Privacy Policy

Effective date: March 3, 2026

This Privacy Policy explains how Trivlet ("the Service"), operated by Cisco ("we," "us," or "our"), collects, uses, and protects your information when you use trivlet.com.

1. Information We Collect

Information you provide

• Account data: Display name, passkey credential (public key only — we never see your biometrics or device PIN).
• User content: Trivia fact submissions (text, source URL, category).
• Payment data: Processed entirely by Stripe. We receive a transaction ID and purchase status — we never see or store your card number, CVV, or billing address.

Information collected automatically

• Gameplay data: Game scores, answer times, badges earned, play streaks, credit balance, XP and rank.
• Device info: IP address (for rate limiting and anti-abuse), browser user-agent string.
• Push subscriptions: Web Push endpoint and keys if you opt in to notifications.

Information we do NOT collect

• Email address (unless you contact us directly)
• Real name, phone number, or physical address
• Location data (beyond IP-derived country for rate limiting)
• Biometric data (passkeys use on-device verification only)
• Advertising identifiers or tracking pixels

2. How We Use Your Information

We do not sell, rent, or share your personal data with advertisers. We will never run ads.

3. Data Storage and Security

All data is stored on Cloudflare's global network using:

• Cloudflare D1 — SQLite database for user accounts, scores, and game history.
• Cloudflare KV — Edge key-value store for trivia packs and caching.
• Cloudflare Durable Objects — Real-time game session state.

All data is encrypted in transit (TLS) and at rest. We use Cloudflare's security infrastructure including WAF, bot detection, and DDoS protection.

4. Cookies and Local Storage

We use minimal browser storage:

• Session cookie: Identifies your authenticated session. Essential for gameplay — no tracking.
• LocalStorage: Stores user preferences (difficulty, theme) and queued offline submissions. No third-party data.

We do not use third-party cookies, analytics trackers, or advertising pixels.

5. Third-Party Services

• Stripe — Payment processing. Stripe collects payment information directly under their own Privacy Policy.
• Cloudflare — Infrastructure, CDN, and security. Subject to Cloudflare's Privacy Policy.
• Cloudflare Turnstile — Invisible CAPTCHA for bot detection. Processes minimal device signals — no tracking cookies.

We do not use Google Analytics, Facebook Pixel, or any advertising SDKs.

6. Data Retention

• Account data: Retained while your account is active. Deleted upon request.
• Gameplay history: Retained for leaderboards and statistics. Anonymized upon account deletion.
• IP addresses: Rate limit records expire automatically (typically within 24 hours).
• Payment records: Retained as required by law (typically 7 years for tax purposes). Managed by Stripe.

7. Children's Privacy

Trivlet is intended for users aged 13 and older. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, contact us at hello@trivlet.com and we will promptly delete the account and associated data.

8. Your Rights

You have the right to:

• Access your data — request a copy of all personal data we hold about you.
• Delete your account and all associated data.
• Opt out of push notifications at any time through your browser settings.
• Correct inaccurate information (e.g., update your display name).

To exercise any of these rights, email hello@trivlet.com. We will respond within 30 days.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the Service. The "Effective date" at the top reflects the last update. Continued use after changes constitutes acceptance.

10. Contact

Questions or concerns about your privacy? Contact us at hello@trivlet.com.

Cisco
200 W Sahara Ave, Unit 3301
Las Vegas, NV 89102