Privacy Policy

What we collect

• Account info. Email, password (hashed), username, optional bio, avatar, country.
• Activity. Quizzes you take, scores, time used, comments, votes, ratings, daily-trivia takes, badges earned.
• Anonymous play. If you play without signing in, we store a short-lived session cookie so you can finish the quiz. No personal info attached.
• Technical. IP address, browser user agent, request timestamps. Used for rate limiting, abuse detection, and incident response.

What we don't do

• We don't sell your data. Ever.
• We don't track you across other sites.
• We don't run third-party advertising trackers in MVP.

Who we share with

Service providers we need to run the site:

• Supabase (database + auth) — stores everything.
• Vercel (hosting) — receives every request.
• Stripe (when premium ships) — handles payment data; we never see card numbers.

That's it. No analytics suites, no ad networks, no data brokers.

Your rights

You can:

• Download every byte we have on you as JSON, anytime, from your account.
• Delete your account from the same page. Profile, takes, comments, badges, the lot.
• Email contact@threeroads.app if anything else needs sorting.

Cookies

We use a session cookie for sign-in (Supabase auth) and a short-lived cookie for anonymous-play tracking. Both are first-party, both are needed for core functionality. EU/UK/CA visitors see a one-time banner explaining this.

Changes

If we change this policy, the date at the top updates and we'll surface a notice on the site for two weeks. Material changes get an email if you're signed up.