Privacy notice
Updated 29 October 2026 · English
About this notice
STUPIT is operated by Marketing, Sports & Safety BV, Oude Baan 12, 2910 Essen, Belgium; enterprise number 0546.730.503. We are the controller of the personal data described here. Contact support@stupit.ai for privacy questions, rights requests or complaints. This notice is dated 29 October 2026 and covers the current quiz, website and support service. Optional features may remain unavailable while release preparation continues.
Quiz and account data
Guest play creates a technical account identifier; it is not anonymous processing. We process your identifier, answers, round timings, results, XP and progress to provide the quiz and save progress. If you register or link an email account, Firebase Authentication processes your email and authentication credentials for sign-in and recovery. An email address is not required for guest play. We rely on performance of the requested service where a valid agreement applies. Security and proportionate abuse prevention rely on our legitimate interest in protecting players and the service; you may object.
Technical information and security
Hosting and service providers process connection information such as IP addresses, request timestamps, device/app information, authentication and integrity tokens, and operational/security events. Firebase App Check and Apple App Attest verify app authenticity. We do not ask you to provide passwords or verification codes in quiz text or support messages. We do not use quiz scores to make legal or similarly significant decisions about you.
Age and country
STUPIT is intended for people aged 13 and over. The participation checkbox is neither age verification nor parental consent. Where age/country assessment is requested, date of birth is used transiently to calculate an age band; we retain country, a coarse age band and assessment dates, not the full birth date in that record. Optional submissions and ads remain blocked when the required eligibility has not been established. Known under-13 users are blocked from new rounds and optional features. Local age and consent rules can impose additional restrictions. Contact us if an assessment is wrong or a child has used the service.
Quiz suggestions and previous Ask history
Where enabled, suggestions require separate privacy consent and submission terms as well as eligibility. We process the text, language, submission time, status and account link in private history and a restricted editorial queue. Suggestions are not published automatically and receive no direct AI response. Original submissions, account data and old Ask history are not sent to editorial AI. Editors may use AI only for independently formulated, non-personal topics; humans approve published content. Earlier Ask versions could send requests to OpenAI and retain AI answers. Existing history is not erased merely by changing the route. You may request access or deletion. New suggestions are currently disabled pending configuration.
Advertising
The app is free. The forthcoming advertising release uses Google AdMob and its User Messaging Platform. It is not yet serving ads. The intended route is optional, non-personalised ads for eligible adults only, with a separate positive choice and applicable consent controls. Refusal does not prevent ordinary quiz play. When enabled, Google can process IP address, device/app information, SDK identifiers and ad impressions/interactions for ad delivery, fraud prevention and reporting; non-personalised does not mean no personal data or storage. Quiz answers, account email, birth date and country assessment are not attached to ad requests by STUPIT. We do not request IDFA tracking permission or use quiz content for ad targeting. You can withdraw the in-app ad choice and use advertising privacy options. No advertising cookies or scripts are placed by these legal pages.
Support and content reports
We process your contact details, message, question reference and necessary technical context to answer support/privacy requests or review reported content. This relies on fulfilling your requested assistance, our legitimate interest in addressing issues, or a specific legal obligation where applicable. Do not send sensitive personal information or information about others. Support, privacy requests and original reports are handled by authorised people, not forwarded to AI tools. Contact support@stupit.ai for review of a moderation decision.
Recipients and international processing
Authorised STUPIT personnel access data for their tasks. Google/Firebase provides authentication, database, server functions and app-integrity services; Apple provides distribution and App Attest; Netlify hosts the website; Microsoft 365 hosts support email; GoDaddy supplies the Microsoft 365 subscription and mailbox administration. Google AdMob is the planned ad provider, currently not serving. OpenAI was used by earlier Ask versions, not by the new suggestion route. RevenueCat is present as an inactive dependency; no purchases or subscriptions are enabled. Providers and their subprocessors can process data in the United States and other countries outside the EEA; the European backend region does not make all processing European. Applicable provider terms describe transfer safeguards such as adequacy decisions and standard contractual clauses. We are checking the exact contractual service chain and locations; we do not claim that a particular transfer mechanism covers every processing operation. Contact us for the applicable safeguards and current details. Provider information is linked below.
Retention and current implementation
Our adopted retention policy is: suggestions and their private copies, and legacy Ask history, up to 90 days from original creation; detailed quiz sessions 90 days; minimum editorial decision metadata 12 months; account/progress while active and up to 24 months without use, with a 30-day warning where email is available; support and content reports up to 12 months after closure. We are still completing scheduled enforcement and mailbox workflows: these are policy limits, not a claim that automated cleanup already operates across all systems. Existing data has been inventoried without deletion. Request deletion through the app or support if you need action now. Ordinary operational logs are configured for 30 days; provider-controlled security/audit logs can have longer fixed periods (the current required Google audit-log bucket is 400 days). Necessary records can be retained for a concrete legal duty or dispute, with restricted access. Provider recovery copies and historic processing have separate deletion cycles; we do not promise that all backups disappear within 30 days.
Your choices and rights
You can request access, correction, erasure, restriction, portability and object to processing where applicable. Consent can be withdrawn without affecting earlier lawful processing. Use the account panel for available data export and account deletion, or email support@stupit.ai. In-app export does not necessarily include every server log, round or editorial record; request broader access via support. Uninstalling the app does not delete the account. We verify identity proportionately, never by requesting your password, and respond within the applicable legal period (normally one month under the GDPR, with permitted extensions explained). You may complain to the Belgian Data Protection Authority, or your competent local authority. We will explain material changes to this notice. Reading this notice is not blanket consent.