Kwoji is a games platform for colleagues. It is designed to collect the bare minimum: no password, no advertising tracker, no reselling of data. This policy describes what we process, why, for how long, and your rights.
Data controller
Kwoji, 47 rue Vivienne, 75002 Paris, France, contact: contact@kwoji.com.
For what your organization configures and reads in its administration space (in particular Kwoji Pulse, teams and hierarchy, the engagement dashboard, invitations, the Slack or Teams channel, Slack direct messages, Google Calendar scheduling and Kwoji Live), your organization is the controller, and Kwoji acts on its behalf under the Data Processing Agreement.
Data we process
| Data | Source | Purpose | Legal basis |
|---|---|---|---|
| Email address, display name, profile photo | Provided by you (or by Google if you sign in with Google) | Create and manage your account, sign you in without a password (magic link) | Performance of the contract (Terms of Use) |
| Membership in an organization, role, membership in clubs, and, if your organization has turned on seniority in Kwoji Pulse, your start date entered by an administrator | Generated by your use | Link your profile to your organization and your clubs | Performance of the contract |
| Game results, scores, badges, rankings | Generated by the game | History, badges and rankings of the organization | Performance of the contract |
| Photos shared in Kwoji Photo | Provided by you, for the duration of a game | Let players guess who each photo belongs to during the game | Performance of the contract |
| Secrets written in Kwoji Secret | Provided by you | The game itself: they remain anonymous until they are discovered | Performance of the contract |
| Texts from a Kwoji Verita round (the question, your true answer or your bluff) | Provided by you during the game | Have an AI model judge whether a bluff actually tells the truth, to remove it from the table. The model receives no identifier and the name of the person being asked is replaced, but a name written in a text is sent as is; nothing is kept | Performance of the contract |
| Billing details of the organization (company name, address, VAT number, billing email) | Provided by the owner of the organization when subscribing | Collect the subscription and issue invoices | Performance of the contract (Terms of Sale) and legal obligation (invoice retention) |
| Email address of a person invited to join an organization | Entered by an administrator of that organization: the only data we receive about someone who does not have an account yet | Send them a personal invitation, once, and avoid contacting them twice. No automatic reminder, no commercial use | Legitimate interest |
| Google Calendar connection and scheduled games (linked Google account, game, time slot, invited colleagues, Meet link); when a game is being set up, anonymous "busy / free" intervals, never stored | Connection authorized by the host; event created by the host from the active members of their organization | Create and manage, in their own Google Calendar, a game event with a Meet call and invitations, and suggest a time slot that works for everyone | Performance of the contract; revocable consent for the Google connection |
| If your organization has installed the Kwoji Slack app: the ID of your Slack account, when it was linked and checked, and your direct message preferences | Looked up in Slack, in your organization's workspace, from the email address of your Kwoji account; preferences set by you in your profile | Let you know by Slack direct message about kudos you received, an idea you proposed or backed that moves forward, the opening and reminder of Kwoji Pulse, the launch and re-send of a survey that concerns you. Answers always happen on Kwoji | Legitimate interest of your organization, on whose behalf Kwoji acts |
| Pseudonymous audience and usage measurement (page views, page exits and product goals) | Cloudflare Web Analytics and, when enabled, PostHog in cookieless mode | Know whether the platform is being used and understand activation and retention steps | Legitimate interest |
| Technical error reports (error message, affected page, browser) | Generated automatically when the platform encounters a bug | Detect and fix failures | Legitimate interest |
| Your Kwoji Pulse answers (one score per week: mood from 1 to 5, or eNPS from 0 to 10), and the segments your organization has defined to group results (team, reporting line, and possibly site, seniority or another axis), frozen at the moment of the vote. If you choose to after a low answer, an anonymous comment of up to 500 characters, stored with no link to you (no account, date, segment or rating) | Provided by you when you answer the Pulse card | Measure the organization's mood as a strictly aggregated trend: never an individual read, no result below the anonymity threshold (5 answers by default) | Legitimate interest |
| Your messages to the Kwoji team (a problem, a question, an idea, or a rating from 1 to 5 with an optional word), your account email address, your organization, your role and its plan, the open page, your browser, the app version, your language and, for a problem, the last technical error in your browser | Provided by you when you write to the Kwoji team or answer one of its questions | Reply to you, fix reported problems and improve Kwoji | Legitimate interest |
What your colleagues see
Kwoji is a team product: your profile (display name, photo, email address), your results, badges and rankings are visible to the other active members of your organization, and to them alone. Nothing is public, nothing is shared between organizations.
Kwoji Photo photos are served from a non-guessable address, visible only to the players of the game, and deleted at the end of the game. Kwoji Secret secrets are never recorded in our database: they are kept in the game server’s temporary storage and are erased automatically when it closes (at the latest 7 days after the last activity).
