Kwoji is a games platform for coworkers. It is designed to collect the bare minimum: no password, no advertising tracker, no reselling of data. This policy describes what we process, why, for how long, and your rights.
Data controller
Kwoji, 47 rue Vivienne, 75002 Paris, France — contact: [email protected].
Data we process
| Data | Source | Purpose | Legal basis |
|---|---|---|---|
| Email address, display name, profile photo | Provided by you (or by Google if you sign in with Google) | Create and manage your account, sign you in without a password (magic link) | Performance of the contract (Terms of Use) |
| Membership in an organization, role, membership in clubs | Generated by your use | Link your profile to your organization and your clubs | Performance of the contract |
| Game results, scores, badges, rankings | Generated by the game | History, badges and rankings of the organization | Performance of the contract |
| Photos shared in Kwoji Photo | Provided by you, for the duration of a game | Let players guess who each photo belongs to during the game | Performance of the contract |
| Secrets written in Kwoji Secret | Provided by you | The game itself — they remain anonymous until they are discovered | Performance of the contract |
| Billing details of the organization (company name, address, VAT number, billing email) | Provided by the owner of the organization when subscribing | Collect the subscription and issue invoices | Performance of the contract (Terms of Sale) and legal obligation (invoice retention) |
| Email address of a person invited to join an organization | Entered by an administrator of that organization — the only data we receive about someone who does not have an account yet | Send them a personal invitation, once, and avoid contacting them twice. No automatic reminder, no commercial use | Legitimate interest |
| Google Calendar connection and scheduled games (linked Google account, game, time slot, invited coworkers, Meet link); when a game is being set up, anonymous "busy / free" intervals, never stored | Connection authorized by the host; event created by the host from the active members of their organization | Create and manage, in their own Google Calendar, a game event with a Meet call and invitations, and suggest a time slot that works for everyone | Performance of the contract; revocable consent for the Google connection |
| Pseudonymous audience and usage measurement (page views, page exits and product goals) | Cloudflare Web Analytics and, when enabled, PostHog in cookieless mode | Know whether the platform is being used and understand activation and retention steps | Legitimate interest |
| Technical error reports (error message, affected page, browser) | Generated automatically when the platform encounters a bug | Detect and fix failures | Legitimate interest |
| Your Kwoji Pulse answers (one score per week: mood from 1 to 5, or eNPS from 0 to 10) | Provided by you when you answer the Pulse card | Measure the organization's mood as a strictly aggregated trend: never an individual read, no result below 5 answers | Legitimate interest |
| The content of your support conversations, your email and your name | Provided by you when you open the support chat | Reply to you and follow up on your support request | Legitimate interest |
What your coworkers see
Kwoji is a team product: your profile (display name, photo, email address), your results, badges and rankings are visible to the other active members of your organization — and to them alone. Nothing is public, nothing is shared between organizations.
Kwoji Photo photos are served from a non-guessable address, visible only to the players of the game, and deleted at the end of the game. Kwoji Secret secrets are never recorded in our database: they live in the game's memory and are erased automatically when it closes (at the latest 7 days after the last activity).
A scheduled game is visible in Kwoji only to its host and invited coworkers. Google sends the invitation to the selected people; the organization's other members cannot access the event.
Kwoji Pulse answers follow a stricter rule: no one sees an individual answer. Not your coworkers, not the administrators, not Kwoji in its own screens. Only aggregated trends are shown, and only once at least 5 people have answered. The mechanism is described in detail on the page How Kwoji Pulse protects anonymity, and your own answers are returned to you by your data export.
