Privacy policy

1. Data controller and contact

The data controller for the processing described here is the operator that provides the QuizBroadcast service from Türkiye (the “Operator”, “we”). You can reach us, including for requests under the KVKK, through the contact form.

2. Roles for broadcaster and viewer data

QuizBroadcast processes data in two different roles:

• As data controller: we decide the purposes and means of the data we process to run broadcaster accounts, provide the website and the app, keep the service secure, answer messages sent through the contact form, measure use, and keep the global round boards that combine the points of every channel.
• As data processor: we process viewers’ usernames, display names, answer results, points and gift records from a broadcaster’s LIVE broadcast on that broadcaster’s behalf, to run the quiz they started. As a rule, the broadcaster who runs the quiz is the data controller for this data.

The broadcaster is responsible for telling the viewers on their broadcast about the quiz and for settling requests viewers make to them; we carry out the technical steps these requests need at the broadcaster’s request. Data being publicly visible on TikTok does not in itself remove the protection of the KVKK.

3. Broadcaster account and settings

When you create an account and use QuizBroadcast, we process:

• your email address
• a one-way hash of your password; we never store the password itself
• when the account was created, and the times of registration and sign-ins, each with the Operator’s service it was on and whether it was a single sign-on; no IP address is kept with these
• your chosen language and account plan
• the country you are from, which you choose when you sign up
• your TikTok username, if you enter it
• question and countdown times, idle and ticker messages, and the broadcast screen’s theme and logo
• the secret key in your broadcast link
• the start, last-seen and end times of each broadcast session in which you connect to live chat, and why it ended
• when you ask for a password reset, only a hash of the reset key, which is valid for 60 minutes
• for single sign-on: a random identifier for each sign-in, shared by the services you reach from it by single sign-on, with when it was created and the day it was last used; and, while you pass from one of the Operator’s services to another, only a hash of a one-time code valid for 60 seconds, with the two services it is between

The password reset email contains only the reset link and is sent through Amazon SES.

The account is shared by the Operator’s services. Your email address, password hash, language, country, account plan, TikTok username and logo, and the sign-in, password reset and single sign-on records above, are kept in one account record that each of them uses, so the same email address and password sign you in to all of them. Once you are signed in to one, single sign-on (“Continue with …” on another’s sign-in page) signs you in to the other without your password. Signing out ends the sign-in on every service you reached from it by single sign-on, and a password reset signs you out of all of them on every device. Everything else (your other settings, question sets, rounds, viewer data and other content) is not shared: each service keeps its own.

4. Broadcaster content

• the name, language, questions and accepted answers of question sets you upload; the uploaded file itself is not kept, the questions in it are parsed and saved
• the logo uploaded on Pro accounts
• polls you save
• a record of each round: the question set’s name, the questions asked, the correct answers, the timings and the results

You can delete a question set, a poll or your logo yourself in the app. The result records of past rounds still contain the question asked and its correct answer after the question set is deleted.

5. Viewer chat, answer and gift data

In a LIVE broadcast that uses QuizBroadcast, chat and gift events arrive through the connection service Euler Stream. Each event carries the viewer’s TikTok username (or, if there is none, their numeric TikTok ID), display name, message and time.

We do not save chat messages: a message is only compared with the accepted answers of the open question and shown live on the broadcaster’s management screen. What we do save permanently is:

• question results: the winning viewer’s username and display name — in most-correct rounds, those of every viewer who answered correctly — the question’s accepted answer (not the text the viewer typed; in closest-guess rounds, the number read from the viewer’s guess), answer time, place and points
• in team rounds, the team a viewer joined and when; in last-one-standing rounds, when a viewer joined and was eliminated; in rounds started with the best friend option, the TikTok username the broadcaster entered for it; in 1 vs ALL rounds, the TikTok username of the challenger the broadcaster named
• gift records: the sender’s username and display name, the gift’s name, count, diamond value as reported by TikTok, time and team
• for a bonus question, the thanked gifter’s username, display name, diamond total and the address of their TikTok profile picture
• round boards: the points a viewer earns on a broadcaster’s channel day by day, and the overall total of their points across all channels; the overall total does not record which channel the points were won on

Poll votes and the supporters board are held only in the server’s memory, are never written to the database, and are dropped within a few hours once no longer in use. In closest-guess rounds, each viewer’s number guess on the open question is likewise held only in memory; only the guesses that win a place are saved, with the question result. QuizBroadcast does not collect payment for gifts and has no access to viewers’ payment details.

