Privacy Policy

The Pop Quiz team is the data controller for the personal data described here. Postal address: [postal address to be confirmed]. Data-protection contact: privacy@popquiz.com.

If you are in the EU, the UK or another jurisdiction with comparable law, this policy is written to meet it, and clause 7 lists the rights you have.

Everything here is either something you typed, something the service has to record to work, or a measurement of how the app is used. There is no data broker, no purchased list and no advertising profile.

• To run your account and show you quizzes (performance of our contract with you). Without this there is no service.
• To send account email (contract): your verification code, password resets, and a notice if you ask to delete your account. We do not send marketing email.
• To keep the leaderboard honest and the service secure (our legitimate interest in a product that is not trivially cheatable, and in not being brute-forced). This covers rate limiting and the attempt hashes in clause 4. We have deliberately kept it to the minimum that answers the question, which is why it is hashes rather than addresses.
• To understand which features get used (consent, for analytics: nothing non-essential loads until you allow it in the cookie banner).
• To comply with the law where we are required to (legal obligation).

We do not use your data to make automated decisions with legal effect, and we do not profile you for advertising. Ranking-point eligibility is calculated automatically, but the only outcome is a score, and clause 6 of the Terms states the rule it applies.

Ranking points are only worth having if an author cannot inflate their own quiz's difficulty rating by taking it repeatedly. Answering that needs one comparison: did these two attempts come from the same place? It does not need to know where that place is.

So the software does not keep the address. On each attempt it:

• reads your IP address from the request, mixes it into an HMAC-SHA256 keyed with a secret that is not in the database, keeps 128 bits of the result, and discards the address;
• does the same with your browser's user-agent and language headers, and nothing else. That is deliberately weak as a fingerprint: it can tell one browser from another, which is the actual question, and it is not the kind of high-entropy canvas-and-fonts fingerprint that would amount to covert tracking.

The key matters. A plain SHA-256 of an IPv4 address is reversible by brute force, because there are only about four billion of them, so an unkeyed digest would still be personal data. Keying it with a secret the database does not contain means that a copy of the attempts table on its own tells an attacker nothing about where anyone was.

And what it is used for is exclusion, never refusal. Two students on one school network share a hash, so treating a match as proof of cheating would mean telling an honest player their work does not count. Instead a matching attempt is recorded normally and simply left out of the quality figures. Nobody is blocked and nobody is accused.

We use a small number of storage mechanisms, and the distinction between them is the distinction between the site working and us learning something:

We set no advertising or cross-site tracking cookies. The banner lists a Marketing category because the consent record has room for one, and we currently place nothing in it.

We do not sell your data and we do not share it for anyone else's marketing. It reaches these processors, each for one job, each under a data processing agreement:

Other people see what you choose to publish: a public quiz, your public profile, your entry on the leaderboard. A private quiz stays private, and a quiz shared by link is visible to whoever holds the link.

We will disclose data if the law compels us to, and we will tell you when we are permitted to.

Some of these processors are outside the EEA, principally in the United States. Those transfers rely on the European Commission's Standard Contractual Clauses, or on an adequacy decision where one applies.

You can:

• See and correct most of your data yourself, in your profile settings.
• Get a copy of your data in a portable format. There is no self-service export button yet, so this one is a request to privacy@popquiz.com, which we answer within one month.
• Delete your account from your profile settings. See clause 8 for what happens and when.
• Withdraw analytics consent at any time by clearing your cookie preferences in your browser, which brings the banner back.
• Object to, or ask us to restrict, processing we do on the basis of legitimate interest.
• Complain to your data protection authority. You do not have to come to us first, though we would rather you did.

We will ask you to sign in to prove a request is yours. We will not charge you for it, and we will not treat you differently for making one.

• Your account and content for as long as the account exists.
• After you ask to delete it, 30 days, then permanently erased. The account is locked for the whole window, and a link sent to the address on the account can undo the request during it. The delay exists because the commonest reason an account gets deleted is that somebody else got into it, and that is recoverable only while the data is still there. After the window we cannot restore anything.
• Rate-limiting counters in Redis: minutes to hours. The record that an address has been blocked before is kept for 7 days, so that repeat offences escalate rather than resetting.
• Verification and reset tokens until they are used or expire, whichever comes first.
• Analytics events according to PostHog's retention, which is longer than we need and which we are not able to shorten per-event.
• Backups age out on their own cycle, so deleted data can persist in a backup briefly after it is gone from the live database.

• Passwords are stored as bcrypt hashes, never in a form we can read.
• Traffic is served over HTTPS, and the session cookie is HTTP-only so page scripts cannot read it.
• Sign-in and sign-up are rate-limited and then blocked for an escalating period, and a wrong password costs the same amount of time whether or not the account exists, so the form cannot be used to discover who has an account here.
• Two-factor authentication is available, and we recommend turning it on.
• Attempt origin data is hashed before it is stored, as described in clause 4.

No system is perfectly secure. If we discover a breach affecting your personal data we will notify the relevant authority within 72 hours where the law requires it, and we will tell you directly when the risk to you is significant.

If you find a vulnerability, please report it to support@popquiz.com rather than testing it against other people's accounts.

Pop Quiz is not for children under 13. We do not knowingly collect their data, and if we learn that an account belongs to one we delete it and its content. If you believe a child has given us data, write to privacy@popquiz.com.

We will update this page when what we do changes, and the date at the top will change with it. If a change materially affects how we use data you have already given us, we will tell you at the email address on your account before it takes effect, rather than relying on you to re-read the page.