A scheduled game is visible in Kwoji only to its host and invited colleagues. Google sends the invitation to the selected people; the organization's other members cannot access the event.
Kwoji Pulse answers follow a stricter rule: no one sees an individual answer. Not your colleagues, not the administrators, not Kwoji in its own screens. Only aggregated trends are shown, and only once your organization's anonymity threshold is reached: 5 answers by default, which your organization can set to 4 or 3 for the following waves, never for answers already given. You can check the threshold in force from your voting card. The anonymous comment you can leave after a low answer is read by the administrators once the wave has closed, with nothing that identifies you: it is linked to no one, so it can neither be returned to you nor deleted at your request. If your organization turns on the AI summary, the wave's comments are also sent, exactly as they were written, to the model that writes that summary. The mechanism is described in detail on the page How Kwoji Pulse protects anonymity. Seven days after a wave closes, your answer is no longer linked to your account: Kwoji only keeps the score and the groups you belonged to when you voted, and the exact time of the answer is erased at the same moment, only the hour remains. Your data export therefore returns your answers that are still linked (the open wave, and those closed less than seven days ago).
You may receive game suggestions in the Games tab, computed from your games, when your organization runs a campaign to connect colleagues, without your employer knowing that you receive them: it only sees headcounts, never who.
Slack direct messages
If your organization has installed the Kwoji Slack app, Kwoji looks up your Slack account by sending Slack the email address of your Kwoji account, and keeps only the ID of that account: no name, no photo, no directory. Guests of the Slack workspace are not linked. Your organization doesn't see whether you are linked: it only reads how many members were looked up and found.
Messages are sent in your organization's Slack workspace, where they are kept under that workspace's rules. Kwoji doesn't keep their text, and reads nothing written in Slack. This is why the Kwoji Pulse reminder and a survey re-send are the same for everyone, whether you have answered or not, why no message carries your rating or your answer, and why none names an idea. Slack is not a sub-processor of Kwoji: it is a recipient designated by your organization, which chose and installed the app on its own workspace, under its own contract with Slack.
You can turn off one topic or all messages from your profile, or choose "Unlink my account": the link is deleted and Kwoji stops linking you on its own. Every message says where this setting is. Your data export includes the link and your preferences.
Partner program
If you become a Kwoji partner, we process your identity, contact details, application, commissions and payouts to run the program and meet our accounting and tax obligations, as set out in the program terms. Your bank details appear on your invoice or your referral fee note and are not stored in the application. This data is kept for as long as you take part, then for ten years from the close of the financial year of the last payout, for accounting records. If your organization enters a partner's code, that partner sees your company name, the date your space was created, your plan and its billing period, and the amount of their commission, never your members or your activity. If you open Kwoji through a partner's link, we count the visit for them without a cookie or any storage in your browser and without keeping anything about you: only a total of visits per day is kept, for thirteen months.
Retention periods
| Data | Duration |
|---|---|
| Account, profile, results, badges | As long as the account exists; immediate and total deletion when the account is deleted |
| Kwoji Photo photos | For the duration of the game; deleted when it ends, safety purge within 7 days |
| Kwoji Secret secrets | Until the host closes the game; 7 days at most in the event of abandonment |
| Kwoji Verita texts sent to the AI referee | Not kept by Kwoji; not kept by Scaleway either, except a request that caused an error, kept two weeks at most for diagnosis |
| Kwoji Pulse answers | Link with your account erased seven days after the wave closes; answer kept for the whole duration of your organization's contract, until the organization's owner deletes it, and at the latest 30 days after the contract ends, anonymous comments included; follow-up actions on a signal (taken in hand, to review, not relevant), with their date, their due date, their author and the average already shown at the time, as well as the context sentence and suggested action written by the AI for an alert, are kept the same way and deleted with the history. Aggregated results of closed weeks may be kept in a technical cache, subject to the same anonymity rules, invalidated when data or rules change, and deleted with the Pulse history. Trends remain based on the answers still present |
| Leaving an organization | If you leave the organization yourself, your membership, results and personal progress in that organization are deleted; your badges, which are attached to your account, are kept until that account is deleted. If the organization permanently removes a deactivated member, their membership and personal progress are deleted, but their previously recorded results remain in anonymized form to preserve collective statistics. |
| Email invitations (invited address, send dates) | 180 days, then automatic deletion, and removable at any time by the organization's administration |
| Your organization's mascot journal | 180 days, then deleted automatically |
| Your opt-outs from non-transactional emails | For as long as your account exists; we keep them precisely so we can keep honoring them |
| Your Slack account ID and direct message preferences | The link, until "Unlink", until your organization uninstalls or disconnects the app, until you are removed from the organization for good, or until you delete your account; it is checked again every week. Your preferences, until you are removed for good or delete your account. Kwoji doesn't keep the text of messages |
| Google Calendar connection (authorization token, Gmail address) | Until you disconnect Google Calendar or delete your account; the token is never included in your data export |
| Scheduled games and guest list | 7 days after the time slot ends; 24 hours after cancellation. Cleanup takes place when the organization next schedules a game |
| Invoices and billing details | 10 years from the close of the financial year (accounting obligation) |
| PostHog audience measurement and product goals | For the lifetime of Kwoji's PostHog analytics account; earlier deletion is available on request |
| Messages and ratings sent to the Kwoji team | 24 months, then deleted automatically; deleted with your account |
Emails we send you
Most of our emails answer something you did: you asked for a sign-in link, your organization invited you, your subscription changed. Three email categories are the exception, and we flag them here precisely because nobody asked for them.