Depending on the look the broadcaster chooses, the broadcast screen shows other viewers the winners’ display names, scoreboards, the channel’s ranking and the top players of the round boards, including the global board across all channels. Every signed-in broadcaster can also see the username, display name and points of the top viewers on the global round boards; the channel where the points were won is not shown. A 1 vs ALL round also shows, from its first card, the display name and username of the viewer the broadcaster named as its challenger. A closest-guess round also shows the number each placed viewer guessed.

The bonus card shows the thanked gifter’s display name, username and profile picture. Our server fetches the picture from TikTok’s image servers; TikTok sees our server’s IP address, not the viewers’.

6. Contact form

When you write to us through the contact form, we save:

• your name, email address and message
• the page language and the time it was sent
• a shortened hash of your IP address made with a secret key; the IP address itself is not kept in this record
• a hash of the message text, to notice when the same message is sent again

We use this data to answer your message and to prevent abuse of the form. We read messages in QuizBroadcast’s administration tool and reply from our domain’s Google Workspace email account. The five most recent messages also appear on a status page that only the Operator’s own account can open.

7. Server logs

For every request, the website and app servers record the date and time, the address requested, the IP address, browser details, the referring page, the response status and duration and, when you are signed in, the broadcaster’s account number. We use these logs to run the service, find errors and prevent abuse; they are deleted automatically after 30 days.

Passwords, session cookies, secret keys, correct answers and viewer identities are removed from the application logs. For rate limiting, IP addresses are held only briefly in the server’s memory.

8. Cookies and browser storage

QuizBroadcast uses no advertising cookies. The cookies and browser storage we use are:

• quiz.sid (app.quizbroadcast.com, strictly necessary): the session cookie created when you sign in. Before you sign in, it is created only when a sign-in through another of the Operator’s services begins, and then it expires 10 minutes after its last use unless the sign-in completes. Scripts in the browser cannot read it, it is sent only over encrypted connections, and it expires 30 days after you last use it.
• _ga and _ga_<id> (both domains, analytics): the cookies Google Analytics sets to tell visits apart; they last up to 2 years.
• Local storage (app.quizbroadcast.com, preference): the interface language (quiz.locale), your round start choices (quiz.podiumScoring, quiz.viewerDuel, quiz.bonusQuestion, quiz.bonusMinDiamonds; the username of the last 1 vs ALL challenger: quiz.challengerHandle; where your account plan offers it, the best friend option and the username entered for it: quiz.bestFriend, quiz.bestFriendHandle) and the mobile screen’s background (quiz.mobileBg). These stay in your browser until you delete them, and the browser does not send them to the server on its own; only when you start a round do the choices that round uses, the best friend’s and the challenger’s usernames included, reach the server, where they are kept with the round.
• Session storage (app.quizbroadcast.com, strictly necessary): a record kept for at most five minutes so that your choices on an open screen survive when the app reloads itself to update (quiz.reloadPicks).
• Local and session storage (app.quizbroadcast.com, preference): once you have signed in through another of the Operator’s services, which service it was (quiz.ssoPeer), so that the sign-in page can sign you in through it again without asking; it is deleted when you sign out. For the open tab, a note that this has already been tried once (quiz.ssoTried).
• Local storage (quizbroadcast.com, preference): the site language you chose (quizbroadcast.site.locale) and the language suggestion bar you closed (quizbroadcast.site.langbar).

You can view, delete or block cookies and site data in your browser settings. If you block the quiz.sid cookie you cannot sign in to the app; blocking the Google Analytics cookies does not affect your use of the site or the app.

9. Google Analytics

We use Google Analytics to measure how the website and the app are used. It runs on every page of quizbroadcast.com and on the app’s sign-in, management, settings and help pages; it does not run on the broadcast screen, the mobile screen, the password reset page or the page that completes a single sign-on.

