Privacy Policy

Last updated: 29 October 2026

This Privacy Policy explains what personal data QuizPlatform collects when you use the quiz service published at QuizPlatform.com (the "Service"), why that data is collected, how long it is kept, and what your rights are.

1. Who is responsible for your data

The operator of this installation of QuizPlatform is the data controller. You can reach us at privacy@QuizPlatform.com. QuizPlatform is server-side software that the operator runs on their own servers: all the data described below is stored and processed by the operator, not by the authors of the software.

2. Your account

An account is created for you by the operator or by an administrator of the installation (for example the administrator of your school or company). To run the account we store:

• your login and your display name — the display name is shown to other users, for example as the author of a quiz;
• your password as a salted hash — the password itself is never stored, never logged, and cannot be recovered from the database;
• your roles (administrator, teacher, API access), which decide which parts of the Service you may use.

You can change your display name and your password yourself at any time on your profile page. To close your account, contact us.

3. Content you create

The categories, quizzes, questions and answers you author are stored and shown to other users according to the visibility you choose: a public quiz is listed on the home page and may be solved by anyone, an authenticated quiz only by logged-in users, and a private quiz is never listed — only people holding its link can open it. Please treat a private quiz link like any other secret URL.

4. Quiz results

Every take of a quiz is stored as a single attempt record: which quiz, which user (an anonymous take carries no user identifier at all), when it was started and finished, how long it took, and the score in percent. The owner of a quiz sees the attempts made at their own quizzes — your login (or "Guest") together with the date, the score and the time spent. You see all of your own attempts on the "My results" page. You may ask the owner of a quiz, or us, to delete a single attempt of yours.

5. API tokens

An account with the API role may create access tokens. A token is stored in clear text so that it can be recognised, together with its name and the id of your account; it gives whoever holds it access to the quizzes and results of your account. Delete the tokens you no longer use; removing the API role from an account removes all of its tokens.

6. Cookies and browser storage

• SESSION — keeps you logged in. It is HttpOnly and SameSite=Lax and expires after the session lifetime configured by the operator. It carries only a random session identifier, never your credentials.
• lang — remembers your interface language for one year. It holds only a two-letter language code.
• theme in localStorage — remembers your light or dark theme. It never leaves your browser.

The Service sets no advertising, marketing or third-party analytics cookies. Only the own cookies listed above are used.

7. Server logs and protection of accounts

Like every web server, ours records technical information about requests (time, requested address, response status, error messages) in order to operate the Service and diagnose faults. Failed logins are counted per client — using the connection address, or the client address forwarded by our own proxy — and a client is temporarily blocked after too many failures in a row. That counter is kept in memory only, is used for nothing else, and is forgotten when the server restarts.

8. Why we process your data (GDPR legal bases)

• Performance of a contract (Article 6(1)(b) GDPR) — providing the quiz functionality to you as a registered user, and showing results to the author of a quiz.
• Legitimate interest (Article 6(1)(f) GDPR) — keeping the Service secure: password hashing, login throttling, role and ownership checks, error logs.
• Consent (Article 6(1)(a) GDPR) — your optional interface preferences, the language and the theme.

9. How long we keep data

Account data is kept while the account exists. An attempt record is kept while the quiz it belongs to exists: deleting a quiz deletes all of its stored results together with it. Sessions expire on their own. Restoring a backup may briefly bring back data that was deleted, within the retention period of that backup.

10. Who your data is shared with

We never sell personal data. It is processed by the operator and by the providers they use to run the installation (hosting, backup storage), who act on our instructions. Where the data is hosted outside the EEA, the operator relies on the standard contractual clauses or another lawful transfer mechanism. We disclose data to public authorities only when the operator is legally obliged to do so.

11. Security

Passwords are stored only as salted hashes and are compared in constant time. Quiz forms carry single-use tokens, and every action on a quiz, a category, a result or a token is checked against the role and the ownership of the acting account. Session cookies are HttpOnly and SameSite=Lax, and the pages are served with a restrictive Content Security Policy. A deployed installation is served over HTTPS. No system is perfectly secure — please use a password that you do not use anywhere else.

12. Children

The Service is offered to organisations, schools and adults. We do not knowingly collect personal data from children below the age of 16 without the consent of a parent or of the organisation running the installation. If you believe that we do, please contact us and we will remove the data.

13. Your rights

You have the right to access your data, to have it corrected, erased or restricted, to object to its processing, and to receive a copy of it in a portable format. Where processing is based on consent, you may withdraw that consent at any time. To exercise any of these rights, write to privacy@QuizPlatform.com; for data that belongs to a quiz, contacting the owner of that quiz is usually the fastest way. You also have the right to lodge a complaint with the data protection authority of your country.

14. Changes to this policy

Changes are published on this page with a new "Last updated" date; material changes are announced on the Service in advance. If the translations of this page differ, the English version prevails.