Privacy policy

The short version

We collect what it takes to run live quizzes: your account, your quizzes, and the results of games you host.
Players don't need an account. Their nickname and answers go to the host's report; anonymous games keep no names at all.
We use one cookie, to keep you logged in. No ads, no analytics trackers, no selling data.
You can download everything we hold about you, set reports to delete themselves, or delete your account from Settings.

Who we are

Drule is run by [Company legal name], [Registered address] (company number [Company registration number]) — “we” in this policy.

For your own account we decide how your data is used, so we are its controller. When a business uses Drule for its team, the business decides what games to run and who takes part; for the players' answers and the workspace's content we act as its processor under our data processing agreement.

What we collect

If you have an account (hosts and creators)

Account details: your name, email address and password. Passwords are stored only as a salted argon2id hash — we can't read them.
Workspace: the workspace you belong to, your role, and its name, logo link and brand colour.
What you make: quizzes, questions, answers and image links. We don't host images; we show the links you add.
Games you host: each game's settings and results — see “If you play” below — and any health-check tracks you create.
Settings: your report-retention choice and, if you arrived through a link like “Made with Drule”, the short referral code on that link.
Billing: your plan, payment references, amounts, currency, status and the country of the card, as reported by our payment provider Paystack. Card numbers are entered on Paystack's page and never reach us.
Integrations: if your workspace connects Slack, its Slack workspace name and id, an access token (encrypted), channel names you choose, and the Slack user ids of people who link their Drule account. If it connects Microsoft Teams, the channel name and workflow URL (encrypted).

If you play

The nickname you pick, the team you join, your answers, how fast you answered and your score. These are shared with the host and saved in their report.
In an anonymous game you join without a name. Hosts only see totals, and a question's results stay hidden until at least 3 people have answered.
Free-text answers (open questions) are saved as you typed them, after removing invisible control characters.

From everyone

Your IP address, used briefly to protect the service from abuse (rate limits) and kept in server logs for [log retention period].
Basic technical details your browser sends with every request, such as its type and language.

Cookies and your device

Drule sets one cookie: a session cookie that keeps you logged in. It's strictly necessary, so there's no cookie banner. We don't use advertising or analytics cookies, tracking pixels or fingerprinting.

Your browser also keeps a few things on your own device, which never leave it unless you send them: your theme and sound preference, your last nickname, a token that lets you rejoin a game after a dropped connection, and unsaved quiz drafts.

How we use it

To run Drule for you — hosting games, saving quizzes and reports, workspaces and integrations. This is needed to provide the service you signed up for.
To keep it safe — preventing abuse, spam and attacks, and reviewing public quizzes people report. This is our legitimate interest in a secure service.
To bill you and keep accounts — processing payments and keeping the records tax law requires.
To email you about your account — password resets, workspace invites and payment problems. We don't send marketing email.

We don't sell your data, use it for advertising, or use your quizzes or answers to train AI models.

Hosts see the nicknames and answers of players in their games.
Your workspace sees quizzes you share with it, reports of games hosted in it, and tracks shared with it.
Everyone can see quizzes you make public in the library, along with your name as the author.
Service providers who run parts of Drule for us, listed on our subprocessors page. They may only use data to provide their service to us.
Slack or Microsoft Teams, only if your workspace connects them: game invites and results posted to the channel you chose.
Our AI provider, DeepSeek, only when you use AI question generation — see below.
Authorities, only when the law requires it. Where we're allowed to, we'll tell you first.

AI question generation

When you choose Generate with AI or ask AI to rewrite a question, we send what you entered to our AI provider, DeepSeek, so it can draft questions:

the topic, audience, difficulty, language and question settings you picked;
any notes you paste or document you add — only its text is sent, taken out of the file in your browser; the file itself never leaves your device;
for a rewrite, the question and answers being rewritten.

We don't send your name, email address or anything about your players, and nothing we send is used to identify players. DeepSeek processes these requests on its own servers, outside the European Union [confirm DeepSeek's data-use and retention terms].

Please don't include personal or confidential information in topics or material you send for AI generation. Workspace owners and admins can turn off generation from documents for their workspace.

We don't keep logs of your topics, material or the drafts that come back beyond the questions you save. We record how many generations you use each month (for your plan's allowance) and include the monthly totals in your data export.

Where it is stored

Drule's servers and backups are in the European Union. Some providers (for example email delivery, payments and our CDN) and our AI provider (only when you use AI generation) work from other countries; where data leaves the EU or UK we rely on safeguards such as the European Commission's standard contractual clauses [confirm per provider].

How long we keep it

Your account and quizzes stay until you delete them or your account.
Game reports stay until you delete them, unless you or your workspace choose automatic deletion after 30, 90, 180 or 365 days. Deleted reports are gone for good.
Deleted accounts are removed straight away. Payment and subscription records are kept, with your name and email removed, for as long as tax law requires [statutory period].
Backups are encrypted and replaced on a rolling basis, so deleted data disappears from them within [backup retention period].

Your rights

Depending on where you live, you have the right to:

Get a copy of your data — use “Download my data” in Settings for a JSON file of everything tied to your account.
Correct it — change your name and password in Settings.
Delete it — delete your account in Settings, or ask us.
Object to or restrict how we use it, and take it elsewhere (the export is machine-readable).
Complain to your data protection authority. We'd appreciate the chance to fix things first.

Played in someone else's game? Your answers belong to their report, so ask the host first — they can delete the report. If you can't reach them, email us at support@drule.app with the game PIN and roughly when you played. We reply within one month.

Children

Accounts are for people aged 16 and over. Players don't need an account; if you host a game for children, you're responsible for doing that appropriately — anonymous mode helps, because no names are collected at all.

Changes to this policy

When we change this policy we'll update the date at the top. If a change matters, we'll tell account holders by email or in the app before it takes effect.

Contact us

Questions or requests: support@drule.app, or write to [Company legal name], [Registered address].