Privacy, in plain words

Written for teachers and the person at school who has to approve new websites. Versed Play is a live quiz game that needs nothing from your students: no accounts, no logins, no app. Here is exactly what it keeps, for how long, and how to get anything removed.

Last updated 9 September 2026 · applies to play.versedapps.com

What we store What we never do Where it lives GDPR, COPPA, FERPA, PDPA Getting something removed For school IT Contact

The short version

Nobody signs up. Students type a name of their choice; it disappears with the game.
A game room lives in memory for at most 6 hours after the last activity, then it is gone.
The host's slides never leave the host's own browser.
No analytics, no trackers, no ad network, no third-party scripts. One first-party cookie, versed_id, described below. Nothing is sold, ever.
Free to use, and the parts a class needs stay free.

What Play stores, and for how long

A game roomThe 4-letter code, the names players typed, their scores and answers, the host's list of questions and settings, and the buzz order. It runs in memory on one small server object while the game is on. Slides are not part of it.Gone 6 hours after the last activity, or as soon as the host ends the game

Slides and photosRendered and cached in the host's own browser (IndexedDB). They are never uploaded anywhere. A PDF the host drops in is opened by the host's computer, not by us.On the host's device only, until they clear it

The libraryTrivia, quizzes and live games that a host chooses to post: the title, the author name they typed (or "Anonymous"), the questions, answers and any picture credits. Library items are public by design and anyone can report one.Until removed: three reports hide it, or email us

Daily 5Counts: how many people played each day's five and how the scores were spread. Per device (by its Versed ID, below): the answers picked that day, so the five can be marked on the server and played once.Counts kept as aggregates; a device's answers for 3 days

Versed ID and coinsA random device id (32 hex characters, nothing personal in it) issued the first time a browser opens a page, and a coin wallet under it: the coin count, the last 50 things that earned coins (source and date), a Daily 5 streak, and the answers of official trivia played that day. Coins are for room themes and pets in Versed Study. No name, email or IP address is attached to the id.Wallet kept while it is used; answer records 1–3 days. Clear site data (or email us the id) to start over

Duels ("beat my score")The name the challenger typed, their score and per-question times, and the same for friends who try the challenge.7 days, then deleted automatically

Picture searchWhen a host searches for a licensed picture, the search words and the results (from Openverse, limited to museums, libraries, NASA and other institutional collections, with adult content excluded and a word filter on the search and the results) are cached so the next host with the same search gets a quick answer. Nothing records who searched. Anyone can report a picture on a question; two reports from different people remove it until we have looked.Cache expires after 1 day

Abuse limitsTo stop someone posting or reporting thousands of times, a few endpoints count requests per connection address. The address is hashed with a secret salt first, so the count cannot be turned back into an address.Counters expire within 1 hour (report votes: 7 days)

On the host's devicelocalStorage and IndexedDB in the host's browser: saved games, the slides cache, the current draft, the last author name, and small preferences like "I have seen the guide".Until the host clears site data

On a player's devicelocalStorage in the player's browser: the last name they typed (so it is pre-filled next time), a seat token for the game they are in (so a refresh rejoins), their Daily 5 streak, and a copy of the Versed ID.Until they clear site data; seat tokens are useless once the room is gone

Server logs: Cloudflare keeps standard request logs for a short period for security and debugging. We do not build profiles from them and we do not add analytics of our own.

What Play never does

No accounts, for anyone. Hosts and players alike. There is no "Sign in with Google", no email sign-up, no password to forget.
One cookie, and it is ours. versed_id holds the random device id above so play.versedapps.com and study.versedapps.com see the same coins. It is set for one year on .versedapps.com only, carries no personal data, and is never sent anywhere else. Everything else kept on a device is the localStorage listed above, which never leaves that device.
No third-party scripts. No analytics, no tag managers, no social buttons, no ad network. The credit strip at the bottom of each page is plain text we place ourselves. The only third-party request a page makes is for the two typefaces (Google Fonts).
No selling, sharing or renting of data. There is nothing worth selling and we would not do it anyway.
No pictures uploaded. Pictures on trivia questions come from Openverse under open licences, from a fixed list of museums, libraries and public collections only (no Wikimedia Commons, no Flickr), with adult content excluded and a word filter on searches and results. Every picture shows the creator's credit and can be reported. We only ever store a link to the picture's thumbnail and its credit.
No reading of the host's files. Slides are rendered by the host's browser. We could not see them even if we wanted to.

Where it lives

Play runs on Cloudflare: a Worker for the pages, one Durable Object per game room (that is the "small server object" above), and a key-value store for the library, Daily 5 counts, duels and caches. A room runs in the Cloudflare location nearest the host; there is no central database of games and no backups of rooms, because rooms are meant to vanish.

Versed is a one-person project. Nobody else has access to any of this.

GDPR, COPPA, FERPA and PDPA, in plain words

We are not lawyers, and this is not legal advice for your school. It is an honest account of how Play lines up with the rules people ask about most.

GDPR (EU and UK)

The only personal data Play processes is the name a player types, and it exists only inside a room for at most 6 hours. We use it for one purpose: running the game you asked for (legitimate interest). We never identify anyone, never profile, never share. If you want anything removed or want to know what we hold, email us; there will almost certainly be nothing left to find.

COPPA (US, under-13s)

Play collects no personal information from children: no accounts, no email, no persistent identifier used for tracking, no location. A teacher can host a game for a class of under-13s without the site collecting anything from them. We suggest students join with a first name or nickname, and the host can remove any name from the lobby at once.

FERPA (US, education records)

Play does not hold education records. Scores exist inside the room for its lifetime; the teacher may download a results CSV to their own computer at the end, and that file is theirs. We keep no copy. The library only ever contains questions a host chose to publish, never results.

PDPA (Singapore)

Same picture: the least data possible, one clear purpose, deleted quickly, never sold or transferred. Requests about personal data go to hello@versedapps.com and are answered by the person who runs the site.

Getting something removed

A game room

The host presses End game and the room is wiped at once. Left alone, it wipes itself 6 hours after the last activity. A host can also remove a single player from the lobby (the players panel, the small x by a name).

A library item

Every library card and quiz page has a Report button. Three reports from different people hide the item until we look. For anything urgent, or if it is your own item and you want it gone, email the link to hello@versedapps.com; it comes down the same day.

A duel

Duels delete themselves after 7 days. Email us the /d/CODE link to remove one sooner.

Your own device

Clear site data for play.versedapps.com in your browser. That removes saved games, the slides cache, your remembered name, your Daily 5 streak and your Versed ID (a new one is issued next visit; the old wallet stays on the server until you email us its id).

For school IT

Allow play.versedapps.com over HTTPS (443). Games use a WebSocket on the same host (wss://play.versedapps.com/api/rooms/…).
Typefaces load from fonts.googleapis.com and fonts.gstatic.com. If those are blocked the site still works in a system font.
Only when a host adds pictures to trivia: thumbnails from api.openverse.org. Players' phones fetch those thumbnails directly.
Nothing to install, no browser extension, no app store. Any modern browser on any device works; the host's screen is just a web page you project.
Phone-free option: a game can run entirely on the big screen with teams and one shared buzzer device (/buzz), so it works in classrooms where student phones are not allowed.
Related products with their own pages: Versed Study and Versed Teach.

Questions, or something to remove?
Email hello@versedapps.com. A person reads it, usually the same day.

Email us