Privacy Policy
Effective date: October 3, 2026
Last updated: October 3, 2026
About this revision
This policy was revised on October 3, 2026. The revision corrects statements that did not match how we actually process data and adds the sections required by law (service providers and transfers abroad, retention and destruction, the privacy officer, and how to seek redress). What changed, and the full text of earlier versions, is under "Change history" below.
View change historyIntroduction
Quiga is operated by Circus Company ("we", "us"). We process personal information in accordance with the Personal Information Protection Act of the Republic of Korea and other applicable laws. This policy explains what personal information we process and why, how long we keep it, which work we entrust to which providers, and which rights you have and how to exercise them.
Scope of This Policy
This policy covers every Quiga service operated by Circus Company. (1) The game website quiga.io, which offers games and quizzes free of charge and may show an ad in one slot below the game play screen. (2) Our discovery-content sites — the blog (blog.quiga.io), the personality-test site (mbti.quiga.io) and the conversation-card site (talk.quiga.io) — which publish articles and tests and may carry advertising. (3) The Quiga Play mobile app (listed in app stores as QuigaPlay), which brings our games together, shows ads and may offer in-app purchases. All three follow this one policy, but what they process and how they handle advertising differ, so each section states which area it describes.
Personal Information We Process
We process only the personal information the service needs. What we process depends on how you use Quiga:
Sign-up and sign-in (quiga.io)
If you sign up with email, we process your email address, your password (stored with one-way encryption so it cannot be recovered), your display name, your account type, and your language, time-zone and country settings.
If you sign in with Google, Apple, Kakao, LINE, Meta or Naver, we receive and process the profile information that provider sends us (an account identifier, your email address and whether it is verified, your name or nickname, the address of your profile picture, and similar). If Naver provides your legal name, we keep it on your account only for refunds and dispute handling and never show it to other users. We do not store the provider's access tokens.
Mobile phone number (optional)
If you add a mobile phone number to protect and recover your account, we process the number and whether it has been verified. Verification texts are sent through the provider listed under "Service Providers and Transfers Abroad" below.
Player profiles
For each player profile created in an account, we process the display name, avatar, age group (and birth year where entered) and language setting. If you set a lock PIN on a profile, it is stored with one-way encryption.
Usage records
When you play while signed in, we process game scores and progress, play time, the record of coins and other in-game currency earned and spent, achievements, leaderboard records and quiz answers.
Information generated automatically
When you use the service, access records such as your IP address, browser and device information, access time and the pages requested are generated automatically and used for security, abuse prevention and troubleshooting. For signed-in players, the IP address is also stored with play records. Cookies and browser storage are explained under "Cookies and Browser Storage" below.
Playing without an account (guest)
On quiga.io you can play every game without signing in. Your game progress is then stored in your browser and is not sent to our servers. A few things are kept on our servers: a temporary guest credential used to serve and grade in-game quizzes (a randomly generated identifier that expires after 24 hours), the list of recently served questions so the same ones are not repeated (expires after 48 hours), and daily counts of how often each game was started and finished (kept for 90 days, with nothing that identifies you). Guests' scores, coins and rankings are not recorded on our servers.
Child profiles
For child player profiles under a family account, we process only the display name, avatar, age group, lock PIN and game performance data. We do not collect contact information from children.
Support requests and bug reports
When you report a bug or contact us, we process what you wrote, the email address for our reply (if you give one), any attachments, the game, language and app version of the screen you reported from, and your IP address and browser information.
Web payment records
Since September 14, 2026 every game on quiga.io has been free and we no longer sell paid subscriptions on the web. Subscriptions paid on the web before then were processed by our payment provider, Paddle; we keep payment records such as the product, amount and currency, transaction identifier and payment time. We never receive or store card numbers or other payment-method details.
Browser notifications
If you turn on browser notifications on quiga.io, we store the delivery address and encryption keys your browser issues, along with browser information, so that we can send you notifications.
Mobile app data (Quiga Play)
A Quiga Play app account is separate from a quiga.io web account.
The Quiga Play app can be used as a guest without signing in. When you play as a guest, the app sends only a randomly generated installation identifier to our servers, used to download the game catalogue and verify installations. That identifier is not linked to your name or email address.
