TriviaRoyale Play

Privacy

TriviaRoyale keeps only what the game needs, and what keeps it fair. No ads, and nothing is sold or shared for marketing.

Questions, or a request about your data: [email protected].

Your account

  • Playing as a guest makes an account with a random name, kept in a cookie in your browser. A guest who never won a round, voted or reported is deleted after 30 days.
  • Signing up keeps your username, your password (only as a hash, never the password itself), your email address if you give one, and what you put on your profile: an avatar, a few words about yourself.
  • Signing in with Discord or Reddit keeps that account's ID, so it signs you in again, and its avatar if you have none.
  • Your sessions (your account's Sessions): the browser, the IP address and the rough place of each device you're signed in on, so you can sign out the ones you don't know. They go when the session ends.
  • Push notifications, if you turn them on: the address your browser's push service gave for this device. It goes when you turn them off or sign out there.

The game

  • Rounds, points and streaks are the game's history and the leaderboards. They're kept for good, with your name on the rounds you won.
  • Your votes and reports on questions and players are kept, so bad questions get fixed and moderators can see who reported what.
  • The chat: each room shows its last 100 lines. Staff can read the chat of the last 30 days, to look into reports; older lines are deleted.

Fair play

One person with many accounts spoils the game for everyone, so TriviaRoyale remembers where accounts play from:

  • your network, as a scrambled code that can't be turned back into an address, and the last IP address;
  • the rough place (country and city) and who runs the network, looked up in a database on our own server (MaxMind's GeoLite2): your address isn't sent anywhere for it;
  • the browser's name, and a random ID in a cookie named device that lasts 2 years: accounts used in the same browser are very likely the same person.

This is kept for 90 days after an account was last seen there. Moderators see the rough place and which other accounts share a browser or a network; only staff see IP addresses. A ban can include the player's other accounts, and for a while guests on their network can only watch. Nothing is banned automatically: moderators decide.

Cookies and storage

  • sessionid: keeps you signed in, as a player or a guest.
  • csrftoken: protects forms from other sites.
  • device: for fair play, above.
  • tz: your time zone, so times show in yours.
  • In your browser only, never sent to us: the light or dark theme, and whether sound effects are on.

No advertising or tracking cookies.

Who else is involved

  • Cloudflare sits in front of the site: every request passes through it, for speed and to keep attacks away.
  • Hetzner runs the server the game and its database are on.
  • Page counts (Umami, run by us): which kinds of pages are visited and which buttons are used, never which player, room or search, and without cookies.
  • Error reports (GlitchTip, run by us): when something breaks, what was going on, which can include your account and IP address, so we can fix it.
  • Email: to verify your address or reset your password, the message goes out through an email delivery service.
  • Discord and Reddit, only if you sign in with them.
  • Push notifications go through your browser's push service (Google's, Mozilla's or Apple's).

Your choices

  • Change or remove your profile, avatar and email address in your account at any time.
  • Sign out other devices from your sessions.
  • Delete your account (“Delete my account” in your account): your name, email address, avatar, profile, sign-ins, sessions, earlier names, chat lines and where you played from are deleted. The rounds you played stay in the history, under an anonymous name, so the leaderboards of the past don't change.