The weekly recap is a summary of your organization's week (games played, most popular games, records broken), sent on Monday morning. It only goes out if an administrator of your organization has enabled it. The setting is off by default, and it sells nothing.
You can opt out at any time, and that decision is yours alone: neither your employer nor your administrator can make it, or undo it, on your behalf. Three equivalent routes: the "Weekly recap" toggle in your profile, the unsubscribe link in every message (it works without even signing in), or the "Unsubscribe" button your email client shows on its own. It takes effect immediately.
The Kwoji Pulse eNPS question goes out once per quarter, if your organization has turned Pulse on (off by default). One question, one button, no pressure: not answering is also fine, with no consequence. You can unsubscribe at any time through the link in every message or the button your email client shows on its own; it is a separate consent from the weekly recap, each one is given and withdrawn on its own.
Kwoji product updates are occasional messages about significant changes to the product. Every message includes its own unsubscribe link. This choice is separate from the weekly recap and Pulse. As an extra precaution, Kwoji does not send a product update to anyone who has already opted out of any of these three non-transactional email categories.
Every message goes to your address alone: your colleagues' addresses never appear in it.
Scheduled-game invitations are not Kwoji emails: Google sends them from the host's calendar only to the colleagues they selected.
Sub-processors
We neither sell nor rent any data. Our technical sub-processors:
- Supabase, Inc.: database, authentication, image storage (region: Ireland (European Union)).
- Cloudflare, Inc.: site hosting, real-time game server and cookieless audience measurement.
- Cloudflare, Inc. (RealtimeKit): voice and video for Kwoji Live, when your organization turns the feature on (it is off by default). Audio and video streams travel through its real-time infrastructure during the game; they are not recorded, neither by Kwoji nor on its behalf. You join a room voluntarily, with microphone and camera off. Kwoji sends it your account identifier only; your name and photo are displayed by your browser. Real-time media has no guaranteed location inside the European Union: streams may travel through servers outside the EU, a transfer covered by the European Commission's Standard Contractual Clauses and by Cloudflare's certification under the Data Privacy Framework.
- Scaleway SAS: AI features (Mistral model), when your organization turns them on with a single setting (it is off by default), for three uses described here (the Kwoji Verita referee, for its part, is part of the game and has its own line below). Kwoji Pulse wave summaries: it receives the aggregated results already shown to administrators, never below the anonymity threshold, including those of managers' scopes with the manager's name, and the text of the wave's anonymous comments exactly as it was written, names included; Kwoji keeps the summary, not what was sent. The context sentence of an alert: it receives only the aggregated results already shown for that alert, never below the anonymity threshold, with the manager's name for their scope, and no individual answer or comment, and picks the suggested action from a fixed list; Kwoji keeps the sentence and the action, not what was sent. Answers from the Galaxy's mascot: it receives the question asked by an administrator, exactly as written, and the aggregated results by group that the Galaxy already shows them, never below the anonymity threshold, with the names of managers that the Galaxy shows, and no individual answer or comment; Kwoji keeps neither the question nor the answer. Processing takes place in France (Paris region), with no transfer outside the European Union. According to its terms, Scaleway does not keep this content and does not use it to train a model, except for a request causing an abnormal error, kept for at most two weeks for diagnosis.
- Resend, Inc.: sending of our emails: subscription messages, invitations sent by your organization, weekly recaps, Kwoji Pulse eNPS questions and product updates.
- Stripe Payments Europe, Ltd. (Dublin, Ireland): payment and billing of subscriptions. The card number is entered at Stripe and never reaches us; we transmit to it the billing email, the company name, the address and the VAT number of the organization.
- Google LLC, if you choose the "Continue with Google" sign-in: Google transmits to us your email, your name and your profile photo.