If you sign in to an account, the following information is stored in your account on our servers and synchronised across your devices:
- Account identification: the account identifier confirmed by your sign-in provider (Google, Google Play Games, Meta, email), your email address and whether it has been verified
- Profile: display name, chosen profile picture, language setting, favourited games
- Progress and currency: game progress, coin balance and the record of its changes
- Rankings: the score and display name shown on leaderboards
- Purchase history: product and order identifiers, and the result of purchase verification
- Notifications: if you enable push notifications, your device notification token, app version, language and time zone
To improve the service, the app sends records of how the app is used (app interactions) to Google Analytics for Firebase. This analytics does not use the advertising identifier.
Payment credentials such as card numbers are handled by Google Play or the App Store. We do not collect or store them. We process only the order identifier needed to confirm a purchase.
The birth year you enter for age verification is stored on your device only and is not sent to our servers. Downloaded game files and per-device settings are also stored on the device.
The advertising identifier (Android Advertising ID / iOS IDFA) is used by advertising providers when ads are shown. See "Advertising and Personalised Ads" below.
The app does not request location, contacts, photo or microphone permissions, and all communication is encrypted with HTTPS.
Deleting your account and data
Uninstalling the app removes the data stored on your device, but your account data on our servers remains. You can request deletion of your account data in either of these places:
- In the app: My screen > Delete account
- On the web: https://quiga.io/account/delete
When you request deletion you are signed out immediately, and for 7 days you can cancel by signing in again with the same account. After that grace period, account data is deleted within 30 days; payment and transaction records are kept separately as described under "Retention and Destruction" below.
Conversation Card Studio (talk.quiga.io/studio)
To create your own card decks in the Conversation Card Studio, you sign in with your quiga.io account. quiga.io does not send your email address, name or account number to the conversation-card service; it passes only a randomly generated link identifier, and the link between that identifier and your quiga.io account is kept on quiga.io.
The Studio stores, in its own separate database, the link identifier, the publisher handle and display name you choose, the decks you create (title, description, card text and chosen artwork), decks you favourite, and session information for keeping you signed in (stored in a form that cannot be reversed).
A deck is visible only to you until you publish it. If you publish it by link, anyone with the link can see the deck and your publisher handle and display name; publishing to everyone happens only after review. You can unpublish or delete your decks.
Why We Process Personal Information
- To manage accounts and provide games and quizzes (saving progress, leaderboards, managing coins and other currency)
- To provide game performance analytics
- To recommend games
- To enable parental controls and family features
- To send messages needed to use the service, such as verification codes, payment receipts and notices of changes to our terms or this policy
- To answer support requests and fix bugs
- To prevent abuse, keep the service secure and handle disputes
- To analyse usage and improve the service, where you have consented
- To serve ads, measure their performance and prevent invalid clicks
- To keep records required by law
Advertising and Personalised Ads
Google AdSense ads may appear in one slot below the game play screen on quiga.io and on our discovery-content sites. Ads appear in an area separate from the game and never interrupt play: we place no ads over a game screen and no video ads before or during a game. Some pages without an ad slot (such as the home page and game pages) may also load Google's advertising script used to verify the site. We do not supply data generated while you play for ad targeting.
The Quiga Play app shows ads through Google LLC's Google Mobile Ads SDK, which may use your device's advertising identifier.
Where ads are shown, advertising providers including Google automatically collect visit and usage records (behavioural information) through cookies or your device's advertising identifier, and use them to serve ads and measure their performance. Google, as a third-party vendor, uses cookies to serve ads based on your prior visits to this or other websites. In doing so, advertising providers may process an approximate location derived from your IP address and your interactions with the ads; how long they keep this follows each provider's own policy.
We do not serve personalised ads to children. On quiga.io, if you are signed in and playing as a child or teen profile, or have not chosen a player profile, we request only non-personalised ads at the time the ad is requested. Visitors who are not signed in cannot be age-identified, so standard ads may be shown to them. In the mobile app, users identified through age verification as under 18 are not served personalised ads. Data collected from children is never used for ad targeting or to build advertising profiles, and is never shared with advertising providers.
