SongQuiz is a music-trivia game available on iOS, Android, and the web at
songquiz.au. It is operated by the SongQuiz team,
contactable at support@songquiz.au.
This Privacy Policy explains what personal information we collect when you use SongQuiz,
how we use it, who we share it with, and what rights you have over it. It applies
equally to the iOS app, the Android app, and the website.
By creating an account or using the app, you agree to the practices described in this policy.
If you do not agree, please do not use SongQuiz.
2. Information We Collect
2a. Information you provide
Email address — collected when you create an account with email and
password, or when a social identity provider (Google, Apple, Facebook) shares it
with us during sign-in.
Player nickname and avatar icon — assigned each time you join a game.
For email/password accounts the nickname is entered manually. For social sign-in
accounts (Google, Apple, Facebook), your real name as provided by that identity
provider is automatically used as your in-game nickname when you join a game. This name is
visible to all participants in the same game lobby and on the podium, and is
auto-deleted via DynamoDB TTL approximately 24 hours after the game ends.
AI music chat messages — text you submit to the MusicChat feature
to generate song-distractor suggestions. These are sent to Amazon Bedrock for
AI inference and stored for up to 7 days.
2b. Information generated by your use of the app
Gameplay data — scores, answers, round results, and session
participation. Linked to your account during a session and deleted via DynamoDB
TTL approximately 24 hours after the game ends.
Game session identifiers — short-lived IDs that connect players
in the same game lobby. Not used for cross-session tracking.
2c. Information collected automatically
IP address, device type, browser/OS version — captured in AWS
CloudFront and S3 access logs for security and abuse-prevention purposes.
Retained for 30 days.
Advertising identifiers — IDFA on iOS, Google Advertising ID (GAID)
on Android — collected by the Google AdMob SDK when you use the free tier to serve
and measure advertisements. On iOS you are asked for consent via the App Tracking
Transparency (ATT) prompt before any identifier is accessed.
Cookies and local storage (web only) — used to maintain your
login session and store preferences (e.g. colour theme). We do not set any
third-party tracking cookies beyond those placed by the Google Ad Manager (GPT)
script for web advertising on the free tier.
What we do not collect
Passwords — Cognito manages hashed credentials; the app never sees your password.
Persistent real name records — for social sign-in users, your name from the provider is used as a default
in-game nickname (visible to other players during a game, deleted after ~24 h). It is never stored
permanently against your account.
Payment card details — RevenueCat, Apple, and Google handle all payment processing.
Location data.
Contacts or address book.
Microphone or camera input.
Persistent device fingerprints beyond standard advertising identifiers.
3. How We Use Your Information
To create and maintain your account and authenticate you on sign-in.
To display your player name and score to other participants during a game session.
To generate AI-powered music suggestions in the MusicChat feature via Amazon Bedrock.
To manage your subscription status and unlock the ad-free premium tier.
To serve advertisements to free-tier users (AdMob on iOS/Android; Google Ad Manager on web).
To monitor for abuse, investigate security incidents, and comply with legal obligations.
Legal basis (GDPR): Processing is necessary for the performance of a
contract (providing the game service), for our legitimate interests (security,
fraud prevention), or — for advertising identifiers on iOS — based on your explicit
consent given via the ATT prompt.
4. Information Sharing and Third-Party Services
We do not sell your personal information. We share data only with the service
providers listed below, and only to the extent required to operate SongQuiz.
User ID, email address, subscription events, purchase history
Subscription management and entitlement checking (free vs premium tier). Email is set as a subscriber
attribute to link the customer record to their account for support lookups.
Optional social sign-in. Google authenticates you and returns an ID token
to AWS Cognito. SongQuiz does not receive or store your Google profile picture.
Google may log the OAuth event per its own policy.
Email address (or Apple-relayed private email), display name, Apple user ID
Optional social sign-in. Apple authenticates you and passes an identity token
to AWS Cognito. Apple lets you hide your real email behind a private relay address.
SongQuiz stores only the Cognito-issued sub, not the Apple-specific user ID.
Email address, Facebook user ID, public profile name
Optional social sign-in. Meta authenticates you and passes an access token to
AWS Cognito. SongQuiz does not access your friends list, posts, or any other
Facebook data.
