Privacy Policy

Who we are

The data controller is Remuda Group AB, org.nr 559596-3785, Slåttervägen 5A, 227 38 Lund, Sweden. For any privacy question or to exercise your rights, contact [email protected].

What we collect

If you create a host account: your email address, display name, and (if you sign in with Google/Apple/Facebook) your profile photo; an account identifier; and the optional answers you give during onboarding (what you use Quack for, and how you heard about us). We also store the decks you build, including any images you upload.

When you run a live session: we store a record of the session (deck title, timestamps, player and slide counts) and each participant’s result (their chosen nickname, score, rank, and per-slide correctness/response time).

If you join a session as a player: you are signed in anonymously (no email or name) and choose a nickname for that session. Your answers, reactions, and any comments you send are processed live during the session; the host can see comments and pin one to the room. If you have accepted analytics, your phone also sends aggregate usage counts - that you joined, answered and finished - with no profile, and never your nickname.

If you use “Create with AI”: the topic and audience you type are sent to Google’s Gemini service to draft a deck (see sub-processors below).

Essential technical data: to keep you signed in and remember your session we store small items in your browser (see our Cookie Policy). We process limited connection data (such as IP address) only as needed to deliver and secure the service. If you accept analytics, that connection data is also used to derive an approximate location (country, region and city) for our analytics provider - see below.

Why we use it, and our legal bases

• To provide the service you asked for - building decks, running sessions, signing you in (contract).
• To keep the service secure and working, and to keep a history of your sessions (legitimate interests).
• To generate AI decks when you choose that feature (your request / contract).
• To understand how Quack is used, with privacy-friendly analytics - only if you accept analytics in the cookie banner (consent). It is off by default and you can withdraw your consent at any time.

Who we share it with

We do not sell your data. We use a small number of processors to run Quack, each bound by a data-processing agreement:

• Google Cloud / Firebase (Google Ireland Ltd. / Google LLC) - Hosting, authentication, databases (Cloud Firestore and Realtime Database - the live database is in the EU, europe-west1), file storage, and serverless functions.
• Google - Gemini (Vertex AI, EU multi-region) - Generating decks and slides from what you type, from the teaching material you upload (PDF, Word, PowerPoint or text - read in your browser, sent to the model for the length of the request, never stored by us), extracting a theme from a brand document you upload, and writing the post-session brief. For a brief, the session's answers and free-text responses are sent; participants are pseudonymous throughout and none of it is used to identify anyone. Model processing runs on Google's EU endpoint (Vertex AI, `eu` multi-region), so prompts, uploaded material and generated decks stay inside the EU.
• Stripe Payments Europe, Ltd. - Payment processing, subscriptions and invoices. Stripe collects your billing details on its own hosted checkout - we never see or store your card number.
• Resend (Plus Five Five, Inc.) - Sending account and transactional email (sign-up, sign-in codes, a deck shared with you, assignment invitations, and product updates you have not unsubscribed from). Receives the recipient address and the message.
• PostHog, Inc. (EU region) - Privacy-friendly product analytics, hosted in the EU, loaded only if you accept analytics in the cookie banner. It receives an approximate location derived from your IP address (country, region, city), your browser, operating system and device, and which pages and features you use. If you are signed in to a host account it also receives your email address, display name, plan and sign-in method, and the organisation you belong to, so we can see how Quack works for a real account. Participants who join a session are measured in aggregate only - that someone joined, answered and finished - with no profile, no name and never their nickname. In the app for hosts it also records how pages are used (clicks, scrolling and what is on screen) so we can find and fix problems. Typed text and email addresses are hidden in these recordings, pages that show participants' names or answers are not recorded, and recordings are deleted after 30 days.
• Pexels GmbH - Stock photo search in the deck editor. Searches are proxied through our servers, so Pexels receives the search term but not your identity; result thumbnails then load in your browser from their CDN.
• Apple Inc. - “Sign in with Apple” - only if you choose that sign-in method.
• Meta Platforms (Facebook) - “Continue with Facebook” login - only if you choose that sign-in method.
• Google - YouTube (YouTube Data API v3 and the embedded player) - Playing a YouTube video a host has added to a slide or to a deck's waiting room. We look the video up from our servers to show its title and thumbnail in the editor; the video itself then plays in YouTube's own embedded player in the presenter's browser, which is when Google receives that viewer's request, sets its cookies and may show ads. Nothing is embedded on participants' phones.
• KLIPY (Kikliko, Inc.) - GIF search in the deck editor, and delivery of a GIF a host has put on a slide. Searches go through our servers, so KLIPY receives the search term but not your identity. Unlike photos, a picked GIF is not copied to our servers - KLIPY's terms do not permit it - so it loads from their CDN: the host's browser, and every participant's phone that opens that deck, reveals its IP address to KLIPY (a US company). We send no user or device identifier with our requests, and ads are switched off for our integration. An organization's admins can turn GIF search off for all of their members.

Please note: images you upload to a deck are stored so they can be shown on the big screen and are accessible to anyone who has the direct link. Don’t upload anything you wouldn’t want shared with your audience.

Quack uses YouTube API Services for this. If you add or watch a video this way you are also bound by the YouTube Terms of Service, and Google's Privacy Policy covers what Google collects through its player - including its cookies and any ads it shows. We are not permitted to block those ads.

AI assistants you connect. If you connect Quack to an AI assistant such as Claude, ChatGPT or Gemini, Quack sends that assistant what it asks for on your instruction: your decks, and your sessions' results as counts and scores, never players' names or what they typed. The assistant's provider (for example Anthropic, OpenAI or Google) then handles it under its own terms and privacy policy, not ours, and may process it outside the EEA. You decide whether to connect one, and you can disconnect it at any time in Settings. We keep a record of each connection (which assistant, when it was approved and last used) until you disconnect it or delete your account.

International transfers

Our providers are part of Google, which may process data outside the EEA. Sign-in (Firebase Authentication) is processed in the United States. Transfers are covered by the provider’s data-processing terms, the EU-U.S. Data Privacy Framework and EU Standard Contractual Clauses. Our live database runs in the EU (europe-west1).

How long we keep it

• Live session data (answers, reactions, comments, scores) is deleted shortly after the session ends and automatically swept within hours.
• Saved session history and results are kept for up to 12 months, then deleted automatically.
• Your account and decks are kept until you delete your account.

Your rights

You can access, correct, export, delete, or object to the processing of your personal data, and withdraw consent at any time. Hosts can do this directly in the app:

• Account settings → “Download my data” exports your profile, decks, and session history as a file.
• Account settings → “Delete account” permanently erases your account, decks, uploaded images, and session history.
• You can also delete an individual session’s stored results from its results page.

Players are anonymous and can’t sign in to self-serve, so to access or delete a player’s data email [email protected] with the session and nickname. You also have the right to complain to your supervisory authority (the Swedish Authority for Privacy Protection, IMY).

Children

Quack is used in classrooms and similar settings. Hosts are responsible for obtaining any consent required to involve minors.

Changes & contact

We’ll update this policy as the product evolves and revise the “last updated” date above. Questions? Email [email protected].