Zilleh LLC ("we", "us", "our") operates the Zilleh daily quiz challenge app. Our contact email is zillehsupport@gmail.com.
Account data — when you sign in with Google we receive your display name, email address, and profile photo from Google.
Quiz performance data — points earned, quiz scores, answer timestamps, accuracy statistics, challenge history, and leaderboard ranking.
Device & security data — device identifier (fingerprint), operating system, app version, and emulator/root detection status. Collected to protect competition integrity.
Push notification token — Firebase Cloud Messaging (FCM) token to send you daily challenge reminders. You can disable notifications at any time in your device settings.
Log data — IP address and request timestamps logged automatically by Firebase for security and abuse prevention. Retained for 90 days.
- Operate the daily quiz competition and calculate leaderboard rankings.
- Prevent cheating: server-side scoring only; emulator and rooted device blocking; screen capture prevention; answer-time validation.
- Send daily challenge reminder notifications (you can opt out anytime).
- Analyse aggregate usage patterns to improve the app.
- Respond to support requests and legal obligations.
If you are in the European Economic Area (EEA), UK, or Switzerland, we process your data under the following legal bases:
- Contract — to provide the quiz competition service you signed up for.
- Legitimate interests — fraud and cheat prevention, app security, aggregate analytics.
- Legal obligation — complying with applicable laws and responding to lawful requests.
To run your wallet and pay out winnings we collect and retain:
- Your StepCoin balance and its full transaction history — purchases, subscription, entry fees and prizes.
- Purchase records from our payment processor (Stripe): the payment identifier, the amount paid and its date.
- When you request a withdrawal: the payout method you choose and the account details you enter (bank IBAN, PayPal email or Wise account) together with the account holder name.
We never receive or store your card details at any point — Stripe handles those directly.
This data is used solely to run your wallet, process purchases, pay out withdrawals, and meet accounting and anti-fraud obligations. Transaction and payout records are kept for as long as accounting requirements and dispute resolution demand.
We do not sell your personal data. We share data only with:
- Google Firebase (Authentication, Firestore, Cloud Functions, Cloud Messaging) — backend infrastructure. Data stored in europe-west1 (Belgium, EU).
- Law enforcement — if required by a valid legal order or to protect our legal rights.
Your partially masked username and leaderboard rank are visible to other users inside the app.
- Account & quiz data — retained for as long as your account is active.
- Deleted accounts — all personal data permanently erased within 30 days of deletion.
- Log & security records — retained for 90 days then automatically deleted.
- Legal holds — data may be retained longer if required by law or ongoing legal proceedings.
- All data transmitted over HTTPS/TLS encryption.
- Firestore security rules restrict access to authenticated users only.
- All scoring is server-side only — clients cannot modify points.
- Firebase App Check verifies request authenticity and blocks fraudulent calls.
- The app blocks emulators and rooted/jailbroken devices.
- Screen recording is prevented inside the app (FLAG_SECURE on Android).
Depending on your location you may have the following rights:
- Access — request a copy of the data we hold about you.
- Correction — ask us to correct inaccurate data.
- Erasure — request deletion of your account and all associated data (processed within 30 days).
- Portability — receive your data in a structured, machine-readable format.
- Restriction — ask us to stop processing your data in certain circumstances.
- Objection — object to processing based on legitimate interests.
- Withdraw consent — withdraw your consent to personalised ads at any time.
To exercise any right, email us at zillehsupport@gmail.com. We will respond within 30 days. To delete your account, see the Delete Account page.
EEA residents may lodge a complaint with their local data protection authority.
California residents have the right to know what personal information we collect, to request deletion, and to opt out of any "sale" or "sharing" of personal information. We do not sell or share personal data for cross-context behavioural advertising. To exercise your rights contact us at zillehsupport@gmail.com.
Zilleh is intended for users aged 13 and older. We do not knowingly collect personal information from children under 13. If you are under 13, do not use this app. If we learn that we have inadvertently collected data from a child under 13, we will delete it immediately upon becoming aware. Contact us at zillehsupport@gmail.com to report such cases.
Your data is stored and processed on Google Firebase servers in the europe-west1 region (Belgium, EU). Google provides appropriate transfer safeguards through Standard Contractual Clauses (SCCs).
We may update this policy from time to time. Material changes will be announced via in-app notification at least 7 days before taking effect. Continued use of the app after changes take effect constitutes acceptance of the updated policy.