Privacy Policy — QuizMaxx
Last updated: 26 September 2026 · Contact: support@quizmaxx.app · Controller: Raj Contractor, trading as QuizMaxx, 185 Kennington Road, London, SE11 6ST
The short version
QuizMaxx works without an account, and without one it holds nothing about you — no cookie, no identifier, no tracking, and no record anywhere of what you study. Everything you learn is stored in your own browser and stays there. The one thing that leaves it is a typed answer the app cannot mark by itself: while online marking is on — it is unless you switch it off — the question, its answer and what you typed are sent to be marked, with nothing that identifies you, and nobody keeps them. The only thing this site counts is that a page was opened, and it counts that without knowing who opened it.
If you create an account, we store your email address and a copy of your study progress so it can sync between your devices. You can sign in with an email address or with your Google account; choosing Google tells us your email address, name and profile picture and nothing more, and is only ever used to know which account is yours.
Nothing in QuizMaxx is sold. If you leave a tip, our payment provider takes it on its own page — we never see your card details, and the app keeps no record of who gave.
We do not sell your data, show adverts, or share anything with anyone except the suppliers listed below, who are necessary to run the service.
Without an account
Your schedule, answers, streak and settings live in localStorage on your device. We cannot see them. If you clear your browser data they are gone, which is why the app offers an export.
One thing leaves your browser, and only while online marking is on (Settings → Online marking switches it off). When you type an answer the app cannot mark by itself — usually a right answer in other words, or a wrong one it cannot rule out — the question, the card's answer and what you typed go to our server, which asks a marking model whether a fair quizmaster would accept it. Nothing that identifies you goes with them: no account, no identifier, no cookie. Like any web request it comes from your internet address, which our host sees in passing as any web server does; we do not record it. We keep no copy of the question or of what you typed. All we keep is a running count of how many answers signed-out visitors have had marked that day, all together, because the service has a daily limit. The model is named under "Who else processes it".
Two things are still fetched from third parties when you use those features, and those parties may log the request as any web server does:
- Google Fonts — the app's typefaces. It falls back to system fonts offline.
- Apple and Deezer CDNs — 30-second music previews, streamed when you play a music round.
- Cloudflare Web Analytics, if this deployment has it on — a page-view count, with no cookie and no identifier. See "Who else processes it".
With an account
| What | Why | Lawful basis |
|---|---|---|
| Email address | To identify your account, send sign-in links and, if you ask for it, the weekly digest | Performance of a contract |
| Password (hashed) | To sign you in. Stored hashed by our auth provider; never in plain text | Performance of a contract |
| How you sign in — a password, or your Google account | To sign you in the way you chose. If you use Sign in with Google, Google tells us your email address, your name and your profile picture if you have one, and confirms the address is yours. We ask for nothing else, we do not read anything else in your Google account, and we never post anything to it | Performance of a contract |
| Your progress blob | So your study history syncs between devices | Performance of a contract |
| The dates you opened the app while signed in | To know whether people who sign up are still here a month later, which is how we judge whether the app is worth building | Legitimate interests |
| "Where did you hear about QuizMaxx?", if you chose to answer it | To know which ways of telling people about it are worth continuing | Consent — the field is optional and blank by default |
| Whether you made your account in the app or on the web | To know whether people who arrive from an app store stay as long as people who arrive from the web, which is how we judge whether the store is worth the work | Legitimate interests |
| A bug report or idea you send us, and the technical details attached to it | To fix what you reported and reply to you | Legitimate interests |
The progress blob is the same data the "Export a backup" button produces: schedules, answer counts, streaks, quiz-night notes and settings. It contains whatever you typed into the app — if you logged a quiz night with a venue name, that is in there.
The dates are dates and nothing else — one per day you opened the app, with no time, no page, no device and nothing about what you studied. They exist to answer one question in aggregate ("of the people who signed up in March, how many were still opening it in April?") and they cannot reconstruct a visit. If you are not signed in, nothing is recorded at all.
