Privacy Policy

1. Information We Collect

1.1 Account and Authentication

We use Google Firebase Authentication to create and secure your account. When you sign up or sign in, we collect and store:

• Your email address, and (if provided) your display name and profile picture.
• Your chosen sign-in method: email and password, or Google sign-in. If you use Google sign-in, Google shares your basic profile information (name, email, avatar) with us. We do not receive or store your Google password.
• Account metadata we generate, such as your plan, role, study streaks, and settings.
• Your age range. The first time you sign in, we ask for your birth month and year once. We keep only the resulting age range (under 13, 13–17, or 18 and over) and when you answered — never your date of birth. We use it to apply our age requirement (see "Children's Privacy") and age-appropriate defaults.

Passwords for email/password accounts are managed by Firebase Authentication; we do not store your raw password.

1.2 Content You Provide

To generate study materials, you provide source content. Depending on how you use the Service, this may include:

• Uploaded files: PDFs, Word and PowerPoint documents, text and Markdown files, images (including photos of handwritten notes), and audio recordings.
• Pasted text and web links, including YouTube video links and other URLs, as well as content you import from optional integrations (see "Google Drive Integration" below).
• Communications: if you contact us for support, we receive your message and any information you include in it.

Please do not upload sensitive personal information, confidential material, or content you do not have the right to share. See our AI processing disclosures below.

1.3 Content We Generate for You

The Service creates and stores study materials derived from your sources, including notes, quizzes and questions, flashcard decks, image-occlusion sets, and AI grades and feedback.

1.4 Study and Practice Activity

As you study, we record your activity so we can track progress and schedule reviews. This includes:

• Quiz attempts and the answers you submit, together with whether they were correct.
• Math practice attempts — the answer you submit to each practice item, whether it was correct, and the time of the attempt.
• Derived study data such as concept mastery, spaced-repetition review schedules, study plans, study streaks, activity history, and progress statistics.

1.5 Preferences and Settings

We store your display and study preferences — such as your selected theme/appearance, skin, accent color, icon set, and fonts. Some of these are stored locally in your browser and some are saved to your account (see "Cookies, Local Storage and Similar Technologies").

1.6 Usage, Log, and Telemetry Data

When you use the Service, we automatically collect limited technical information, including log data (such as your IP address, browser type, and access times) and information about which features you use. To enforce fair-use and rate limits and to help us debug and improve generation, we keep usage records that may include a short preview (up to roughly the first 2,000 characters) of the prompt sent to, and the response returned by, the AI provider for a generation. We use this information to operate, secure, meter, and improve the Service. See "Data Retention" for how long we keep it.

1.7 Parent Email and Weekly Reports (Optional)

You can optionally enable a weekly progress report emailed to a parent or guardian. If you turn this on, you provide the recipient's email address and we use it solely to send that report. The report is opt-in, contains no advertising, and every email includes a one-click unsubscribe link that turns the reports off. See "Children's Privacy" for how this interacts with children's-data law.

1.8 Payment Information

Paid subscriptions are not generally available at this time. If and when we offer them, payments will be processed by Stripe. Card details are entered directly with Stripe and are never stored on or transmitted through our servers; we retain only non-card billing metadata such as your Stripe customer and subscription identifiers, plan, and billing status.

1.9 Push Notification Subscriptions (Optional)

If you enable web push notifications, your browser creates a push subscription that we store so we can deliver the notifications you asked for. This is optional and opt-in.

1.10 Google Drive Authorization (Optional)

If you connect Google Drive to import documents, we store your Google authorization (an OAuth refresh token) in encrypted form (AES-256-GCM) so we can import the specific files you choose. See "Google Drive Integration" below.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service and its features
• Process your source content to generate notes, quizzes, flashcards, and other study materials, and to grade and give feedback on your answers
• Check generated study materials for accuracy with a second AI reviewer, if you turn on the optional AI Cross-check (see Section 3)
• Track your study progress and schedule spaced-repetition reviews
• Create, authenticate, and secure your account
• Enforce fair-use limits, prevent abuse, and detect and prevent fraud or security incidents
• Send the optional weekly parent/guardian report, if you enable it
• Send you push notifications you have opted into, and respond to your support requests
• Process payments and manage subscriptions, if and when paid plans are available
• Comply with legal obligations and enforce our Terms of Use

3. AI Processing of Your Content

IMPORTANT: Your source content is sent to third-party AI and document-processing services so we can generate your study materials. This is core to how the Service works.

