PRIVACY POLICY

Quizora ("we", "us", or "our") is an adaptive quiz engine that generates multiple-choice questions from user-uploaded documents. This Privacy Policy describes how we handle personal information collected through our website and services.

If you have questions about this policy, contact us at privacy@quizora.app.

We collect information in the following ways:

Information you provide directly

• ▸Account details: name, email address, and (if using email sign-up) a hashed password
• ▸Profile information: display name and avatar (pulled from OAuth provider if applicable)
• ▸Documents you upload for quiz generation
• ▸Onboarding preferences and subject interests

Information collected automatically

• ▸Quiz attempts, scores, and performance history
• ▸Streak data and last activity timestamps
• ▸Usage patterns such as quizzes generated and topics studied
• ▸Basic device and browser information for security and debugging
• ▸IP address for rate limiting and abuse prevention

Information from third parties

If you sign in via GitHub or Google, we receive your name, email address, and profile picture from that provider. We do not receive your passwords from these services.

We use the information we collect to:

• ▸Create and maintain your account
• ▸Generate quizzes from your uploaded documents using AI models
• ▸Track your learning progress, streaks, and quiz history
• ▸Send transactional emails such as sign-in links and account notifications (via Resend)
• ▸Enforce usage limits and prevent abuse
• ▸Improve the accuracy and quality of our AI-generated content
• ▸Respond to support requests and communications
• ▸Comply with legal obligations

We do not sell your personal data to third parties. We do not use your data for advertising purposes.

Documents you upload are processed solely to generate quiz questions. We use third-party AI APIs (such as Groq) to extract and analyse document content. These providers process text content in accordance with their own privacy policies.

Uploaded files may be deleted from our servers after processing is complete. We do not use the content of your documents to train AI models, and we do not share your document content with other users.

Your data is stored in MongoDB databases hosted on cloud infrastructure. Session state is managed via encrypted JWT tokens. Passwords are hashed using bcrypt with a cost factor of 12 and are never stored in plaintext.

We implement rate limiting (via Upstash Redis) to protect against brute-force and abuse. All data is transmitted over HTTPS.

While we take reasonable security measures, no system is perfectly secure. We cannot guarantee the absolute security of your data and encourage you to use a strong, unique password for your account.

We retain your account and quiz data for as long as your account is active. If you delete your account, we will delete or anonymise your personal data within 30 days, except where retention is required by law or for legitimate business purposes such as fraud prevention.

Uploaded documents may be deleted sooner, typically immediately after quiz generation is complete.

We use cookies solely for authentication — specifically, a session cookie containing your encrypted JWT token. We do not use advertising cookies or cross-site tracking.

We may use browser local storage to preserve guest quiz state before you sign in, enabling seamless data migration to your account.

We use the following third-party services to operate Quizora:

Each of these providers processes data in accordance with their own privacy policies. We encourage you to review those policies.

Depending on your location, you may have the following rights:

• ▸Access: request a copy of the personal data we hold about you
• ▸Correction: request that inaccurate data be corrected
• ▸Deletion: request that your account and associated data be deleted
• ▸Portability: request your data in a structured, machine-readable format
• ▸Objection: object to certain types of processing
• ▸Withdrawal of consent: where processing is based on consent, withdraw it at any time

To exercise any of these rights, email us at privacy@quizora.app. We will respond within 30 days.

The Service is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided us with personal data, we will delete it promptly. If you believe a child under 13 has registered, please contact us immediately.

Your data may be processed in countries other than your own, including by third-party service providers listed above. We ensure that any such transfers are conducted with appropriate safeguards in place.

We may update this Privacy Policy from time to time. We will notify you of material changes via email or a prominent notice within the Service. The effective date at the top of this page will always reflect the most recent version.

Continued use of the Service after changes take effect constitutes your acceptance of the updated Privacy Policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us: