Last updated: 28 October 2026
Zip Blitz is a daily trivia game operated by Modern Labs LTD, a company registered in England and Wales. Each day has five speed-quiz rounds that get progressively harder, with daily and all-time leaderboards, live head-to-head multiplayer, friends, and streaks. This policy explains what data we collect, why, and how you can control it.
When you first open Zip Blitz, we create an anonymous account for you automatically. This is a pseudonymous identifier — it is not linked to your name or email, and you don't have to do anything to set it up. It lets the game save your progress, record gameplay analytics, and (on the mobile app) register for notifications even before you choose to sign in. Your game results are also stored locally on your device. When you later sign in, this anonymous account is upgraded in place to your real account, so nothing you've played is lost.
When you create an account we store:
You can sign in with Google, Apple, or a magic link sent to your email. When you use Google or Apple sign-in, we receive your name and email address from those services and, from Google, your profile photo. We do not access your contacts, calendar, or any other data from your Google or Apple account.
We use your data to:
We may share data with the service providers and partners described in this policy (such as our hosting, analytics, error-monitoring, subscription, and — where applicable — advertising partners) so they can perform these functions on our behalf. We will always handle your data in line with this policy and applicable law, and we will update this policy before introducing any materially new use of your data.
We may use the information we hold about you and your play in marketing and promotional material for Zip Blitz, in any medium and anywhere in the world. That includes your name, profile picture, scores, results, leaderboard positions, streaks, multiplayer results, league activity and other gameplay and usage data. It may appear on our website (for example a live leaderboard or a "recent games" feed), in the App Store and other app listings, on social media, in advertisements, in emails and newsletters, in press material, and in screenshots and videos of the app. We may also use aggregated or anonymized data — such as how many people played, or how a question was answered — for the same purposes.
We will never publish your email address, payment details or IP address. You don't need to do anything for us to use your information this way, and we don't pay for it. If you would rather not appear in our marketing, email us and we will stop using your name and picture in new material. Deleting your account also removes you from anything we create afterwards. Material that has already been published, printed or shared may stay in circulation. Our lawful basis is our legitimate interest in promoting Zip Blitz.
The friends feature lets you add other players and see how you rank against them on the daily leaderboard. A friendship is mutual — both players must accept before either can see the other in their friends view. We store each accepted connection as a record linking the two account IDs. You can remove a friend at any time from their profile, which immediately deletes the connection from our servers.
When you share your profile link with someone, it opens your public profile page where they can choose to send a friend request. We do not notify anyone outside the app or share your link with third parties.
Zip Blitz Plus is an optional paid subscription. You can buy it on this website or in the iOS app. Either way, we never see or store your card details, billing address, or any other payment information — the payment provider handles all of it and tells us only whether your subscription is active.
On this website, payments are processed by Paddle.com Market Ltd, which acts as our merchant of record: Paddle sells you the subscription, takes the payment, handles tax and issues your receipt. Paddle receives the email address and billing details you give it at checkout, and is the data controller for that payment information — see Paddle's privacy notice. We send Paddle a pseudonymous account identifier so the resulting subscription can be attached to your account, and Paddle tells us the subscription's status. You can manage or cancel at any time from the menu → Settings → Manage subscription, which opens Paddle's portal.
In the iOS app, payments are processed by Apple through your App Store account, and Apple shares with us only whether your subscription is active. We use RevenueCat to manage that subscription status. RevenueCat acts as our data processor and receives a pseudonymous account identifier plus the subscription state Apple reports, so the app knows whether to unlock Plus features. RevenueCat does not receive your payment details either. You can manage or cancel an App Store subscription at any time in iOS Settings → Apple ID → Subscriptions.
We keep a record of the subscription events our payment providers send us — what changed, when, and the provider's own reference — so we can answer billing questions and investigate problems. These records contain no card details.
Our Terms of Service and Refund policy set out what you are buying and how to get your money back.
On the iOS app you can choose to receive push notifications — for example, a daily reminder when the new quiz goes live, a nudge when your streak is at risk, or an alert when a friend challenges you. If you enable them, we store a device notification token (provided by Apple Push Notification service), your time zone, and your preferred send time so reminders arrive at a sensible local hour. You can turn notifications off at any time in the app's Notifications settings or in iOS Settings, which stops any further messages.
Your data is stored on Supabase, a cloud database platform. Supabase acts as our data processor and stores data in secure, encrypted infrastructure. Profile pictures are stored in Supabase Storage.