A bug report is only ever sent when you press Send. The technical details it can carry are shown to you in full, in the message itself, before it goes: which build of the app you are running, your browser and window size, your settings, and how many items you have scheduled. Never a card, a deck, a question or an answer — nothing about what you study. You can untick them and send the message alone, and if you would rather not use the form at all, email <support@quizmaxx.app> instead.
Who else processes it
- Supabase — hosts the database and handles authentication. Your data is stored in the European Union (Frankfurt,
eu-central-1). - Google — only if you choose to sign in with Google. Signing in that way tells Google you are signing in to QuizMaxx, and returns your email address, your name and your profile picture to us through Supabase so we can identify your account. We use it for nothing else: not for advertising, not for analytics, and not to reach any other part of your Google account. You can revoke it at any time from your Google account's third-party access page, and signing in with an email address instead involves Google not at all.
- Lemon Squeezy — only if you leave a tip. They take the payment as merchant of record, on their own page: they collect your billing details and handle tax, and show us a record of the order — the amount, and the name and email address you gave them — never your card details. Nothing about a tip reaches the app or your account. Their privacy policy governs the payment.
- OpenRouter and TypeSafe — online marking, while it is on, and only with the text it needs. When the app cannot mark a typed answer by itself, our server sends the question, its answer and what you typed to OpenRouter, which passes it to TypeSafe's Jev model to judge whether a fair quizmaster would accept it. The request is made by our server and carries nothing that identifies you, signed in or not, and neither provider keeps it or trains on it. On our side, an answer marked while you are signed in is counted against your account — that a mark happened and when, never the question or your answer — so that your allowance can be kept; one marked while you are signed out is counted against nobody. Switch online marking off, or point the app at your own local marking model, which involves nobody at all, and neither provider is used.
- Cloudflare Web Analytics — if this deployment has it switched on. A count of page views and where they came from, and nothing else: it sets no cookie and no identifier, cannot follow you to any other site, and never sees what you studied — nothing about your study is ever sent to it. That is why there is no consent banner in front of this app.
We use no advertising suppliers, no session recording, no heat maps and no third-party cookie of any kind.
Cookies
None for tracking. Signing in stores a session token in your browser's local storage so you stay signed in; it is not shared with anyone and is deliberately kept out of your progress export so a shared backup file can never carry it.
How long we keep it
- Account and progress — until you delete your account. Deletion is immediate and takes your stored progress with it; encrypted backups may retain a copy for up to 30 days before rotating out.
- A tip's payment record — retained by our payment provider as long as tax law requires, typically six years.
- The dates you opened the app — up to 13 months, then deleted. They also go with your account if you delete it, like everything else.
- Online marking — the question and what you typed are kept by nobody. For an answer marked while you are signed in, the record that a mark happened (when, and how long the request was) is kept for 31 days, the window your allowance is counted over, then deleted. Signed-out marks leave only the day's shared count.
- Whether you signed up in the app or on the web — one word, recorded once when the account is made and never updated. It goes with your account if you delete it.
Your rights
Under UK GDPR you may request access to your data, correction, deletion, portability, or restriction of processing, and object to processing. Email support@quizmaxx.app and we will respond within one month.
Two of these you can exercise instantly, without asking:
- Portability — Settings → Your progress → Export a backup gives you everything, as JSON.
- Deletion — Settings → Account → Delete my account removes your account and everything stored on it, immediately and without needing to ask us. Deleting your account sets out the steps and exactly what goes and what is kept. Separately, Settings → Your progress → Reset clears the copy held in this browser; the two are deliberately different actions, because closing your account is not the same as erasing your own study history from your own device.
You may also complain to the Information Commissioner's Office (ico.org.uk), with whom we are registered (reference C1996318).
Children
QuizMaxx is not aimed at children under 13, and we do not knowingly hold their data.
Changes
Material changes will be announced in the app before they take effect.