Privacy policy

Rémy Dekeister, sole trader (SIREN 130 362 072), who publishes Owluz. The publisher’s address and other details are on the Legal notice page.

Your account: your display name and tag. Your email address and password are kept by Supabase, our sign-in provider, not in our own database, and the password is never stored there in the clear. If you sign in with Google, Supabase also receives your name, profile picture and Google ID from Google, used only to sign you in. If you have not chosen a display name, we make one from the start of your email address; you can change it whenever you like. Supabase also keeps your language, and the version of the terms of use you accepted with its date. As a guest, you have an account too, just without an email address.

What you create: your quizzes, their questions, your generations and your flashcard decks. What you do in the app: your games with your answers and scores, the quizzes you favourite and the ratings you give them. Your ties to others: the authors you follow and the people you block. Your plan, and how many Luz you spend each day.

A few technical details: the app version, when you were last active and, when the app crashes, an error report that names your device model. If you accept revision reminders, we keep the hour you choose and your time zone, and your device receives a notification token, its address for receiving a reminder; it is tied to your account so the reminder knows who it is for. Declining notifications is enough for it never to exist, and deleting your account erases it.

Our server also records each exchange with the app, without your full IP address or the contents of links, to understand an outage or spot an attack. Your full IP address only appears in rare error traces, or if you send too many requests at once. All these traces erase themselves after about two weeks. From all of this, without collecting anything more, we count how many people sign up, create, play and come back. These are totals: they say nothing about you in particular.

If you report a problem in the app: your message, the screen you were on, the app version, your device and your language, with the screenshot if you leave it attached. If you report a quiz, a deck or a person: what you report, the reason you pick, the comment you add, and the fact that the report comes from you. If someone reports you, we also keep that report for moderation.

If you share your feedback: the mood you pick, the sentence you add if you write one, the screen you were on, the app version and your device (Android, iPhone or website).

Your display name and tag, your public quizzes, how many people follow you and how many you follow, and how many times your quizzes have been played: your author page is visible to everyone, even without an account. In multiplayer, the players in the game see your display name and score. Everything else, including your private quizzes and your decks, is visible only to you, unless you share a deck.

We sell no data. Nobody reads your private quizzes: they are read only by the app, to serve them to you, and by the automatic check that makes sure, when they are created, that they follow our rules. We ask for neither your real name nor your location.

The first time you open the app, we ask for your date of birth. It is used only to apply the age rules, and we never store it: in the app, it stays on your device; on the site, it is kept in a cookie in your browser, which our server reads to apply those rules.

Your account, what you create, what you do in the app, your ties to others, generation and the emails tied to your account: performing the contract between us, meaning the terms of use. Without them, we could not provide the service.

Notifications: your consent, which you withdraw whenever you like from your device settings. Ads, in the version installed from owluz.com only: your consent too, which you withdraw whenever you like from "Ad choices" in the account settings, or by writing to us.

Crash reports, the app version, our server traces and your IP address, which Supabase also reads when you sign in to slow down repeated attempts: our legitimate interest in keeping the app working and protecting accounts. The totals: our legitimate interest in understanding how the app is used, so we can improve it. Problems you report to us: our legitimate interest in fixing the app, and you choose what you send, screenshot included.

Your feedback: our legitimate interest in improving Owluz.

Content reports: a legal obligation, which requires us to remove illegal content once it is reported to us. Reports about a person: our legitimate interest in protecting other users.

The app published on Google Play shows no ads. The one installed from owluz.com (no longer offered) does, served by Google AdMob, and only after asking for your consent where the law requires it, which is the case in France. If you decline, the ad module does not start and no ad is requested. Paid plans show none. For anyone under 15, ads are flagged to Google as aimed at a minor.

When you generate a quiz from text, a photo of your course notes or a document, that content is sent to Google (Gemini) to write the questions. Gemini also reads a quiz’s content at four other moments, never your account: to turn it into flashcards, to improve it when you ask, to file it under a category, and to check it follows our rules.

We use the paid Gemini service: Google does not use this content to train its models, and keeps it only for the time it needs to detect abuse. The questions written this way are labelled "AI-generated", in the app and on the site.

Do not send a document holding sensitive information or someone else’s personal data to be generated: it leaves our server.

The site only sets the cookies it needs to work: your sign-in session, your date of birth to apply the age rules, and a few navigation choices, such as a sign-up in progress or a message already read. No audience measurement or advertising cookies, which is why the site does not ask for your consent.

Supabase, for sign-in and accounts, on servers located in the European Union. Hetzner, in Germany, to host our server, our database and its backups. Resend, from Ireland, to send the emails tied to your account (codes, confirmation and restore links).

Google: sign-in with Google if you choose it, Gemini for the uses described above, Firebase Cloud Messaging to deliver notifications, and Gmail, where the messages you write to our contact address arrive. Cloudflare, which receives those messages and forwards them to that inbox. Expo, which passes notifications on to Firebase. And, in the version installed from owluz.com only, Google AdMob for ads.

Apart from AdMob, none of them receives your data for its own purposes.

Google, Supabase, Cloudflare, Expo and Resend are American companies. What you send to be generated, your account, the token and text of notifications, your email address and the messages you write to us may therefore be processed in the United States or be accessible from there, even when their servers are in Europe.

These transfers rely on the EU-US Data Privacy Framework for the companies that have joined it, and otherwise on the European Commission’s standard contractual clauses. You can ask us for the details of these safeguards.

Your account and what you create stay for as long as the account exists. The topic you type and the names of your files stay in your generation history. The text you paste, the photo or the document themselves are erased as soon as your quiz is ready; if generation fails, they are kept for 30 days so you can retry it, then erased. Crash reports are erased after 30 days, server traces after about two weeks.

When you report a problem in the app, the screenshot is erased after 90 days and the message after a year. Reports about a quiz, a deck or a person are kept for moderation; deleting your account erases the ones you made and the ones about you.

Your feedback is deleted after a year, or with your account.

From inside the app, in your profile, or by writing to us at the address at the bottom of this page. You then have 30 days to change your mind: we email you a restore link, and while that window runs your account waits for you intact. After the 30 days the erasure is final. Only our backups still hold a copy, for three months at most, until they expire: they are used only to recover from a failure, never to look at your data.

One exception, and it is deliberate: a quiz you made public stays online, detached from your account and your display name. Other people have played it, favourited it or turned it into flashcards, and removing it would erase their work along with yours. Your private quizzes leave with your account.

You can ask to see your data, to correct it, to delete it or to receive a copy, and object to a processing. Write to us at the address at the bottom of this page. Without closing your account, you can erase a deck, a card or a favourite yourself from the app. A quiz you delete disappears at once from the app and from what others see, but it stays in our database until your account is deleted; write to us if you want it erased sooner. For the rest, your game history for example, write to us and we will erase it.

If you believe we are not respecting your rights, you can complain to the CNIL, the French data protection authority (cnil.fr).

Owluz is for people aged 13 and over. A younger child may play with a parent, from that parent’s access, who stays responsible. Between 13 and 14, you play as a guest, without an email address: creating an account is for people aged 15 and over. If you are the parent of a child who created an account and you want it deleted, write to us and we will do it.