We use Mixpanel to understand how the game is used in aggregate — for example, how many people start and finish a round, which features are popular, and how the app performs over time. Mixpanel records product events (such as "round started", "round completed", or "subscription started") tied to a pseudonymous identifier, plus basic context like your platform and app version. It does not record your individual quiz answers beyond these aggregate gameplay events, and we configure it not to collect sensitive personal data. Mixpanel acts as our data processor, stores data on EU-based infrastructure, and processes it only on our behalf. We use this for product improvement under our legitimate interest, not for advertising.
Website analytics. On our website's homepage and topic pages — not in the app, and not on the pages where you play — we also use Google Analytics, provided by Google, to understand how people find those pages: for example which search engine or website sent a visit, which pages were viewed, the general region a visit came from, the type of device and browser, and whether a visitor went on to play or to the App Store. Google Analytics sets first-party cookies (named “_ga” and “_ga_” followed by an ID) holding a random identifier for your browser. Google receives your IP address in order to estimate the region and says it does not store it. We do not send Google your name, email address, account identifier or anything about your games, and we have not enabled advertising features or Google Signals. Google processes this data on our behalf and may do so outside the UK, including in the United States, under the safeguards in its data processing terms. We keep this data for 14 months. You can block these cookies in your browser settings, or use Google's opt-out browser add-on. Our lawful basis is our legitimate interest in understanding how people discover Zip Blitz.
Where a visit came from. If you arrive on our website through a link that names a source (for example a link from a partner site or an article, which carries a short label such as “utm_source=…”), or from another website, we remember that label in your browser's local storage for 30 days, so that we can tell which link a later visit, sign-up or install came from. It is only a short label (the partner or site name, how the link was shared and, if given, the piece it appeared in) — never the full address you came from or any query string. The first source wins and later ones do not overwrite it. We attach it to our analytics events (Mixpanel and, on the homepage and topic pages, Google Analytics) and, if you create an account, store it once alongside your account so we can count sign-ups by source. If you tap the App Store button, the campaign name in that link also includes the label, so that Apple's App Store Connect can count installs by source. Our lawful basis is our legitimate interest in understanding which of our partners and publications bring people to Zip Blitz. You can clear this at any time by clearing your browser's site data.
Your first page, and who shared the link. The first time you open our website, we also note which of our own pages you arrived on (for example a topic page), the name of the website that linked you there (only its domain, such as google.com, never the page or anything you searched for) and, if the link carried them, two further short labels describing the link. If you arrived through a link another player shared from the app, the link carries that player's account identifier, and we remember it for 30 days. If you go on to play, we store these once alongside your account, so that we can tell which pages bring people to Zip Blitz and thank players whose shares brought friends in. We never store a query string or the address of the page that linked you. Our lawful basis is our legitimate interest in understanding how people find Zip Blitz. You can clear this at any time by clearing your browser's site data.
We use Sentry to automatically capture JavaScript errors and crashes. When an error occurs, Sentry records information about what went wrong — including the error message, the page you were on, and a sequence of recent in-app events (such as which screens you visited). To help us diagnose bugs and confusing flows, Sentry also captures a privacy-masked session replay — a reconstruction of on-screen layout and interactions for a sample of sessions and for sessions where an error occurs. This replay is masked by default: it does not capture the text you read or type, your name, email, or images. Sentry does not record your quiz answers or any sensitive personal data. Your user ID may be included to help us reproduce account-specific bugs. Sentry acts as our data processor and processes this data only on our behalf.
When you play a multiplayer (Versus) game, we log structured events to our database — such as when a match started, when you finished, and the result. These logs are used solely for debugging match timing and fairness issues. They are automatically deleted after 7 days.
To keep leaderboards fair and protect the service from abuse, when you play we record the IP address your device connects from, alongside your account identifier and the times we saw it. We use this only to detect and investigate fraud and abuse — for example, one person creating multiple accounts to manipulate a leaderboard — and to keep the service secure. We do not use it for advertising or to track you across other websites. This information is access-restricted, automatically deleted after 1 year, and removed immediately if you delete your account. When a new account is created, including the guest account the app makes when you first open it, we also record the IP address it came from and the time, so that we can limit how many accounts one network can create and spot automated sign-ups. That record is access-restricted and deleted automatically after 30 days. Our lawful basis is our legitimate interest in preventing fraud and securing the service.
