Privacy policy
Last updated:
This policy explains what personal data Quizboard collects, why, who it is shared with, how long it is kept and how it is protected, and the rights you have over it under the Personal Data Protection Law of Saudi Arabia.
Data we collect
Quizboard has three kinds of users: coordinators, who create quizzes and run games; players, who join a game with its code; and the platform's administrators. We collect only what each of them needs.
Coordinators' accounts
- Name and mobile number. The number must be verified and is used to sign in. You can change it on your account page after confirming the new number with a WhatsApp code.
- Email address, only if you add one on your account page. It must not be used by another account. A new email counts only once you type the code we email to it; your previous email stays until then. A confirmed email can be used to sign in with your password and to get a password reset code. Your account itself stays tied to your mobile number.
- Username, only if you set one on your account page to sign in with instead of your number.
- Password, stored only as a one-way hash that nobody can read back.
- Interface language, and the dates you signed up, verified your number and changed your account.
- Sign-ins: for each one, when it started and was last used, the IP address and the browser's description (user agent).
- Source of the visit: how you first reached the site (for example a link shared on WhatsApp), saved when you create an account, start the trial or buy a plan (see Cookies).
Players
- No account or phone number is needed to play. We store the display name you type, when you joined, and your answers: the option you chose, when the server received it, how long you took, whether it was correct and its points, then your total and rank.
- Game key: a random key kept in your browser so you can return to the same game. The server stores only a hash of it.
- Who sees it: your display name, score and rank are shown to the coordinator, on the presentation screen and to the other players in the game.
- Prize coupons: if you win a coupon and choose to save it, we store the mobile number you enter with it, and only an account with that number can use it. Anyone who enters that number on the My prizes page sees the coupons saved to it, with their code, expiry and whether they were used.
Quizzes, pictures and results
- Content: the categories, questions, quizzes and settings a coordinator creates, and a fixed copy of the questions for each game played.
- Uploaded pictures: each picture is re-encoded without its hidden metadata (such as the place it was taken), checked automatically for unsuitable content, and reviewed by the administration.
- Results: each game's players, answers, scores and totals per question, which the game's coordinator sees.
- Platform ratings: if a player or coordinator chooses to rate the platform after a game, we store "All good" or the problems they ticked and the note they wrote, with the game and the player's name in it. Only the platform's administrator sees them.
Payments
- Every purchase: the plan, the amounts, any discount code, the payment method, its status and the review decision.
- Bank transfer: the transfer reference you enter and the receipt you upload (JPEG, PNG or PDF, up to 5 MB). Receipts are kept in private storage and seen only by you and the administrators who review payments; image receipts are checked automatically for unsuitable content.
- Online payment: the payment number and its status at the payment gateway. You enter your card details on the payment gateway's page; Quizboard never receives or stores your card number or security code.
Verifying your mobile number
- Through WhatsApp: the NHMSV Messaging Gateway sends an official six-digit code to your number on WhatsApp, you type it here, and we check it with the gateway. We store when the code expires and when it was verified; you are never asked to send a message from your phone. After that, coordinators receive a few account messages on WhatsApp (see "Who we share data with"); players never do.
- Manually: if needed, an administrator can verify a number by hand, and the reason is recorded.
Administrators
- Accounts like coordinators' (name, mobile number, password).
- Single sign-on: administrators can also sign in through NHMSV single sign-on. We then receive their verified email address and role, and record the email with the sign-in in the activity log.
Technical and security data
- IP address: used to limit repeated attempts (such as signing in, registering and joining games), and stored with sign-ins and in the activity log.
- Activity log: sensitive actions (signing in, registration, payments, account changes and the administration's decisions) are recorded with who did them, when, what they concerned and the IP address.
- Visit statistics: a random visitor number from a cookie, stored only as a hash, with daily page counts and the source of the visit. No IP address or browser details are stored with them. If you create an account, your visitor number is linked to it.
Why we use data
- To create and run your account, verify your mobile number and sign you in.
- To run live games: show the questions, receive answers, compute scores and rankings, and show the results.
- To process subscriptions and payments, review bank transfers, and apply discounts and prizes.