Retention periods
| Data | Duration |
|---|---|
| Account, profile, results, badges | As long as the account exists; immediate and total deletion when the account is deleted |
| Kwoji Photo photos | For the duration of the game; deleted when it ends, safety purge within 7 days |
| Kwoji Secret secrets | Until the host closes the game; 7 days at most in the event of abandonment |
| Kwoji Pulse answers | 6 months, then automatic deletion; nothing is kept alongside, the trends on screen are recomputed from the answers still present |
| Leaving an organization | If you leave the organization yourself, your membership, results and personal progress in that organization are deleted; your badges, which are attached to your account, are kept until that account is deleted. If the organization permanently removes a deactivated member, their membership and personal progress are deleted, but their previously recorded results remain in anonymized form to preserve collective statistics. |
| Email invitations (invited address, send dates) | 180 days, then automatic deletion — and removable at any time by the organization's administration |
| Your organization's mascot journal | 180 days, then deleted automatically |
| Your opt-outs from non-transactional emails | For as long as your account exists; we keep them precisely so we can keep honoring them |
| Google Calendar connection (authorization token, Gmail address) | Until you disconnect Google Calendar or delete your account; the token is never included in your data export |
| Scheduled games and guest list | 7 days after the time slot ends; 24 hours after cancellation. Cleanup takes place when the organization next schedules a game |
| Invoices and billing details | 10 years from the close of the financial year — accounting obligation |
| PostHog audience measurement and product goals | For the lifetime of Kwoji's PostHog analytics account; earlier deletion is available on request |
| Support conversations (Crisp) | Kept by our provider for as long as needed to handle and follow up on your requests |
Emails we send you
Most of our emails answer something you did: you asked for a sign-in link, your organization invited you, your subscription changed. Three email categories are the exception, and we flag them here precisely because nobody asked for them.
The weekly recap is a summary of your organization's week (games played, most popular games, records broken), sent on Monday morning. It only goes out if an administrator of your organization has enabled it. The setting is off by default — and it sells nothing.
You can opt out at any time, and that decision is yours alone: neither your employer nor your administrator can make it, or undo it, on your behalf. Three equivalent routes — the "Weekly recap" toggle in your profile, the unsubscribe link in every message (it works without even signing in), or the "Unsubscribe" button your email client shows on its own. It takes effect immediately.
The Kwoji Pulse eNPS question goes out once per quarter, if your organization has turned Pulse on (off by default). One question, one button, no pressure: not answering is also fine, with no consequence. You can unsubscribe at any time through the link in every message or the button your email client shows on its own; it is a separate consent from the weekly recap, each one is given and withdrawn on its own.
Kwoji product updates are occasional messages about significant changes to the product. Every message includes its own unsubscribe link. This choice is separate from the weekly recap and Pulse. As an extra precaution, Kwoji does not send a product update to anyone who has already opted out of any of these three non-transactional email categories.
Every message goes to your address alone: your coworkers' addresses never appear in it.
Scheduled-game invitations are not Kwoji emails: Google sends them from the host's calendar only to the coworkers they selected.
Sub-processors
We neither sell nor rent any data. Our technical sub-processors:
- Supabase, Inc. — database, authentication, image storage (region: Ireland (European Union)).
- Cloudflare, Inc. — site hosting, real-time game server and cookieless audience measurement.
- Resend, Inc.: sending of our emails: subscription messages, invitations sent by your organization, weekly recaps, Kwoji Pulse eNPS questions and product updates.
- Stripe Payments Europe, Ltd. (Dublin, Ireland) — payment and billing of subscriptions. The card number is entered at Stripe and never reaches us; we transmit to it the billing email, the company name, the address and the VAT number of the organization.
- Google LLC — if you choose the "Continue with Google" sign-in: Google transmits to us your email, your name and your profile photo.
- Google Ireland Limited — if you voluntarily connect Google Calendar to schedule a game: Kwoji sends it the title, the time slot and the selected coworkers' addresses (up to 500). Google creates the Meet link and sends invitations and reminders. To suggest a common time, Kwoji reads anonymous busy and free intervals only, never an event's title, attendees, location or content. Those intervals are not stored, and you may disconnect the calendar at any time.
- Functional Software, Inc. (Sentry) — detection of technical errors. Error reports are hosted in the European Union and contain neither identity, nor IP address, nor game content — only technical data (error message, page, browser).