When you open a link someone shared with you — an invitation to a league, a challenge or a topic, or a player's link to Zip Blitz itself — and you do not yet have the app, we briefly record the IP address your device connects from alongside the link you opened. If the app is installed and first opened from the same network within the next hour, it uses this to continue to the league, challenge or topic you were invited to, instead of starting on a generic home screen, and to note which player's share brought you (see “Your first page, and who shared the link” above). These records contain no account identifier and are not linked to your identity; they cannot be read by the app or the website, and the IP address is deleted automatically within two days. We keep, indefinitely, a separate anonymous record that the link was opened — which invitation it was, who had shared it, the date, the country, and whether the app was then installed — so that we can understand whether invitations are working. That record contains no IP address and nothing that identifies you or your device, and it cannot be traced back to you. Our lawful basis for both is our legitimate interest in making an invitation you chose to open work as you expected, and in understanding whether our invitations reach people.
If you reached our website through a link that named a source (see “Where a visit came from” above) and then tap the App Store button, we briefly record that source label together with the IP address your device connects from and the time. If the app is installed and first opened from the same network within the next hour, the app asks for it and keeps the label with your account, so we can count installs and sign-ups by source. This does nothing else: it does not unlock anything, link you to any other record, and it only happens for a first launch on a device with no history in the app. Visitors who arrive without a named source, or who do not tap the App Store button, are not recorded. The record with the IP address contains no account identifier, cannot be read by the app or the website, and the IP address is deleted automatically within two days. We keep, indefinitely, a separate anonymous record of the source label and the dates a store button was tapped and an install was matched; it contains no IP address and nothing that identifies you or your device. The match is approximate (it relies on the same network), so it can occasionally attach a source to the wrong person, and it misses installs made from a different network; we use it only for aggregate counts. Our lawful basis is our legitimate interest in understanding which partners bring people to Zip Blitz.
We advertise Zip Blitz on Facebook and Instagram, which are run by Meta Platforms Ireland Limited ("Meta"). To learn which of our ads bring new players, and to help Meta show them to people likely to enjoy Zip Blitz, the iOS app includes Meta's software development kit (SDK). Our website does not.
What Meta receives. The SDK tells Meta when the app is opened, when you finish your first round and when you create an account. When you start a free trial or a subscription in the iOS app, RevenueCat tells Meta that it happened and what it cost. With these events Meta receives an identifier that its SDK creates for your copy of the app, your device's model and operating-system version, the app's version and your IP address. We never send Meta your name, email address, scores, answers or anything else about how you play.
No tracking. Zip Blitz does not ask to track you, and Meta never receives your device's advertising identifier from us. Meta says that, without that permission, it uses these events only in aggregated, privacy-preserving ways to measure how ads perform, and does not use them to link you to your Facebook or Instagram account. Separately, Apple's own install measurement (SKAdNetwork) lets Meta count that an install came from one of our ads without identifying you.
Meta's role. Meta processes this data under its Business Tools Terms, and is responsible for its own use of it, as described in Meta's Privacy Policy. Meta may process it outside the UK. Our lawful basis is our legitimate interest in measuring and improving our advertising.
We use your browser's local storage to save your game state, results, session token, the identifiers used by our analytics and error-monitoring providers, and the 30-day source label described above. Some of this information — for example your gameplay results and analytics events — is associated with the anonymous or signed-in account described above and sent to our servers and processors. On our homepage and topic pages, Google Analytics also sets the analytics cookies described under Analytics above; they measure visits and are not used for advertising. Our website does not use advertising cookies. In the iOS app, Meta's SDK keeps the identifier described under "Advertising on Facebook and Instagram" on your device.
Under UK GDPR, we process your data on the following bases:
You have the right to:
Your data is kept for as long as your account exists. When you delete your account, all your data (profile, game results, leaderboard entries, friends connections, notification preferences, and device tokens) is permanently removed from our servers. Deleting your account does not cancel an active App Store subscription — manage that in iOS Settings → Apple ID → Subscriptions. Multiplayer event logs are deleted automatically after 7 days regardless of account status, IP addresses recorded for security and fraud prevention are deleted after 1 year (30 days for the record made when an account is created), and Google Analytics data about website visits is deleted after 14 months.
Zip Blitz is a general-audience game. We do not knowingly collect data from children under 13. If you believe a child has provided us with personal data, please contact us.
We may update this policy from time to time. The "Last updated" date at the top will reflect the most recent version.
If you have questions about this policy or your data, contact Modern Labs LTD at hello@modern-labs.co.uk.