Privacy Policy — QuizMaxx
Last updated: 3 August 2026 · Contact: [email protected] · Controller: Raj Contractor, trading as QuizMaxx, 185 Kennington Road, London, SE11 6ST
The short version
QuizMaxx works without an account, and without one it holds nothing about you — no cookie, no identifier, no tracking, and no record anywhere of what you study. Everything you learn is stored in your own browser and stays there. The only thing this site counts is that a page was opened, and it counts that without knowing who opened it.
If you create an account, we store your email address and a copy of your study progress so it can sync between your devices. You can sign in with an email address or with your Google account; choosing Google tells us your email address, name and profile picture and nothing more, and is only ever used to know which account is yours. If you subscribe to Plus, our payment provider handles your payment details — we never see your card number.
We do not sell your data, show adverts, or share anything with anyone except the suppliers listed below, who are necessary to run the service.
Without an account
Nothing leaves your browser. Your schedule, answers, streak and settings live in localStorage on your device. We cannot see them. If you clear your browser data they are gone, which is why the app offers an export.
Two things are still fetched from third parties when you use those features, and those parties may log the request as any web server does:
- Google Fonts — the app's typefaces. It falls back to system fonts offline.
- Apple and Deezer CDNs — 30-second music previews, streamed when you play a music round.
- Cloudflare Web Analytics, if this deployment has it on — a page-view count, with no cookie and no identifier. See "Who else processes it".
With an account
| What | Why | Lawful basis |
|---|---|---|
| Email address | To identify your account and send sign-in links and receipts | Performance of a contract |
| Password (hashed) | To sign you in. Stored hashed by our auth provider; never in plain text | Performance of a contract |
| How you sign in — a password, or your Google account | To sign you in the way you chose. If you use Sign in with Google, Google tells us your email address, your name and your profile picture if you have one, and confirms the address is yours. We ask for nothing else, we do not read anything else in your Google account, and we never post anything to it | Performance of a contract |
| Your progress blob | So your study history syncs between devices | Performance of a contract |
| Subscription status and renewal date | To know whether Plus is active | Performance of a contract |
| The dates you opened the app while signed in | To know whether people who sign up are still here a month later, which is how we judge whether the app is worth building | Legitimate interests |
| "Where did you hear about QuizMaxx?", if you chose to answer it | To know which ways of telling people about it are worth continuing | Consent — the field is optional and blank by default |
| Whether you made your account in the app or on the web | To know whether people who arrive from an app store stay as long as people who arrive from the web, which is how we judge whether the store is worth the work | Legitimate interests |
| A bug report or idea you send us, and the technical details attached to it | To fix what you reported and reply to you | Legitimate interests |
The progress blob is the same data the "Export a backup" button produces: schedules, answer counts, streaks, quiz-night notes and settings. It contains whatever you typed into the app — if you logged a quiz night with a venue name, that is in there.
The dates are dates and nothing else — one per day you opened the app, with no time, no page, no device and nothing about what you studied. They exist to answer one question in aggregate ("of the people who signed up in March, how many were still opening it in April?") and they cannot reconstruct a visit. If you are not signed in, nothing is recorded at all.
A bug report is only ever sent when you press Send. The technical details it can carry are shown to you in full, in the message itself, before it goes: which build of the app you are running, your browser and window size, your settings, and how many items you have scheduled. Never a card, a deck, a question or an answer — nothing about what you study. You can untick them and send the message alone, and if you would rather not use the form at all, email <[email protected]> instead.
Who else processes it
- Supabase — hosts the database and handles authentication. Your data is stored in the European Union (Frankfurt,
eu-central-1). - Google — only if you choose to sign in with Google. Signing in that way tells Google you are signing in to QuizMaxx, and returns your email address, your name and your profile picture to us through Supabase so we can identify your account. We use it for nothing else: not for advertising, not for analytics, and not to reach any other part of your Google account. You can revoke it at any time from your Google account's third-party access page, and signing in with an email address instead involves Google not at all.
- Lemon Squeezy — takes payment as merchant of record. They collect your billing details and handle tax; we receive only your subscription status and a reference number. Their privacy policy governs the payment.
- AI model providers — only when you use the two Plus AI features, and only with the text each one needs. Drafting a round sends your chosen topic to DeepSeek and the drafted questions to Google (Gemini) for fact-checking; automatic answer marking sends the question, its accepted answer and what you typed to Google (Gemini) to be marked. The requests are made by our server and carry no account identifier to the provider. On our side, drafting keeps the topic against your account (that is the quota record); marking keeps only that a call happened and when — never the question or your answer, which stay in your browser like the rest of your study data. Skip the features — or point the app at your own local marking model, which involves nobody at all — and neither provider is used.
- Cloudflare Web Analytics — if this deployment has it switched on. A count of page views and where they came from, and nothing else: it sets no cookie and no identifier, cannot follow you to any other site, and never sees what you studied — your study data does not leave your browser, so there is nothing there for it to see. That is why there is no consent banner in front of this app.
We use no advertising suppliers, no session recording, no heat maps and no third-party cookie of any kind.
Cookies
None for tracking. Signing in stores a session token in your browser's local storage so you stay signed in; it is not shared with anyone and is deliberately kept out of your progress export so a shared backup file can never carry it.
How long we keep it
- Account and progress — until you delete your account. Deletion is immediate and takes your stored progress and subscription record with it; encrypted backups may retain a copy for up to 30 days before rotating out.
- Payment and tax records — retained by our payment provider as long as tax law requires, typically six years.
- The dates you opened the app — up to 13 months, then deleted. They also go with your account if you delete it, like everything else.
- Whether you signed up in the app or on the web — one word, recorded once when the account is made and never updated. It goes with your account if you delete it.
Your rights
Under UK GDPR you may request access to your data, correction, deletion, portability, or restriction of processing, and object to processing. Email [email protected] and we will respond within one month.
Two of these you can exercise instantly, without asking:
- Portability — Settings → Your progress → Export a backup gives you everything, as JSON.
- Deletion — Settings → Account → Delete my account removes your account and everything stored on it, immediately and without needing to ask us. Deleting your account sets out the steps and exactly what goes and what is kept. Separately, Settings → Your progress → Reset clears the copy held in this browser; the two are deliberately different actions, because closing your account is not the same as erasing your own study history from your own device.
You may also complain to the Information Commissioner's Office (ico.org.uk), with whom we are registered (reference C1996318).
Children
QuizMaxx is not aimed at children under 13, and we do not knowingly hold their data.
Changes
Material changes will be announced in the app before they take effect.