- Google Ireland Limited, if you voluntarily connect Google Calendar to schedule a game: Kwoji sends it the title, the time slot and the selected colleagues' addresses (up to 500). Google creates the Meet link and sends invitations and reminders. To suggest a common time, Kwoji reads anonymous busy and free intervals only, never an event's title, attendees, location or content. Those intervals are not stored, and you may disconnect the calendar at any time.
- Functional Software, Inc. (Sentry): detection of technical errors. Error reports are hosted in the European Union and contain neither identity, nor IP address, nor game content, only technical data (error message, page, browser).
- PostHog, Inc.: cookieless audience and usage measurement, when enabled. Kwoji sends it no name, email, account or organization ID, room code, score, or game content. Data is hosted in the European Union (Frankfurt) and the IP address is not retained; any transfers are governed by its data processing agreement.
- Scaleway SAS (Paris, France), for the Kwoji Verita referee, which is part of the game in every organization, with no setting: once a round's writing closes, a Mistral model judges whether a bluff actually tells the truth. It receives the question (the name of the person being asked is replaced with a neutral first name), the true answer and one bluff, as they were written, with no account or game identifier; a name written in one of these texts, a colleague's for instance, is sent as is. Kwoji keeps nothing of this exchange; Scaleway does not use it to train a model and does not keep it, except a request that caused an error, kept two weeks at most for diagnosis. Hosted in France (Paris region), with no transfer outside the European Union.
Some of these providers are US companies: transfers are governed by their data processing agreements (standard contractual clauses of the European Commission and, where applicable, certification under the Data Privacy Framework).
Google user data
This section describes precisely what happens to the data Kwoji receives from Google APIs, when you choose "Continue with Google" or connect Google Calendar.
What we receive. Through Google sign-in: your email address, your name and your profile photo. Through the Google Calendar connection (the "calendar.events" scope, event writing only, and the "calendar.freebusy" scope, availability reading only): an OAuth authorization token, the email address of the connected Google account and, at the moment an organizer sets up a game, anonymous "busy / free" intervals used to suggest a common time slot. Kwoji never reads the content of your calendar: not the title, the attendees or the location of any event, nor your emails. Those intervals are not stored: they are used to compute the suggestion, then discarded.
Sharing, transfer and disclosure. We do not share, transfer or disclose Google user data to anyone, with three exceptions:
- our technical hosting providers listed in the "Sub-processors" section (Supabase, Inc. and Cloudflare, Inc.), which store and process this data on our behalf and under contract, with no right to use it for themselves;
- if the law requires it (judicial requisition or legal obligation);
- with your explicit consent, in any other case that might one day be offered.
We never sell this data, we do not transmit it to any advertising network or data broker, we do not use it for advertising, and we do not use it to develop, improve or train artificial intelligence or machine learning models.
Kwoji's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Protection of sensitive data. The Google authorization token is the most sensitive data we hold: whoever possesses it can write to your calendar. It is protected by dedicated mechanisms:
- encryption in transit: all communications (browser, servers, Google APIs) go exclusively over HTTPS/TLS;
- encryption at rest: the database storing it is encrypted;
- strict compartmentalization: the token lives in a private schema of the database, unreachable from the application and from any public API; only our billing server, holder of a service key, can read it. It never travels to a browser and is never included in your data export;
- access control: the OAuth connection flow is protected by a cryptographically signed, time-limited state, which prevents a third party from attaching their calendar to your account;
- revocation: disconnecting Google Calendar from your profile, or deleting your account, deletes the token immediately; you can also revoke Kwoji's access at any time from your Google account security settings.
Cookies and local storage
Kwoji uses no tracking cookie or advertising tracker, and therefore does not display a consent banner. The browser retains only information strictly necessary for operation, in local storage:
- your sign-in session (authentication token);
- technical keys
kwoji-*: pending invitation, game link, current room;
Audience measurement (Cloudflare Web Analytics and PostHog when enabled) works without a tracking cookie. PostHog runs in cookieless mode: it sets no cookie or local storage and creates no person profile. It uses technical signals such as the IP address, browser and domain to produce a server-side pseudonymous identifier whose salt changes every day; it therefore does not link the same browser across days or domains. URLs containing a fragment, free-form parameter, or invitation, game or authentication secret are not sent to it; only the closed language and sign-up/sign-in mode choices are allowed. Kwoji goals contain no identity data.
Your rights
In accordance with the GDPR, you have the rights of access, rectification, erasure, portability, restriction and objection. Most are exercised directly within the platform:
- Rectification: display name and profile photo can be changed at any time from your profile;
- Erasure: the "Delete my account" button in your profile immediately and permanently deletes all your data; "Leave the organization" erases your data within that organization;
- Access and portability: the "Download my data" button in your profile produces a complete copy of your data in JSON format, immediately.
For any other request: contact@kwoji.com. You may also lodge a complaint with the CNIL (cnil.fr).