Privacy Policy
Effective date: October 1, 2026 Last updated: October 31, 2026
In short
- We collect what we need to run Whizzu: your email if you join, your onboarding answers, your game scores, and how you use the site.
- Analytics and session recordings run only with your consent where the law asks for it (EU, EEA, UK, Switzerland, Brazil, Canada), and you can opt out everywhere else.
- We do not sell your data and we do not run advertising.
- You can see, correct, export or delete your data at any time by writing to team@whizzu.com.
- Whizzu is for people aged 16 and over.
Who we are
Whizzu is a trading name of David Levinov, an individual trader ("Whizzu", "we", "us"). We are the controller of the personal data described in this policy.
- Email: team@whizzu.com (privacy questions and requests)
- Website: whizzu.com
This policy covers whizzu.com, the free games on it, the founding member waitlist and, once released, the Whizzu apps for iOS and Android.
What we collect
You give us
- Email address and name (name is optional) when you join the founding member list, sign in to save game progress, or write to us.
- Onboarding answers: the topics, goals and learning rhythm you choose in the founding badge flow.
- Game data: scores, times, answers per round and achievements. If you sign in, your display name appears on public leaderboards.
- Messages you send to support.
We collect automatically
- Usage data: pages viewed, buttons clicked, game events, the page you came from and campaign tags (UTM) in the link you used.
- Device data: IP address, approximate country and region (from the IP), browser, operating system, screen size.
- Session recordings (only if you accept analytics): a replay of clicks and scrolling on the site, with everything you type masked.
Referrals: if you invite friends, we store your referral code, who joined through it and any reward earned.
When the apps launch we will also process: your account, sign in details from Apple or Google if you use them, learning progress, purchase and subscription status (we never see your card details), push notification tokens and crash reports. We will update this policy before that happens.
We do not ask for sensitive data (health, religion, political views and similar). Please do not send it to us.
Why we use it and on what legal basis
| Purpose | Data | Legal basis (EU / UK) |
|---|---|---|
| Run the waitlist, send your confirmation and launch updates | Email, name, onboarding answers | Your consent, given when you join. You can withdraw it with one click in any email |
| Run the games, save progress, show leaderboards | Game data, display name, email if signed in | Contract (providing the service you asked for) |
| Personalise lessons at launch | Onboarding answers, learning progress | Contract |
| Keep the site secure, prevent fraud and abuse, rate limit | IP, device data, usage data | Legitimate interest in a safe service |
| Understand how the site is used and improve it (analytics, session recordings) | Usage data, device data, recordings | Your consent (EU, EEA, UK, Switzerland, Brazil, Canada); legitimate interest elsewhere, with an opt out |
| Run the referral programme | Referral data | Contract |
| Subscriptions and purchases (after launch) | Purchase status | Contract and legal obligations (tax, accounting) |
| Answer support requests | Your messages, email | Contract or legitimate interest |
| Meet legal obligations and defend legal claims | Any relevant data | Legal obligation and legitimate interest |
We do not use your data for automated decisions that have legal or similarly significant effects on you.
Who we share it with
We use service providers that process data for us under contract and only on our instructions:
| Provider | What for | Where |
|---|---|---|
| Cloudflare | Hosting, database, storage, security, cookieless web statistics | United States and worldwide network |
| Resend | Sending emails | United States |
| PostHog | Product analytics and session recordings (after consent) | United States |
| Google Analytics | Website analytics (after consent) | United States |
| Apple, Google (after launch) | App distribution, payments, sign in | United States |
| RevenueCat (after launch) | Subscription status | United States |
Your leaderboard display name and score are public. We may also disclose data if the law requires it, to protect our rights or users' safety, or to a buyer or successor if Whizzu is sold or reorganised (you would be told first).
We do not sell personal data and we do not share it for cross context behavioural advertising.
International transfers
Our providers store and process data in the United States, and we may access it from countries that the European Commission recognises as giving adequate protection. Transfers to the United States rely on the EU US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses (with the UK addendum for UK data). You can ask us for a copy of the safeguards.
Cookies
We use a small number of cookies and browser storage items. Strictly necessary items are always on. Everything else waits for your choice where consent is required.
| Name | Purpose | Duration | Needs consent? |
|---|---|---|---|
privacy_regime, privacy_prefs, privacy_gpc | Remember your region and your cookie choice | 1 year | No (strictly necessary) |
visitor_id, visitor_pub | Count visits to our own pages, remember the campaign link you arrived from, keep your place in the founding badge flow and link referrals. Data stays with us | 30 days | No (first party) |
gl-achievements-v1 (browser storage) | Save Geo League achievements on your device | Until you clear it | No (you asked for the game) |
_ga, _ga_K3BDW8HG07 | Google Analytics | Up to 2 years | Yes |
ph_<project>_posthog (cookie and browser storage) | PostHog analytics and session recordings | 1 year | Yes |
Cloudflare's web statistics set no cookies.
Your choice: in the EU, EEA, UK, Switzerland, Brazil and Canada we ask before loading anything that needs consent; use Manage cookies in the footer to change your mind. In the United States you can opt out on our Do Not Sell or Share page, and we honour the Global Privacy Control signal. Withdrawing consent stops analytics from your next page view. You can also delete the cookies in your browser settings.
How long we keep it
| Data | Kept for |
|---|---|
| Waitlist email and onboarding answers | Until you unsubscribe or ask for deletion, or 12 months after the apps launch if you never create an account |
| Unconfirmed signups | 30 days |
| Anonymous visitor records (no email linked) | 90 days |
| Usage events | 180 days |
| Game scores and leaderboard entries | While your account exists, or until you ask for deletion |
| Security and audit logs | 12 months |
| Support emails | 24 months after the last message |
| Purchase records (after launch) | As long as tax law requires |
| Suppression list (to respect an unsubscribe or deletion) | Only your email, kept so we do not contact you again |
Your rights
You can ask us to:
- give you a copy of your data, including in a portable format;
- correct it;
- delete it (Delete Account);
- restrict or object to how we use it, including any use based on legitimate interest;
- withdraw consent at any time (this does not affect use before you withdrew).
Write to team@whizzu.com from the email you used with us. We reply within 30 days and may ask you to confirm your identity. These requests are free.
EU, EEA and UK: you can complain to the data protection authority where you live or work. We would appreciate the chance to fix things first.
United States: depending on your state you have the right to know, access, correct and delete your data and to opt out of sale, sharing or targeted advertising (we do none of these). If we decline a request you can appeal by replying to our answer; we will respond within 45 days. We will not treat you differently for using any of these rights.
Age
Whizzu is for people aged 16 and over. We do not knowingly collect data from anyone younger. If you believe a child under 16 has given us data, write to team@whizzu.com and we will delete it.
Security
We use encryption in transit, access controls, and providers with recognised security certifications. No service is perfectly secure; if a breach puts you at risk, we will tell you and the authorities as the law requires.
Changes
We will post any change here and update the date at the top. For important changes we will also email you or show a notice before they apply.