At present Google Analytics loads when a page opens; there is no separate cookie consent step. Google processes the page visited, the time, the referring page, the browser and device type, an approximate location derived from the IP address, and the identifier in the analytics cookie. We do not send Google Analytics your email address, TikTok username, questions or answers.

You can block Google Analytics with your browser’s tracking protection, a content blocker or Google’s opt-out browser add-on; this does not affect your use of the site or the app. Event data in Google Analytics is kept for the period set in the Analytics property, at most 14 months.

10. Purposes and legal bases

We process personal data on these legal bases:

• Establishing and performing the contract (KVKK Art. 5/2-c): opening and running your account, signing you in to the Operator’s services with it, storing your question sets and settings, connecting to live chat, matching answers, determining the winner and the score, providing the broadcast screen and management tools, applying plan features and sending password reset emails.
• Legal obligation (KVKK Art. 5/2-ç): responding to requests from competent authorities and answering requests under the KVKK.
• Establishing, exercising or defending a right (KVKK Art. 5/2-e): reviewing and preserving records in disputes and cases of abuse.
• Legitimate interest (KVKK Art. 5/2-f): keeping the service and accounts secure, preventing automated attacks and abuse of the form, finding errors, answering messages sent through the contact form, measuring the website and the app with Google Analytics, and keeping the global round boards that combine the points of every channel.

For viewer data we process on a broadcaster’s behalf, the broadcaster who runs the quiz determines the legal basis. Your right to object to processing based on legitimate interest is described below.

11. Who we share data with

We do not sell personal data or use it for advertising. We share data only as far as the service requires, with:

• Amazon Web Services (AWS): servers, encrypted storage and backups, server logs (CloudWatch Logs) and password reset emails (Amazon SES), all in the Frankfurt region in Germany.
• Euler Stream: the intermediary service that connects to TikTok LIVE chat. To connect, it receives the broadcaster’s TikTok username, and it passes us the chat, gift and viewer information of the broadcast (username, display name, message, profile picture).
• Google: usage measurement with Google Analytics, and the Google Workspace email account from which we answer contact form messages.
• Other broadcasters and viewers: the display names, usernames and points shown on broadcast screens and the global round boards, as described above.
• Competent persons and authorities: courts, law enforcement and regulators, where a legal obligation, a lawful request or the defence of a right requires it.
• An acquirer: if the service is transferred or reorganised, under a duty of confidentiality and only as needed; we will inform you if a transfer happens.

12. Transfers outside Türkiye

QuizBroadcast is run from Türkiye, but its data is hosted outside Türkiye: application data, server logs and backups are in AWS’s Frankfurt (Germany) region. Euler Stream and Google may process data outside Türkiye, in other countries including the United States.

These transfers fall under Article 9 of the KVKK. You can ask through the contact form which provider data is transferred to, to which country and on which transfer basis.

13. How long we keep data

• Session cookie and the server’s session record: 30 days from last use, or 10 minutes for one opened to begin a single sign-on; expired sessions are deleted automatically.
• Account, settings, sign-in and broadcast session records: for as long as the account is open.
• Single sign-on records: a sign-in’s identifier until you sign out, reset your password or leave it unused for 32 days; one-time codes are deleted automatically after they expire.
• Question sets, polls, logo and theme: until you delete them or the account is closed.
• Viewer data, including round results, team and elimination records, gift records and round boards: there is currently no automatic deletion period; the data is kept until it is deleted on request or when the broadcaster’s account is closed. The global round board across all channels is not tied to a broadcaster account, so it is deleted on request.
• Contact form messages: after they are answered, until the Operator deletes them.
• Server logs: 30 days.
• Google Analytics event data: as set in the Analytics property, at most 14 months.
• Backups: the database is backed up every night and a backup is kept for at most about 120 days; deleted data can remain in older backups until that period ends.

Where there is a legal retention obligation, an ongoing investigation or a legal claim, the relevant data may be kept for as long as needed with access restricted. A deletion on TikTok does not by itself remove a record that had already reached QuizBroadcast.

