Privacy Policy

Last updated: 20 October 2026

This policy explains what personal data Yippito (“we”, “us”) collects when you use yippito.com and our quiz platform, why we collect it, who we share it with, and the rights you have over it. It forms part of our Terms of Service. If anything here is unclear, email us at support@yippito.com.

Who this applies to

It applies to people who create a Yippito account (teachers, businesses, creators) and to players who join a live game. Players who join a game give only a nickname and, optionally, an avatar choice — no account and no email are required to play. In a game played with a group, a player does not type a nickname: they choose their own name from the list the host keeps for that group. To keep the game working well, Yippito's operator may observe a live game as it is played — the same screens the host and the players see, nothing more; an observer never takes part, is not counted and does not change the game.

What we collect

When you create an account and use Yippito, we collect:

• Account details — your email address, display name, and either a password (which we store only as a securely hashed value, never in plain text) or a Google account identifier if you sign in with Google. You may add a profile picture. We also record whether your email address has been confirmed and the time you accepted our Terms of Service.
• Content you create — the quizzes, questions and answers you write, and any images, audio or video you upload to your questions.
• Game activity — games you host, and the nicknames, answers and scores of players in those games.
• Challenge results — when someone plays a quiz you shared as a challenge link, the name they type, their answers and their score, kept for you to see for 90 days. The player gives nothing else: no account, no email. You can delete any of it at any time, and it goes when you delete the quiz or your account.
• Groups and their members— if you keep a group (a class, a course, a club or a team), the list you enter for it: each member’s first name, the first letter of their surname and the drawn face they play with. If you type a full surname, only its first letter is kept. That is all: we do not ask for, or keep, members’ email addresses, dates of birth or photographs, and we keep no separate record per member — a group’s game is recorded like any other game, under the name that was played with, and what the host sees of a member is a tally of those games by that name (played, best place, last played).
• Feedback you send us — the message, an optional mood rating, the page you were on, and, if you are not signed in, the email address you choose to leave so we can reply.
• Technical data — basic information your browser sends (such as IP address and device/browser type), used for security and to keep the service running.

AI quiz generation

When you ask Yippito to generate a quiz, the source you provide — a topic, your pasted notes, the text of a web page, a pasted transcript, or the text of a PDF — is sent to our AI provider to write the questions. For PDFs, the file itself is never uploaded: your browser extracts the text on your own device and only that text is sent. Please do not paste content you are not comfortable processing this way.

How we use your data

• To provide the service — create your account, save your quizzes and run live games.
• To generate quizzes from the sources you give us.
• To send you essential emails — a welcome message, a link to confirm your email address, password reset links when you ask for one, replies to feedback you send, and notices such as a warning before inactive uploaded media is removed.
• To keep the service secure, prevent abuse and fix problems.

Under UK/EU data protection law, we rely on the following legal bases: performing our contract with you (to run the service and your account), our legitimate interests (to secure and improve the service), and your consent where required.

Who we share it with

We do not sell your data. We share it only with the service providers that make Yippito work, each acting on our instructions:

• Neon — our database (stores your account and quizzes).
• Render and Vercel — hosting for our backend and website.
• Bunny.net — storage and delivery of images, audio and video you upload.
• Resend — sending our transactional emails.
• Google (Gemini) — the AI that generates quiz questions from your source text, and reads any photos you add as material (they are sent for that request only; we do not store them).
• Google — only if you choose to sign in with Google.
• Cloudflare — DNS, security and email routing.

We may also disclose data if required by law. Some of these providers are based outside the UK/EU; where that is the case, appropriate safeguards (such as standard contractual clauses) apply.

Cookies and local storage

We use only what is necessary to run the service — for example, keeping you signed in and remembering your language choice. We do not use advertising or cross-site tracking cookies.

How long we keep it

We keep your account data for as long as your account exists. Media you upload to a quiz that is never edited or played for a long period is automatically removed to save storage (you receive a warning email first) — using the quiz again keeps it. If you delete a quiz, its data and media are removed. You can delete your whole account yourself at any time from Settings; that removes your account, quizzes and uploaded media, and unlinks any feedback you sent.

Your rights

If you are in the UK or EU, you have the right to access, correct, delete, restrict or object to our use of your personal data, to data portability, and to withdraw consent at any time. To exercise any of these, email support@yippito.com. You also have the right to complain to the UK Information Commissioner’s Office (ICO) or your local data protection authority.

Children

Yippito is designed for teachers, businesses and creators, not for use by children on their own. You must be at least 13 to create an account. Where it is used in a classroom, the teacher or school is responsible for how pupils take part. We do not knowingly collect personal data from children: a child never gives us anything themselves. The only exception is a first name and one letter that an adult host enters in a group list, as described below.

Groups

A group is for anyone who plays with the same people again and again — a team at work, a course, a club, or a class if a teacher chooses to use it. When you keep a group, you decide whose names go on its list, and you are responsible for being entitled to enter them — for a school or a club, under its own rules and any permission it requires. For those names you are the controller; we hold the list on your behalf, on your instructions, and use it only to run your games. We never contact members, and we keep nothing about them beyond the list and the games played under those names.

• What a group holds— a first name, the first letter of a surname and a drawn face for each member. Nothing else. A group’s games are recorded like any other game, under the name that was played with; on a member’s page you see a tally of those games by that name — played, best place, last played — and nothing more.
• Who can see the names— you, and the people who join that group’s game with its PIN while its lobby is open: the list is what they choose their name from (a group that joins by card shows no list at all). Names are not shown on any public page, and a group’s game cannot be shared publicly.
• Member cards— a printed card carries a code that stands for one member, not their name. Whoever holds the card can join as that member, so cards are for you to hand out and keep with the group; a lost card is replaced with “New card”, which stops the old one at once.
• On the player’s device— after someone joins a group’s game, their browser remembers which name (or which card) was theirs so they are not asked again next time, and writes down that phone’s own place and points so the member can see their own games. All of this is kept on that device only — none of it reaches us or the host — and can be cleared with “Change” at the door or by clearing the browser’s site data.
• Removing them — you can remove a member or a whole group at any time, and that is the end of the name on our side. Games already played stay in your results under the name that was played with, like any other game; deleting your account deletes your groups, their members and your games.

Security

Traffic to and from Yippito is encrypted (HTTPS), passwords are stored only as hashes, and access to data is limited to what the service needs. No system is perfectly secure, but we take reasonable measures to protect your data.

Changes to this policy

We may update this policy as Yippito grows. When we make material changes, we will update the date at the top of this page.

Contact

Questions about your data or this policy? Email support@yippito.com.

Credits

Music between questions: “Wallpaper” by Kevin MacLeod (incompetech.com), licensed under CC BY 4.0.