Privacy Policy

Information we collect

When you create an Anvil account, we collect your email address, a username, and a password that we store as a secure hash. If you sign in with Google instead, we store your Google account ID and the name and email Google shares with us; we never see your Google password. As you use the app, we save your quiz progress, streaks, XP, and badges, along with any interests, avatar, and profile details you add. Messages you send to support and reviews you post are stored as well.

Cookies and advertising

Anvil uses one essential cookie to keep you signed in. That cookie is not used for advertising or for tracking you across other sites. Anvil also shows ads served through Google AdSense. Google and its advertising partners may use cookies and similar technology to serve ads and measure how well they perform, including personalized ads based on your activity on this and other sites. You can review or adjust how Google personalizes ads for you at Google Ads Settings, and you can learn more about how Google uses information from sites that use its services on this page. You can also opt out of personalized advertising generally at www.aboutads.info. Visitors in the EU, UK, and Switzerland see a consent banner and can decline non-essential cookies before any ad personalization cookies are set.

Security and log data

To protect accounts from abuse, we keep a security log of events such as sign-in attempts, password changes, blocked or rate-limited requests, and requests for pages that do not exist. Each entry records what happened, when, the browser's user-agent string, the address requested, and — where relevant — which account was involved. We do not store your full IP address in these logs: we store a one-way salted hash of it, which lets us tell repeat activity apart without keeping the address itself, alongside a shortened version of your network (for example 203.0.113.0/24). We also keep a record of account emails we send, including the type of email, whether it was delivered, and a masked form of the recipient address. Security log entries are deleted automatically after 90 days.

How we use your information

We use the information above to run Anvil: signing you in, saving your progress, showing leaderboards, sending account emails such as verification and password reset messages, responding to support requests, and improving the app. We do not sell your personal information to third parties.

Who we share information with

We share information with the service providers that help us run Anvil, including our email delivery provider, Google (for Sign-In and for ads), and our hosting and security providers. We may also disclose information if required by law or to protect the safety of our users.

Data retention and your choices

You can update your profile, interests, and language at any time from Settings. You can also delete your account from Settings; doing so removes your profile, progress, and personal information from our systems. Some records, such as anonymized aggregate statistics, may be kept after deletion.

Children's privacy

Anvil is not directed at children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has created an account without appropriate consent, contact us through the Support page and we will remove the account.

Changes to this policy

We may update this policy as Anvil changes. If we make a material change, we will update the date on this page and let active users know inside the app.

Contact us

If you have questions about this policy, reach us through the Support page in the app.