- To review uploaded pictures and receipts, prevent misuse and fraud, limit repeated attempts, and keep a record of sensitive actions.
- To produce totals for the administration: visits, sources of visits, sign-ups, trials and revenue.
We show no advertising and use no third-party analytics or tracking scripts.
Sharing data
We share data only as far as each service needs:
- WhatsApp (Meta) and the NHMSV Messaging Gateway: one-time codes are sent and checked by the NHMSV Messaging Gateway (msg.nhmsv.net), which runs on the same server as this site and delivers them over WhatsApp (Meta) under its own terms. We send it only your number, the code's purpose (creating an account, resetting your password or changing your number) and the language; it sends you the six digits and tells us whether the code you typed was right. If it cannot send the code, you see an error and a «Resend» button; you are never asked to send a message. For coordinators we also send it your number, name, language and the text of a few account messages, which it delivers on WhatsApp: a welcome after you confirm your number, a reminder the day before your trial ends, a confirmation when a plan is activated, a note when one session is left, and a reminder 3 days before a monthly or yearly plan ends. Players never receive messages.
- Emails through the NHMSV Messaging Gateway: email confirmation codes, password reset codes and the "your account email was changed" notice to your previous address (after a new one is confirmed) are sent by the NHMSV Messaging Gateway (msg.nhmsv.net, on the same server as this site) from noreply@nhmsv.net. We send it your email address, the purpose of the code and the language. It checks the codes you type and tells us the result. When WhatsApp cannot deliver one of the account messages above, it is emailed to your confirmed address instead.
- The payment gateway (Nhmsv Pay, pay.nhmsv.net): when you pay online we send it the amount, the plan, and your name and mobile number, which its page and receipt show. The gateway processes the card payment through Moyasar.
- NHMSV single sign-on: for administrators only; it tells us who signed in. Coordinators and players do not use it.
- Anthropic (Claude): when a coordinator uses «Suggest questions», we send Claude the topic, level, question type and count and any text they paste, only to draft questions. We don't send their name, phone, email or any player data, and we don't store the request text; we keep only the number, size and cost of requests. The service runs only when the platform admin turns it on.
- Hosting: the site, its database, uploaded files and backups are on a server rented from Hetzner, currently in Germany. The payment gateway, the messaging gateway, the single sign-on and the automatic picture check run on the same server.
- Official authorities: when there is a binding legal request.
We do not sell your data or use it for advertising.
Data security
- Connections to the site are encrypted (HTTPS).
- Passwords are stored as Argon2id hashes, and sign-in, password reset, player and screen keys only as hashes.
- Every page and action checks permissions on the server: a coordinator reaches only their own quizzes, games and payments, and only administrators see accounts, payments and the activity log.
- Administrators who use single sign-on need a password and an authenticator code.
- Receipts and pictures are kept in private storage outside the site's code, and the payment gateway's keys are stored encrypted.
- Repeated attempts are limited, and sensitive actions are recorded in the activity log.
- The database and uploaded files are backed up daily.
How long we keep data
- Account data is kept while the account exists. There is no button to delete an account; to delete yours, send a request to the privacy email in "Contact us about privacy" below, and the administration deletes it with everything that is yours, except payment records, which are kept as financial records without the link to your account.
- A sign-in record, with its IP address and browser, is deleted when you sign out of it, and otherwise 30 days after it expires. Changing your password signs out, and deletes, your other sign-ins.
- Of the messaging gateway's notice that a code was confirmed, the notice log keeps only its id, so that it is never processed twice. The id is deleted after 24 months.
- WhatsApp and email codes work once and only for 10 minutes, and a code may be typed five times at most. Older ones are deleted when you ask for a new one, and all of them are deleted with the account.
- Players' names and answers stay with the game's results until the coordinator deletes them or the whole game. Only the number of players and the totals per question are kept after that. They are also deleted automatically 365 days after the game ends.
- A prize coupon and the number saved with it are kept after the players' data is deleted, so the winner can still use it. The number is erased 90 days after the coupon expires.
- A platform rating stays with its game and is deleted with it or with its coordinator's account. When players' data is cleared, the rating loses the player's name and stays without it.