- PostHog, Inc. — cookieless audience and usage measurement, when enabled. Kwoji sends it no name, email, account or organization ID, room code, score, or game content. Data is hosted in the European Union (Frankfurt) and the IP address is not retained; any transfers are governed by its data processing agreement.
- Crisp IM SAS (Nantes, France) — customer support chat, when enabled. If you open a conversation, Crisp processes the content of your messages, your email and your name, as well as technical connection data. The data is hosted in the European Union (Amsterdam and Frankfurt), with no transfer outside the EU.
Some of these providers are US companies: transfers are governed by their data processing agreements (standard contractual clauses of the European Commission and, where applicable, certification under the Data Privacy Framework).
Google user data
This section describes precisely what happens to the data Kwoji receives from Google APIs, when you choose "Continue with Google" or connect Google Calendar.
What we receive. Through Google sign-in: your email address, your name and your profile photo. Through the Google Calendar connection (the "calendar.events" scope, event writing only, and the "calendar.freebusy" scope, availability reading only): an OAuth authorization token, the email address of the connected Google account and, at the moment an organizer sets up a game, anonymous "busy / free" intervals used to suggest a common time slot. Kwoji never reads the content of your calendar: not the title, the attendees or the location of any event, nor your emails. Those intervals are not stored: they are used to compute the suggestion, then discarded.
Sharing, transfer and disclosure. We do not share, transfer or disclose Google user data to anyone, with three exceptions:
- our technical hosting providers listed in the "Sub-processors" section (Supabase, Inc. and Cloudflare, Inc.), which store and process this data on our behalf and under contract, with no right to use it for themselves;
- if the law requires it (judicial requisition or legal obligation);
- with your explicit consent, in any other case that might one day be offered.
We never sell this data, we do not transmit it to any advertising network or data broker, we do not use it for advertising, and we do not use it to develop, improve or train artificial intelligence or machine learning models.
Kwoji's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Protection of sensitive data. The Google authorization token is the most sensitive data we hold: whoever possesses it can write to your calendar. It is protected by dedicated mechanisms:
- encryption in transit: all communications (browser, servers, Google APIs) go exclusively over HTTPS/TLS;
- encryption at rest: the database storing it is encrypted;
- strict compartmentalization: the token lives in a private schema of the database, unreachable from the application and from any public API; only our billing server, holder of a service key, can read it. It never travels to a browser and is never included in your data export;
- access control: the OAuth connection flow is protected by a cryptographically signed, time-limited state, which prevents a third party from attaching their calendar to your account;
- revocation: disconnecting Google Calendar from your profile, or deleting your account, deletes the token immediately; you can also revoke Kwoji's access at any time from your Google account security settings.
Cookies and local storage
Kwoji uses no tracking cookie or advertising tracker, and therefore does not display a consent banner. The browser retains only information strictly necessary for operation, in local storage:
- your sign-in session (authentication token);
- technical keys
kwoji-*: pending invitation, game link, current room; - when the support chat is enabled, a technical identifier set by Crisp to keep your support conversation continuous — functional storage, never an advertising tracker.
Audience measurement (Cloudflare Web Analytics and PostHog when enabled) works without a tracking cookie. PostHog runs in cookieless mode: it sets no cookie or local storage and creates no person profile. It uses technical signals such as the IP address, browser and domain to produce a server-side pseudonymous identifier whose salt changes every day; it therefore does not link the same browser across days or domains. URLs containing a fragment, free-form parameter, or invitation, game or authentication secret are not sent to it; only the closed language and sign-up/sign-in mode choices are allowed. Kwoji goals contain no identity data.
Your rights
In accordance with the GDPR, you have the rights of access, rectification, erasure, portability, restriction and objection. Most are exercised directly within the platform:
- Rectification — display name and profile photo can be changed at any time from your profile;
- Erasure — the "Delete my account" button in your profile immediately and permanently deletes all your data; "Leave the organization" erases your data within that organization;
- Access and portability — the "Download my data" button in your profile produces a complete copy of your data in JSON format, immediately.
For any other request: [email protected]. You may also lodge a complaint with the CNIL (cnil.fr).