Privacy policy
Last updated: October 30, 2026
Meletia collects as little data as possible. Players have no account, no cookie is set for them, and their answers are only used for added-up statistics, with no data that identifies them.
Data controller
[à compléter : nom ou raison sociale de l'éditeur], [à compléter : adresse postale]. Contact for any question or request: [à compléter : adresse e-mail de contact].
Players
Playing a quiz, on a website or on Meletia, requires neither an account nor a nickname. At the end of a game, the player sends the answers given; they are scored and then added to the quiz's daily totals (number of games, score, success per question). No individual answer, IP address or player identifier is kept. The IP address is only used, at the time of sending, to limit abuse; it is not stored.
If the quiz creator chose to send results to their own server (webhook), the scored answers of each game are sent to them at the end of the game, without any player identifier or IP address. Meletia keeps no copy; the creator is responsible for how they use them.
Quiz creators and website visitors
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Account: name, email address, password (stored in hashed form, never in plain text), and for a Google or GitHub sign-in, the identifier and profile picture provided by that service | Create and manage your account, sign you in | Performance of the contract (these terms) | Until the account is deleted |
| Sessions: IP address and browser type | Secure sign-in | Legitimate interest (security) | Length of the session: 7 days, extended when you use the service; deleted the night after it expires |
| Attempt limit: IP address, page requested (sign-in, sign-up, password) and number of attempts | Block repeated attempts (passwords tried in a row, accounts created in bulk) | Legitimate interest (security) | 24 hours at most, deleted every night |
| Bot detection: technical browser signals, analyzed by Vercel BotID during sign-in, sign-up and password reset requests | Block automated sign-ins and sign-ups | Legitimate interest (security) | Not kept by Meletia: analyzed on the spot |
| Quizzes: content, settings, chosen distribution | Provide the service | Performance of the contract | Until the quiz or the account is deleted |
| API and webhooks: name and fingerprint of API keys (never the key itself), webhook URL, signing secret and result of the last delivery | Give creators access to their data from their server | Performance of the contract | Until the key is revoked, or the webhook or account is deleted |
| Teacher discount, if you request it: academic email address, or school, position and proof | Check your status and apply the discount | Performance of the contract | Until the account is deleted |
| Challenges: badges earned, reward requests and account figures at the time of the request | Show your progress, review and grant rewards | Performance of the contract | Until the account is deleted |
| Game statistics: number of games, scores and success per question, added up per quiz and per day | Creator statistics, monthly plan quota | Legitimate interest (running the service) | As long as the quiz exists |
| Audience measurement: page visited, referring page, country, device type, operating system and browser. No cookies: a visit is recognized by a technical fingerprint deleted after 24 hours, with no IP address or identifier kept | Count visits and know where they come from, as aggregated statistics | Legitimate interest (audience measurement exempt from consent) | Aggregated statistics available for 12 months |
| Reports: reason, message, and email address if you give it | Handle content reports | Legal obligation (EU Digital Services Act) | 12 months after the report is handled |
| Technical errors: error message, page or request concerned, browser and system, without IP address, cookies or form content | Detect and fix failures | Legitimate interest (running the service) | 30 days |
This data is neither sold nor used for advertising.
Cookies
The quiz player embedded on websites sets no cookie and does not use browser storage. On the Meletia website, only cookies required for it to work are used: the session cookie, which keeps you signed in (7 days), and, during a Google or GitHub sign-in, a temporary security cookie. No audience measurement or advertising cookie: the Meletia website's audience measurement (Vercel Web Analytics) works without cookies and doesn't apply to the embedded player. That is why no consent banner is shown.
Providers
Data is processed by the following providers, bound by a data processing agreement. The database is located in the European Union. Some providers are US companies: any transfers outside the Union are covered by the EU–US Data Privacy Framework or by the European Commission's standard contractual clauses.
| Provider | Role | Location |
|---|---|---|
| Vercel Inc. | Web application hosting, bot detection (BotID), cookieless audience measurement | Servers in Frankfurt (Germany); US company |
| Cloudflare, Inc. | API and quiz player | Global network: a request is handled as close to the user as possible; US company |
| Neon, Inc. | Database | Frankfurt (Germany) |
| Resend | Sending emails (confirmation, password) | Ireland; US company |
| Functional Software, Inc. (Sentry) | Technical error tracking | Frankfurt (Germany); US company |
| Google, GitHub | Sign-in, only if you choose this option | Depending on these services |
Your rights
You can request access to your data, its correction, deletion or portability, the restriction of its processing, or object to it, by writing to [à compléter : adresse e-mail de contact]. We reply within one month. You can also lodge a complaint with the French data protection authority, the CNIL (cnil.fr).
You can delete your account yourself from the My account page: your quizzes and their statistics are deleted with it, immediately. See also the terms of use and the legal notice.