Privacy

The data Curio collects, cookies, how long data is kept and your rights (GDPR).

Privacy

Last updated: 10 October 2026

This page explains what data Curio (https://curio-quiz.com) collects, why, how long it is kept and how to exercise your rights, in line with the EU General Data Protection Regulation (GDPR) and the UK GDPR.

Data controller

Curio is an independent project funded by advertising. For any question about your data: contact@curio-quiz.com.

Data we collect

Your account: email address, username, password (stored only as an irreversible hash, never in plain text), country if you provide it, a profile picture if you add one (visible to everyone), and your preferences (theme, colours, difficulty).

Your game activity: games played, answers, scores, articles already seen (so you don’t get the same questions again), and the dates you signed up, logged in and were last active.

Your friends and duels: friend requests, friends list, duel invitations and results (answers and scores), and the related notifications. Multiplayer rooms are only kept in memory during the game (only their number is stored).

Your collection: coins, boosters, cards and their copies, your profile showcase, cosmetics bought or worn, season pass progress, and your sales and bids on the market (prices, dates, buyer and seller).

Your reports: the message you send through “Report a problem”, the page concerned, your browser and, if you give it or are logged in, your email address so we can reply.

Technical data: your IP address and browser are used temporarily for security (limiting login attempts) and for live traffic statistics (number of visitors, page viewed, device type, country derived from the IP). This stays in memory for a few minutes and is not stored in our database.

Sign in with Google: if you use it, we only receive your email address, your first name to suggest a username, and an account ID. No password and no access to your Google account.

Anonymous usage audit: the pages shown and the buttons clicked (button label, device type, day and hour), to learn what’s useful and improve the site. Nothing links this data to you: no account, no username, no IP address. It’s deleted after 90 days.

No spam: your email address is used to log in and to recover your account. We send you login and password reset emails (if you ask for them), and rare emails about major updates (V1.x). You can unsubscribe in one click from the email, or in Settings. No ads.

We don’t sell your data or share it with anyone, apart from the service providers listed below.

Why?

To run the game and your account (performance of the service you request by signing up).

The leaderboard and your public profile: your username, country, best scores, records by topic, stats, duel record, number of friends, online status, card showcase and worn cosmetics are visible to everyone, as is your username on your market sales. Your email is never shown.

Security and traffic statistics (legitimate interest).

Advertising, which funds the site (based on your consent, see below).

Cookies and local storage

Session cookie (curio_session): keeps you logged in for 60 days. Strictly necessary, it’s used for nothing else.

Browser local storage: your preferences, language, current game (to resume it after a refresh), your personal bests and the game counter used for ad breaks. This stays on your device.

Google AdSense advertising: Google and its partners may set cookies to show ads, measure them and, if you agree, personalise them. In the European Economic Area, the UK and Switzerland you’re asked for your choice on your first visit, and you can change it at any time. Learn more: how Google uses information from sites that use its services.

How long we keep data

Account, scores, preferences, friends, duels, notifications and collection: for as long as your account exists.

Login session: 60 days at most.

Unfinished games: deleted after 2 hours.

Articles already seen: the last 5,000 at most.

Reports: until they are handled, and one year at most.

Chat messages: 30 days, then deleted automatically. Reported messages are kept while they are being handled.

Coin movements (the game’s economy ledger): for as long as your account exists.

Online presence (page, device, country): 5 minutes, in memory only.

Hosting and service providers

The site and its database are hosted by Railway Corporation (United States). Reports are emailed to the Curio team through Gmail (Google, United States). Resulting data transfers outside the European Union are covered by the European Commission’s standard contractual clauses. Visitors’ countries are derived locally from their IP address using MaxMind’s GeoLite2 database, without sending your address to a third party. Questions are generated from Wikipedia’s public API: no personal data is sent to it.

Your rights

You can access, correct, export or delete your data, and object to its processing. On your account page you can already change your username and country, and delete your account: this immediately erases your scores, history, collection and sessions. For any other request, email contact@curio-quiz.com or use the contact form.

If you think your rights aren’t being respected, you can complain to your data protection authority, for example the CNIL in France or the ICO in the UK.

Chat moderation

The chat is a hosting service under the EU Digital Services Act. Any message can be reported in one tap, banned words are masked automatically, and every sanction tells the player its reason and length, with a way to appeal through the report form.

Children

Curio is open to everyone. If you’re under 15, please ask a parent before creating an account.