You can turn off personalised ads at any time. On the web, you can opt out of Google personalised ads in Google Ads Settings (google.com/settings/ads) and of participating vendors collectively at www.aboutads.info. In regions where consent is required (such as the European Economic Area, the UK and Switzerland), Google's consent message asks separately whether advertising cookies may be used. In the mobile app, you can delete or reset your advertising ID in your device settings, and on iOS you can choose whether to allow app tracking. Opting out does not remove ads; they will simply be less relevant to your interests. The choice you make in the quiga.io cookie banner applies to analytics cookies only, not to advertising cookies.
Service Providers and Transfers Abroad
We entrust some of the work needed to run the service to the providers below, and personal information may be transferred abroad in the process. Through contracts and similar measures we make sure they process personal information only for the work we entrust to them. Transfers abroad take place over encrypted networks at the time you use the service.
- Google LLC (United States)
- Work entrusted: Usage analytics (Google Analytics for Firebase — on the web only with your consent), web ad serving and measurement (Google AdSense), app ad serving and measurement (Google Mobile Ads SDK), app sign-in verification (Firebase Authentication) and app push notifications (Firebase Cloud Messaging)
- Information transferred or processed: Cookies and advertising identifiers, device and browser information, IP address, usage records, account identifier and email address for app sign-in, notification tokens
- Retention: Until the service agreement ends, or as set out in Google's data-retention policies
- Cloudflare, Inc. (United States)
- Work entrusted: Website delivery and security (content delivery, DDoS protection, blocking malicious traffic)
- Information transferred or processed: IP address, requested URLs and browser information
- Retention: Until the service agreement ends, or as set out in Cloudflare's data-retention policies
- Amazon Web Services, Inc. (processing region: Seoul, Republic of Korea — not a transfer abroad)
- Work entrusted: Sending verification and transactional email for quiga.io accounts (Amazon SES) — verification codes, payment receipts, notices of changes and similar
- Information transferred or processed: Recipient email address and message content
- Retention: Until the service agreement ends
- Twilio Inc. (United States)
- Work entrusted: Phone number verification for quiga.io accounts — sending verification texts and checking the codes (Twilio Verify)
- Information transferred or processed: Mobile phone number
- Retention: Until the service agreement ends, or as set out in Twilio's data-retention policies
- Functional Software, Inc. (Sentry, United States)
- Work entrusted: Error logging and performance monitoring for the quiga.io API server (Sentry)
- Information transferred or processed: Error details and where they occurred, the method and path of the request involved (with account and player identifiers and tokens masked), browser and server environment information, and performance timings. Request bodies, cookies, query strings, IP addresses, sign-in credentials and account details are not sent.
- Retention: Until the service agreement ends, or as set out in Sentry's data-retention policies
- Paddle.com Market Limited (United Kingdom)
- Work entrusted: Web subscription payments — subscriptions paid before September 14, 2026 and their management
- Information transferred or processed: Email address, payment details (collected directly by Paddle), transaction records
- Retention: As required by law and by Paddle's policies
If you do not want your information transferred abroad, you can prevent some transfers by rejecting analytics cookies (Google Analytics), turning off personalised ads, or not registering a phone number. Transfers that are essential to providing the service, such as website delivery and security (Cloudflare) and server error logging (Sentry), cannot be refused while still using the service.
Sharing with Third Parties
We do not sell personal information, and we do not provide it to third parties unless the law requires or permits it or you have consented. Where ads are shown, advertising providers process cookies and advertising identifiers directly, to the extent described under "Advertising and Personalised Ads" above. Data collected from children is never provided for advertising purposes. App purchases are processed by Google Play or the App Store under their own policies.
Retention and Destruction
We destroy personal information without delay once its purpose has been fulfilled. Retention periods by type:
- quiga.io account information and usage records: until the account is deleted. When you request deletion, the account is deactivated immediately and permanently deleted after 30 days; to cancel during that time, contact us at the address below.
- Quiga Play app accounts: when you request deletion you are signed out immediately and can cancel for 7 days; the account data is deleted within 30 days after that.
