Privacy policy

Last updated: October 17, 2026

In short: Playkit keeps what your club needs to run its sessions: who you are, how to reach you, and your answers. It shows no ads, uses no tracking or analytics, and sells nothing. Your club's organizers can see your name, email address and mobile number. You can ask us to delete your account at any time.

Who we are

Playkit is an app made by QuizRift for sports clubs. Clubs use it to run their sessions; you use it as a member of one or more of them. For your account and the service itself we are responsible for your information; each club decides who belongs to it and how its sessions run. Write to us at hello@quizrift.com about anything in this policy.

What we keep

Your account

• Your email address, which you sign in with.
• Your first and last name, and the mobile number you give when you complete your profile (one account per number).
• Your language, your quiet hours if you set them, and, if you organize a club, whether you want a morning summary and alerts.

What you do in your clubs

• The clubs you belong to, your role in each, and the rosters and programs you are on.
• Your answers to each session's poll, with the time our server received them, and the place you were given, waitlisted for or offered. These records are what makes the allocation fair and checkable, so they are kept with the session.
• If you bring a guest, the name you give for them.
• Requests to join a club, and the invitations you use.
• If you organize a club, the changes you make, in the club's log of changes.
• The messages Playkit sends you, in your inbox.

Your phone

• If you turn notifications on, your phone's push address (a token from Apple or Google), its type and when it was last used, so we can send you messages.
• On your phone, Playkit keeps your sign-in in the phone's secure storage, and your language choice.

Signing in safely

• The six-digit codes we email you, stored only in a scrambled form (a keyed hash) and valid for ten minutes.
• A keyed hash of the network address a request came from (never the address itself), to stop people guessing codes.
• Your sign-in sessions, stored as hashes, which end after your club's chosen period (90 days unless it chose another).
• If you sign in with Google or Apple, the account identifier they give us, and nothing else from them.

What we do not collect

No location, contacts, photos, payment details or advertising identifiers. No advertising, no analytics or tracking tools, no profiles for marketing. We do not sell or rent your information.

How we use it

• To run your club's sessions: open polls, give out places by the club's rules, keep waitlists and offers moving, and show who is coming.
• To tell you what matters: push notifications, the in-app inbox, and email for sign-in codes and for important messages a notification did not reach.
• To keep the service working and secure, and to put things right when something goes wrong.

Who can see it

• Other members of your club see your name in a session's list of who is coming, if the club chose to show names (it can show numbers only).
• Your club's organizers see your name, email address, mobile number, rosters and answers, so they can run the club and reach you.
• Each club sees only its own information. If you are in several clubs, one club cannot see what you do in another; the database itself keeps them apart.
• The services that run Playkit for us, only to do that, under their own privacy and security commitments:
  • Cloudflare (runs our server and its network),
  • Supabase (our database, hosted by Amazon Web Services in the United States),
  • Resend (sends our emails),
  • Expo, Google Firebase Cloud Messaging and Apple Push Notification service (deliver notifications to your phone),
  • Google or Apple, only if you choose to sign in with them.
• Authorities, only where the law requires it.

Where it is kept

Your information is stored in the United States and passes through Cloudflare's network. If you live in Canada or elsewhere, it may therefore be accessed under the laws of the United States.

How long we keep it

• Your account information, for as long as you have an account.
• Sign-in codes expire after ten minutes; sign-in sessions end as described above.
• When you delete your account, we erase your name, email address, mobile number, phone push addresses, sign-in links and the names of guests you brought, and remove you from every club. The records of past sessions stay, without anything that says who you were, so each club's history (who had a place and why) still adds up.
• When a club stops using Playkit, its information is deleted.

Your choices and rights

• See and correct your name and mobile number in the app (Me).
• Turn notifications off in your phone's settings, and set quiet hours in the app.
• Ask for a copy of your information, or for your account to be deleted: see how. We answer within 30 days.
• Under Canadian law (including Quebec's Law 25) you may also complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.

Children

Playkit is meant for people aged 16 and over. It is not directed at children, and we do not knowingly collect information about anyone under 16. If you think a child has an account, write to us and we will delete it.

Security

Everything between the app and our server is encrypted. Clubs are kept apart in the database itself, sign-in codes and sessions are stored only as hashes, and your sign-in is kept in your phone's secure storage.

Changes

If we change this policy we will update the date above, and tell you in the app before a change that matters takes effect.

Contact

hello@quizrift.com