Social sign-in note
When you choose "Sign in with Google / Apple / Facebook", authentication is performed
entirely by that provider. SongQuiz receives only the minimum attributes listed above —
enough to create and maintain your account. We do not pass any SongQuiz gameplay data
back to these providers.
5. Data Retention
Data Type
Retention Period
Email address and Cognito account
Until you request account deletion
Per-game data (Player, Score, Round, Session, Game records)
Auto-deleted via DynamoDB TTL approximately 24 hours after a game ends
AI music chat messages (MusicChat)
Auto-deleted via DynamoDB TTL approximately 7 days after creation
Server / CDN access logs (IP address, device info)
30 days
Advertising identifiers
Managed by Google AdMob / Google Ad Manager per their own retention policy
Subscription and purchase history
Managed by RevenueCat per their own retention policy
6. Your Rights and Choices
GDPR (EU / EEA) and Australian Privacy Act
Right to access — you may request a copy of the personal data we hold about you.
Right to rectification — you may ask us to correct inaccurate data.
Right to erasure ("right to be forgotten") — email us at privacy@songquiz.au to request deletion of your account and associated
data. We will action requests within 30 days.
Right to data portability — you may request your data in a structured, machine-readable format.
Right to object to processing — you may object to processing based on legitimate interests.
Right to lodge a complaint — you may contact your local data protection authority (e.g. the
OAIC in Australia, the ICO in the UK, or your EU member state's supervisory authority).
CCPA / CPRA (California residents)
Right to know — you may request disclosure of the categories and specific pieces of personal
information we have collected about you.
Right to opt out of sale — we do not sell personal information.
Right to non-discrimination — we will not discriminate against you for exercising your rights.
Account deletion
To delete your account and all associated data, email
privacy@songquiz.au with the subject line
"Account deletion request" and the email address on your SongQuiz account.
We will confirm deletion within 30 days. Ephemeral game data (scores, players, rounds)
is deleted automatically by DynamoDB TTL regardless of account deletion requests.
7. Advertising and Cookies
Free-tier advertising
SongQuiz is free to play with advertisements. On iOS and Android, ads
are served by Google AdMob. On the web, ads are served by Google Ad
Manager (GPT). Personalised ads are based on the advertising identifier assigned to
your device by your operating system.
Opting out of personalised ads
iOS — tap "Ask App Not to Track" when prompted by the App Tracking Transparency (ATT) dialog,
or go to Settings → Privacy & Security → Tracking and disable tracking for SongQuiz.
Android — go to Settings → Privacy → Ads and choose "Opt out of Ads Personalisation".
Opting out of personalised ads does not remove ads — it replaces personalised ads with contextual ads.
Cookies and local storage (web)
On the web we use browser local storage and session cookies to keep you
signed in and remember your theme preference. These are first-party and do not track you
across other websites. Google Ad Manager may set its own cookies for advertising
purposes; you can manage these via your browser settings or Google's tools linked above.
8. Children's Privacy
SongQuiz is not directed at children under 13 years of age (or under 16 in the EEA).
We do not knowingly collect personal information from children. If we become aware that
a child has provided us with personal data without parental consent, we will delete that
data promptly. If you believe a child's data has been submitted, please contact us at
privacy@songquiz.au.
9. Data Security
All data is stored in AWS ap-southeast-2 (Sydney) within Australia.
All data in transit is encrypted with TLS 1.2+ (HTTPS and WSS).
DynamoDB data is encrypted at rest using AWS-managed keys.
Passwords are never stored or accessible by SongQuiz — AWS Cognito manages authentication with hashed
credentials.
No payment card or bank account details are stored by SongQuiz. All payments are processed by Apple, Google, or
RevenueCat.
Access to production infrastructure is restricted by IAM roles with least-privilege policies.
No security measure is perfect. If you discover a vulnerability, please report it
responsibly to security@songquiz.au.
10. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will revise the
"Last updated" date at the top of this page.
Continued use of SongQuiz after the effective date constitutes acceptance of the
updated policy.
11. Contact
For any questions, requests, or complaints about this Privacy Policy or how we handle
your data, please contact:
SongQuiz Privacyprivacy@songquiz.au
We aim to respond within 5 business days and resolve requests within 30 days.