Privacy Policy
Last updated 8 September 2026
This policy explains what TheQnA collects, why, and what you can do about it. It covers theqna.co.uk and the game that runs on it.
The short version. An account needs an email address, a password and a display name. A game you play is stored so you can pick it up on another device. A review you write is stored with the name you put on it. Nothing is sold, nothing is shared for advertising, and there is no tracking or analytics on this site.
Who is responsible
TheQnA is operated by TheQnA, the data controller for the purposes of the UK GDPR. Contact: hello@theqna.co.uk.
What is collected, and why
- Account details — email address, password and display name. Needed to give you an account and to sign you in. Passwords are stored hashed by our authentication provider; nobody at TheQnA can read them. Lawful basis: performance of a contract.
- Games — the board, the scores and the state of a game you started, along with the code in its URL. Needed so a game survives a reload and can be resumed on another device. Lawful basis: performance of a contract.
- Reviews — the name, rating and words you submit, plus a salted one-way digest of your IP address. The digest exists only to rate-limit submissions; it is not reversible and is not used to identify you. Lawful basis: legitimate interests, in keeping the review form usable.
- Purchases — if and when payments are enabled, a record of what was bought and when. Card details are handled by the payment provider and never reach TheQnA. Lawful basis: performance of a contract, and legal obligation for tax records.
There is no analytics, no advertising, no profiling and no automated decision-making on this site.
Who else sees it
- Supabase — hosts the database and handles authentication.
- Cloudflare — serves the site, and sees the IP address of every request as any host does.
- Google Fonts — the site loads its typeface from Google's servers, which means your browser tells Google your IP address and user-agent when a page loads. Nothing else is sent, and this happens whether or not you have an account.
- Stripe — will process payments if and when they are enabled.
These are processors acting on instructions, except Google Fonts and Cloudflare, which also act as controllers for the connection data they receive. Nothing is sold or shared for advertising.
Where it is kept, and for how long
Data is stored on servers operated by the providers above, which may be outside the UK. Transfers rely on the providers' standard contractual clauses and the UK Addendum.
Account data is kept while the account exists. Games are kept while the account exists. Reviews are kept while they are published, or until deleted if they are not. Rate-limiting digests are kept for 24 hours. Deleting your account removes the account and the games attached to it.
Your rights
You can ask for a copy of your data, ask for it to be corrected or deleted, object to processing, or ask for it to be restricted. Email hello@theqna.co.uk and you will get an answer within one month. If you are not satisfied you can complain to the Information Commissioner's Office at ico.org.uk.
Children
TheQnA is not directed at children under 13, and an account should not be created by one. If you believe a child has an account, email the address above and it will be removed.
Changes
If this policy changes materially, the date at the top changes with it and the change is announced on the site.