service communications about your account. We have balanced these against your rights.
- Consent — newsletters, push notifications, and an uploaded avatar photo. You can withdraw consent at any time in settings.
- Legal obligation — keeping billing records.
6. Service Providers We Share Data With
We share information only with the providers below, only to the extent needed for the purpose stated, under contracts that restrict their use of it. We do not sell personal information and we do not share it for advertising.
Supabase (database, authentication, file storage)
Stores all account, gameplay, content, billing-record and log data. Hosted on Amazon Web Services in London, United Kingdom (eu-west-2). Handles password hashing, sign-in codes and provider sign-in.
Vercel (hosting and delivery)
Runs the website and application and keeps short-lived request logs (including IP address and user agent). Servers in the United States and edge locations worldwide.
Stripe (payments)
Collects and stores card and billing details, processes charges, and tells us the outcome. Stripe is an independent controller for the payment data it collects; see Stripe’s privacy policy.
Resend (email delivery)
Delivers every email we send you, from play@spontyx.com. Receives your email address and the message content.
OpenAI (AI quiz generation)
When you generate a quiz in AI Arena, the topic, difficulty and settings you enter are sent to OpenAI’s API to produce the questions. We do not send your name, email, account id or gameplay history. OpenAI does not use API data to train its models under its API terms.
Google and Apple (sign-in)
If you sign in with them, they tell us your name, email and account identifier and learn that you signed in to Spontyx. Their own privacy policies govern what they do with that.
Push notification services (Apple, Google, Mozilla)
If you enable push notifications, the notification is routed through the push service of your browser or device. They see the encrypted payload and the device endpoint, not your account details.
We may also disclose information if required by law, to enforce our Terms, to protect the rights, safety or property of Spontyx, our players or others, or as part of a merger, acquisition or sale of assets (in which case this policy continues to apply to your data until you are told otherwise).
7. What Other Players Can See
Your display name, handle, avatar, rank, ratings and results are visible to other players: on leaderboards, in duels and lobbies, on Custom Quiz leaderboards, and on any quiz you publish. Your email address is never shown to other players. Choose a display name and avatar you are comfortable with being public.
8. How Long We Keep Information
| Information | Kept for |
|---|---|
| Account, profile, gameplay, content, progression | While your account exists, plus the 14-day deletion grace period. Then erased. |
| Uploaded avatar and support screenshots | Erased with the account. |
| Quizzes and questions you created that were added to the shared question bank or played by others | May be kept without any link to you. |
| Billing and payment records | Up to 7 years after the transaction, as required by tax and accounting law. Kept by Stripe and in our purchase records. |
| Emails we sent you (recipient, subject, content) | Up to 12 months, for support and deliverability. |
| Error reports and hosting logs | Up to 90 days. |
| Page-view records | Up to 12 months, in aggregate form after that. |
| Rate-limit hashes | Hours; pruned automatically. |
| Record that an account was deleted (account id, the email at the time, dates) | Kept as proof that the deletion was carried out and to prevent abuse. |
| Newsletter opt-out | Kept so we do not email you again. |
| Backups | Deleted data may persist in encrypted backups for up to 30 days before it is overwritten. |
9. Security
All traffic to the Service is encrypted with TLS. Data is encrypted at rest by our database provider. Passwords are stored only as salted hashes. Access to production data is limited to the people who operate the Service, through role-based access controls, and every table is protected by row-level security so that one player cannot read another’s private data. Payment card data never touches our systems. No system is perfectly secure; if we learn of a breach affecting your information, we will notify you and any regulator as the law requires.
10. Children
The Service is not directed at children under 13, and we do not knowingly collect personal information from them. If you are a parent or guardian and believe your child under 13 has an account, email play@spontyx.com and we will delete it. Players aged 13–17 need a parent’s permission and may not make purchases themselves.
11. Your Choices
- Profile — change your name, handle, avatar and password in your profile settings.
- Newsletters — opt out in Profile → Settings, or with the unsubscribe link in any newsletter. Service emails about your account continue while the account exists.
- Push notifications — turn them on or off in the app or in your browser or device settings.
- In-app notifications — mute categories in notification settings.
- Delete your account — Profile → Settings → Delete your account. Erased 14 days later; cancel any time before that by signing in.
- Cookies — see the Cookie Policy. We use only the cookies needed to keep you signed in.
12. Your Rights
Depending on where you live you may have the right to access the personal information we hold about you, receive a copy in a portable format, have it corrected or deleted, restrict or object to certain processing, withdraw consent, and complain to a supervisory authority. To exercise any of these, email play@spontyx.com from the address on your account. We will verify the request, respond within 30 days (or as the law requires), and will not treat you differently for exercising your rights.
12.1 California and other US states
Residents of California and other states with privacy laws have the rights above, including the right to know the categories of personal information we collect and the purposes, the right to delete, the right to correct, and the right to opt out of the sale or sharing of personal information. We do not sell personal information and we do not share it for cross-context behavioural advertising, and we have not done so in the preceding 12 months. We do not use or disclose sensitive personal information for purposes that require a right to limit. Categories we collect are listed in Section 3; recipients in Section 6. An authorised agent may make a request on your behalf with your written permission.
12.2 EU, EEA, UK and Switzerland
You have the rights under the GDPR and UK GDPR described above, and the right to lodge a complaint with your local data protection authority (in the UK, the Information Commissioner’s Office). Our legal bases are in Section 5. We have not appointed a representative in the EU or UK; you can reach us at play@spontyx.com.
13. International Transfers
We are a United States company. Your data is stored with Supabase in the United Kingdom and processed by providers in the United States and elsewhere (Section 6). Where we transfer personal data from the EEA, UK or Switzerland to a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses and the UK Addendum, as incorporated in our providers’ data processing agreements, and on the EU–US Data Privacy Framework where a provider is certified.
14. Do Not Track and Global Privacy Control
We do not track you across other websites, so there is nothing for a “Do Not Track” or Global Privacy Control signal to switch off. We treat such a signal as an opt-out of sale or sharing, which we do not do in any case.
15. Changes to This Policy
We may update this policy as the Service changes. For material changes we will email you or show a notice in the app before they take effect. The date at the top tells you when it was last changed.
16. Contact
Individual Auto Design LLC d/b/a Spontyx
14261 SW 120th St, Ste 108-528, Miami, FL 33186, United States
play@spontyx.com