You acknowledge and agree that:

• Content you provide — including uploaded documents, images and photos, audio, transcripts, and pasted text — is transmitted to Google Gemini to generate notes, quizzes, flashcards, grades, and related materials. Images and photos are analyzed by Gemini's multimodal (vision) models, and audio narration of study materials, when you use it, is produced by Google Cloud Text-to-Speech. Text is extracted from some uploaded documents by Google Cloud Document AI.
• We use these providers as service providers / processors under contract, on paid enterprise tiers, and we do not permit them to use your content to train their models.
• Optional AI Cross-check (xAI). AI Cross-check is off unless you turn it on (Settings → Usage → "Cross-check generated content"). While it is on, each set of notes, quiz, or flashcard deck you generate is also sent to xAI's Grok API for an automated quality review before it is saved. We send the generated study material and the part of your source content needed to check it (up to roughly the first 30,000 characters). We use the review only to improve accuracy: it checks the material for factual errors, gaps, formatting problems, unclear wording, and claims your source does not support, and we use its findings to correct the material. xAI's API terms state that xAI does not use API inputs or outputs to train its models without the customer's explicit permission, and we do not give that permission. Under those terms, xAI keeps API requests and responses for up to 30 days to monitor for abuse and misuse, then deletes them. Requests to xAI may be processed outside the United States. To stop sending content to xAI, turn AI Cross-check off at any time; nothing is sent to xAI while it is off.
• We do not use your content to train our own foundation models. Your content is processed to produce the materials you request.
• AI-generated content may contain errors or inaccuracies (sometimes called "hallucinations"). It is a study aid, not an authoritative source — see the AI-Generated Content Disclaimer in our Terms of Use.
• You should not upload sensitive personal information, confidential business information, or content you do not have the right to share.

4. How and Where We Store Your Data

We host the Service on Google Cloud Platform. Your account data, generated study materials, and study records are stored in a managed PostgreSQL database (Google Cloud SQL), and your uploaded files are stored in Google Cloud Storage. Our infrastructure is located in Google Cloud's us-central1 region in the United States. Except for the optional AI Cross-check described in Section 3, our sub-processors listed below process data in the United States.

We protect data in transit with TLS and rely on Google Cloud's encryption of data at rest, along with access controls and authentication. Your Google Drive authorization token, if any, is additionally encrypted by us at the application layer (AES-256-GCM). No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

5. Third Parties and Sub-processors

We share information with the service providers we rely on to run the Service, each under a data-processing agreement that limits their use of the data to providing their service to us. We do not sell or share your personal information, and we do not use third-party advertising networks. Except where noted, the sub-processors below store and process data in the United States.

• Google Firebase Authentication — account creation, sign-in, and session management.Privacy Policy
• Google Cloud Platform — hosting and the following managed services: Cloud SQL (the PostgreSQL database holding your account, content, and study records); Google Cloud Storage (your uploaded files); Google Gemini (AI generation, grading, and image/vision analysis); Google Cloud Text-to-Speech (audio narration); and Google Cloud Document AI (text extraction from documents).Privacy Policy
• xAI (Grok API) — the optional AI Cross-check: an automated quality review of the study materials you generate and the source excerpts needed to check them, only while you have AI Cross-check turned on. Under xAI's API terms it is not used to train xAI's models without our permission, which we do not give, and xAI keeps requests for up to 30 days for abuse monitoring. It may be processed outside the United States. See Section 3.API Terms
• Upstash — Redis-based rate limiting, usage counting, and caching.Privacy Policy
• Stripe — payment processing and subscription management. Stripe handles card data directly; we never receive or store your full card number. (Applies only if and when paid subscriptions are enabled.)Privacy Policy

We may also disclose information if required by law or legal process, to protect our rights, safety, or property or those of others, or in connection with a merger, acquisition, or sale of assets. If we ever change our sub-processors, we will update this list.

6. We Do Not Sell or Share Your Personal Information

We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising, as those terms are defined under California and other U.S. state privacy laws. We do not serve targeted advertising and do not load third-party advertising or analytics trackers.

Global Privacy Control (GPC). Where required by applicable law, we treat a Global Privacy Control browser signal as a valid request to opt out of any sale or sharing of personal information. Because we do not sell or share personal information in the first place, there is nothing to opt out of — but we honor the signal as a matter of policy.

7. Cookies, Local Storage, and Similar Technologies

We keep our use of browser storage minimal and functional. We do not use third-party advertising or cross-site tracking cookies.

• Authentication: the Firebase Authentication SDK stores your sign-in session in your browser (for example, in local/IndexedDB storage) so you stay signed in. We do not place your credentials in cookies.
• Preferences: we store display preferences in your browser's local storage under keys such as qs-skin, qs-accent, qs-appearance, and qs-iconset (theme, skin, accent color, fonts, and icon settings), and we use local/session storage to remember study UI state. Some preferences are also saved to your account so they follow you across devices.
• Display cookie: a single first-party, strictly functional cookie named qs-ui holds only your theme, skin, accent-color and highlight-intensity choice, so the page arrives already in the right look instead of flashing. It contains no identifier and no personal information, is never used for advertising or analytics, and is not shared with anyone.

You can clear this storage through your browser settings. Doing so may sign you out and reset your preferences.

8. Web Push Notifications (Optional)

If you choose to enable push notifications (for example, study reminders), your browser asks for permission and creates a push subscription that we store to deliver those notifications. This feature is entirely optional and opt-in. You can turn it off at any time in your browser or device settings, which revokes the subscription.

9. Google Drive Integration (Optional)

You may optionally connect Google Drive to import documents as study sources. If you do:

• We request read-only access (the drive.readonly scope) and only access the specific files you choose through Google's file picker.
• We store your Google authorization (refresh token) in encrypted form so we can import the files you select. We do not browse, modify, or delete your Drive.
• You can disconnect the integration at any time, which deletes the stored authorization, and you can also revoke access in your Google Account settings.

10. Data Retention

We keep personal information only for as long as we need it for the purposes described in this policy, and as required to meet legal obligations, resolve disputes, and enforce our agreements. Our retention periods are:

• Account information: retained until your account is deleted.
• Sources, files, and generated content: retained until you delete them or your account is deleted. Deleting a source also removes its associated file from Google Cloud Storage.
• Study and practice activity (quiz and math attempts, review schedules, progress): retained while your account is active so we can track your progress; deleted with your account.
• Usage-record previews and technical logs: retained for a limited period (target: 30–90 days) for security, abuse prevention, metering, and debugging, then automatically deleted.
• AI Cross-check requests at xAI: kept by xAI for up to 30 days, then deleted by xAI (see Section 3). The review's findings are stored with the study material they concern and deleted with it.
• Accounts of users under 13: closed as soon as the age answer is given, and deleted together with their information (see "Children's Privacy").
• Inactive accounts: after an extended period of inactivity we may notify you and then delete the account and its data.
• Legal holds: we may retain limited information longer where required to comply with law, resolve disputes, or enforce our agreements.

11. Your Privacy Rights and Choices

Depending on where you live, U.S. state privacy laws (including the California Consumer Privacy Act, as amended by the CPRA) may give you the rights described below. We honor these choices for our users regardless of state, subject to identity verification and legal exceptions.

11.1 Access and Portability

You can view and update much of your account information and preferences directly in the app. You may also request a copy of the personal information we hold about you in a portable, machine-readable format.

11.2 Deletion of Your Content and Account

You can delete individual sources, notes, quizzes, and flashcard decks directly in the app; deleting a source also removes any file stored for it. You may also request deletion of your entire account and all associated data. We will delete your data across our systems and instruct our sub-processors to do the same, except for limited information we must keep for legal compliance.

11.3 Correction

You may correct inaccurate personal information, either in the app or by contacting us.

11.4 U.S. State Privacy Rights and Non-Discrimination

Depending on your state, you may have the right to know what personal information we collect and how we use it, to access and delete it, to obtain a portable copy, to correct it, and to opt out of the sale or sharing of personal information and of targeted advertising. We do not sell or share personal information and do not engage in targeted advertising (see Section 6). We will not discriminate against you for exercising any of these rights.

11.5 How to Exercise Your Rights

To exercise any of these rights, contact us at <<OWNER: privacy/DSAR contact email — suggest privacy@quizstack.ai (must be a monitored inbox)>>. We will acknowledge your request, may need to verify your identity first, and will respond within the time required by applicable law. You may use an authorized agent to submit a request where the law permits.

12. Children's Privacy

QuizStack is for people who are 13 or older. The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. We do not offer accounts to children under 13, with or without a parent's consent, and we do not ask children for a parent's contact details.

The first time you sign in, we ask for your birth month and year without saying what answer is required. If the answer shows that you are under 13:

• the account is closed immediately. It cannot be used to study, upload, generate, or share anything, and any share links it created stop working;
• we collect nothing more from it. The only thing we add is a record that the account holder is under 13 and when that answer was given — never the date of birth — so the account stays closed;
• the account holder can delete the account and everything already in it straight away (and download a copy first). If it is not deleted, we delete it and its information ourselves.

If we learn in any other way that we have collected personal information from a child under 13, we will delete it. If you are a parent or guardian and believe your child under 13 has given us personal information, contact us at <<OWNER: privacy/DSAR contact email — suggest privacy@quizstack.ai (must be a monitored inbox)>> and we will delete the account and the information associated with it.

The optional weekly parent report described in Section 1.7 lets a user who is 13 or older send progress updates to a parent or guardian; the recipient can unsubscribe from any report email.

13. Data Security

We use administrative, technical, and organizational measures designed to protect your information, including TLS encryption in transit, encryption of data at rest, access controls and authentication, Firebase-managed password handling (we never store raw passwords), and application-layer encryption of stored Google Drive tokens. No system is perfectly secure, and we cannot guarantee absolute security.

14. Data Breach Notification

If we become aware of a data breach affecting your personal information, we will investigate promptly and notify affected users and the appropriate authorities as required by applicable U.S. federal and state breach-notification laws, without unreasonable delay.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the effective date and version above and post the updated policy on this page. If a change is material, we will make reasonable efforts to notify you. Your continued use of the Service after changes take effect indicates your acceptance of the updated policy.

16. Contact Us

If you have questions about this Privacy Policy or want to exercise your privacy rights, contact us at:

<<OWNER: legal entity name (e.g. QuizStack, Inc.)>>
Email: <<OWNER: privacy/DSAR contact email — suggest privacy@quizstack.ai (must be a monitored inbox)>>
Mailing address: <<OWNER: physical postal / mailing address>>