- Child profiles: the profile's data is deleted within 48 hours of deleting the profile.
- Payment and transaction records: kept for 5 years as required by Korea's Act on the Consumer Protection in Electronic Commerce; when an account is deleted, they are kept with the link to that account removed.
- Free-trial duplicate-prevention records: one-way hashes of phone numbers and email addresses (which cannot be turned back into the originals), created so that each person received a free trial only once, are kept for 1 year(s) from the date they were created (collected) and then destroyed automatically. They remain for that period even if the account is deleted.
- Guest data: quiz guest credentials expire automatically after 24 hours and recently served question lists after 48 hours; per-game start and finish counts are kept for 90 days.
- Bug reports and inquiries: bug reports (including attachments) and inquiries received by email are kept for 3 year(s) from the date they were received; bug reports are destroyed automatically once that period ends.
How we destroy data: electronic records are deleted so that they cannot be recovered; some statistical records are kept only after being made non-identifiable.
Children's Privacy (COPPA)
Sign-up on quiga.io is for people aged 13 and over, which we confirm on the sign-up screen. Younger children do not sign up themselves; they use a child profile under a parent's family account. Child profiles can be created only inside a parent's account, and during sign-up and family setup we ask a parent aged 18 or over to consent to the processing of their child's data. Parents can review, correct or delete their child's data at any time in account settings. Children's data is never sold, never used for personalised advertising and never shared with third parties for advertising purposes. While a child profile is in use, no analytics data is collected either.
Your Rights and How to Exercise Them
- Access your personal data
- Correct inaccurate data
- Request deletion of your data
- Export your data in a portable format
- Restrict or object to data processing
- Withdraw your consent
On quiga.io you can download your data or delete your account under Account Settings > Privacy & Data. Mobile app users can request deletion from My screen > Delete account in the app, or at https://quiga.io/account/delete. For any other request, write to [email protected]; after confirming your identity we will respond without delay and within 10 days at the latest. You may also exercise your rights through a legal representative or an authorised agent.
How We Protect Your Data
To protect personal information, we encrypt all communication with HTTPS, store passwords, PINs and verification codes with one-way encryption, and encrypt certain sensitive fields at rest. The admin console requires separate authentication and keeps a record of administrative actions, and we keep the number of people who can access personal information to a minimum.
Privacy Officer
The person responsible for overseeing the processing of personal information and handling privacy inquiries, complaints and redress is listed below. Requests to access your personal information and similar requests are also received at this contact.
- Name: 박선욱
- Contact: [email protected]
How to Seek Redress
If you need advice or dispute resolution about a privacy infringement, you can contact the following public bodies in the Republic of Korea.
- Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
- Personal Information Infringement Report Center (KISA): 118, privacy.kisa.or.kr
- Supreme Prosecutors' Office: 1301, www.spo.go.kr
- Korean National Police Agency: 182, ecrm.police.go.kr
Changes to This Policy
When we change this policy, we announce it on this page and through service notices at least 7 days before it takes effect; for changes that significantly affect your rights, we announce them at least 30 days in advance and also notify you individually, for example by email. Corrections of statements that did not match how we actually process data apply from the day they are published.
Change history
| Effective | Summary | Full text |
|---|---|---|
| October 3, 2026 | Corrected statements that did not match reality (the scope section's statement that quiga.io had no ads, mobile app data, how cookies are used, how parental consent is obtained, security measures) · added guest play, mobile phone numbers, support requests and bug reports, web payment records, browser notifications and the Conversation Card Studio · added sections on service providers and transfers abroad, retention and destruction, the privacy officer, and redress · removed the sentence that treated continued use after a change as acceptance | This version |
| September 14, 2026 | Added notice of ads below the game play screen on quiga.io (Advertising and Cookies sections). The page's "Last updated" line was left at August 28, 2026, and the scope section's statement that quiga.io had no ads remained until this revision. | View |
| August 28, 2026 | Added the scope section (web, discovery content, mobile app), the Advertising section and the mobile app data section; revised the Data Sharing and Cookies sections | View |
| March 10, 2026 | First published | View |
Contact Us
For privacy-related inquiries, contact us at [email protected].