14. Security

We apply technical and organisational measures in proportion to the risk:

• all connections to the website and the app are encrypted with TLS
• passwords are hashed one way; password reset keys and single sign-on codes are stored only as hashes, and resetting a password signs out every session on all of the Operator’s services
• a single sign-on code works once, within 60 seconds, and only for the service and the browser that asked for it
• the application database is kept on an encrypted disk, and backups in encrypted storage closed to public access
• each broadcaster’s data is separated by account in the database queries
• the administration tool is not reachable from the internet, only through an encrypted tunnel
• correct answers and management information are never sent to the broadcast screen
• you can renew the key in your broadcast link at any time
• sign-in, registration, single sign-on, password reset and contact form requests are rate-limited

No internet system is absolutely secure. Keep your password and your broadcast link secret, and tell us straight away about any suspicious access. If we learn of a personal data breach, we make the notifications the KVKK requires.

15. Automated matching and winners

QuizBroadcast compares chat messages by software with the accepted answers the broadcaster defined and marks the first correct answer to reach the server as the winner. In closest-guess rounds it reads a number from each viewer’s first message that contains one, and marks the guess closest to the answer as the winner, the earlier of two equally close guesses. In most-correct rounds it also scores every other correct answer that reaches the server before the question’s time runs out. In multiple-choice most-correct rounds only a viewer’s first message that names one of the options counts as their answer, right or wrong. Network and platform delays can affect the result.

This result is a quiz score; it is not used for any decision about you that has legal effects. The broadcaster who gives a prize is responsible for checking the result and considering objections. If you believe a result produced solely by automated processing has gone against you, you can ask us for a human review.

16. Children

QuizBroadcast accounts are only for people aged 18 or over. Younger viewers can, however, write in a TikTok LIVE chat; the broadcaster is responsible for setting age-appropriate rules for their audience and any prize. If you believe a child’s data is being processed unlawfully, tell us through the contact form.

17. Your rights

Under Article 11 of the KVKK you have the right to:

• learn whether your personal data is processed
• request information about it if it is
• learn the purpose of the processing and whether the data is used accordingly
• know the third parties in Türkiye or abroad to whom it is transferred
• ask for it to be corrected if it is incomplete or inaccurate
• ask for it to be deleted or destroyed where the conditions of Article 7 of the KVKK are met
• ask for corrections, deletions or destruction to be notified to the third parties the data was transferred to
• object to an outcome against you that results solely from analysis by automated systems
• claim compensation if you suffer damage because of unlawful processing

If you are in the European Economic Area or the United Kingdom, you may also have rights under the General Data Protection Regulation (GDPR) to access your data; to have it corrected, erased, restricted or ported; to object to processing based on legitimate interest; and to complain to the data protection authority of your country.

Where other laws require us to keep data, or a request would infringe the rights of others, we may not be able to meet a request in full or in part; in that case we explain why.

18. How to make a request

Send your request through the contact form, starting the message with “KVKK request”. State your name, your request, your QuizBroadcast account’s email address or the relevant TikTok username if there is one, and the approximate date and broadcast the request concerns. If you apply on someone else’s behalf, a document showing your authority is needed. Do not send identity documents we have not asked for; if needed, we will tell you a secure way to verify your identity.

Requests are settled free of charge as soon as possible according to their nature, and within 30 days at the latest; if handling a request involves an additional cost, the fee in the tariff of Türkiye’s Personal Data Protection Board may be charged. If your request is refused, you find the answer insufficient, or it is not answered in time, you can complain to the Board within the periods set by the KVKK.

If you are a viewer and your request concerns an answer, score or gift record from a broadcast, the fastest route is to contact the broadcaster who ran that quiz first. If you cannot reach the broadcaster, or your request concerns the global round boards, you can contact us directly. Before disclosing broadcast data about someone, we verify that the identity, broadcast and record match.

19. Changes

We update this policy when the service, the data flows, our providers or the law change. The date of the last update is shown at the top of the page. We announce a change that materially affects your rights or the purposes of processing on this site, and by email where appropriate, before it takes effect.