- A picture the administration hides is deleted with its file 90 days later, unless it is held for a decision about illegal content. Other uploaded pictures are kept.
- Payment records and transfer receipts are kept as financial records, also after the account is deleted, without the link to your account. A receipt stays as you uploaded it, with the transfer details shown on it.
- Counters of repeated attempts that use your IP address are deleted when their period ends (10 minutes to one hour).
- The activity log is kept without an automatic deletion period.
- IP addresses recorded in the activity log are erased after 12 months; the entries stay without them.
- Visit statistics (daily counts that hold no IP address) are deleted after 24 months.
- Daily backups are kept for 14 days, so deleted data can remain in them until they are replaced.
Cookies
Quizboard uses a few small cookies of its own. This section lists every one of them, what it is for and how long it is kept.
- All cookies are set by this site only; there are no third-party cookies or scripts.
- No advertising and no tracking across other sites.
- Your IP address is not stored with any of them.
- Because of this there is no cookie banner; the cookies below are all there is.
Strictly necessary
Needed for signing in, the language and the look you chose.
| Name | Purpose | Kept for |
|---|---|---|
| qz_session | Keeps you signed in. | 30 days, or until the browser closes without «Remember me» |
| qz_remember | Notes that you signed in without «Remember me». | Until the browser closes |
| qz_verify | Links this browser to the phone check while you create an account. | 1 hour |
| qz_reset | Links this browser to the WhatsApp or email code while you reset your password. | 15 minutes |
| qz_sso | Completes an administrator's single sign-on. | 10 minutes |
| NEXT_LOCALE | Remembers the language you chose. | Until the browser closes |
| theme | Remembers light or dark mode. | 1 year |
| admin-sidebar | Remembers whether the admin menu is collapsed (administrators only). | 1 year |
| dashboard-sidebar | Remembers whether the coordinator menu is collapsed (coordinators only). | 1 year |
For reports
Anonymous counts of visits and the source of the visit only (for example a link shared on WhatsApp). They grant nothing and identify no one.
| Name | Purpose | Kept for |
|---|---|---|
| qz_vid | A random number so a visitor is counted once a day in the anonymous visit statistics. | 1 year |
| nh_src | The source of the visit only: where you first came from and the latest tagged link (source, medium, campaign, landing page, date), counted when an account is created or a plan is bought. | 90 days |
Data kept in your browser
Besides cookies, the site keeps a few values in your browser's own storage. They stay on your device until you clear the site's data:
- a player's game key, to return to the same game;
- your mobile number, username or email as you typed it, only if you tick «Remember me» when signing in;
- small preferences, such as sound on or off and notices you closed.
Deleting cookies
You can delete these cookies at any time in your browser's settings (usually under Privacy or Site data), or by clearing this site's data. Deleting them signs you out and resets the language and look; the site works the same afterwards.
Your rights
Under the Personal Data Protection Law you have the right to:
- Know how your data is collected and used, which is what this page is for.
- See the data we hold about you and get a copy of it.
- Correct or update it. You can change your name and language, set a username, and add, change or remove your email on your account page; for anything else, contact us.
- Ask us to delete your data or your account, by sending a request to the privacy email below; the administration deletes your account and everything that is yours, and payment records are kept as financial records without your name or number.
- Withdraw your consent, for example by removing your email address on your account page or asking us to remove it.
Players have no account: the coordinator who ran a game can delete its players' names and answers, and players can also contact us.
To use any of these rights, contact us as described below.
We respond to rights requests within 30 days at most.
Children and minors
- Coordinators must be at least 18 years old to create an account.
- Players join a game without an account and enter only a display name.
- A coordinator who runs a game with players under 18 is responsible for getting their guardians’ consent, and should ask them to use a nickname rather than their full name.
Changes to this policy
When the way we handle data changes, we update this page and the date at its top.
The Arabic version of this policy is the reference and prevails if the two versions differ.
Contact us about privacy
Data controller: Nhmsv Digital Solutions (حلول إن إتش إم البرمجية), freelance license no. FL-944945095.
For any privacy question or request, including rights requests and account deletion, email us at: contact@nhmsv.net
You can also contact the Quizboard administration on WhatsApp: +966541333372