Privacy policy

Account information includes your email and authentication records. Study information includes decks, folders, question text, answer options, stored answers, supplied solutions and optional subject, difficulty and exam labels.

Practice records include sessions, checked answers, correctness, timestamps, progress and mistakes. Exams can also store saved choices, review flags, results and recorded study time. Progress is recorded for free and paid accounts; access to particular study tools is separate.

Connected-app authorisations include the app identity, approved scopes and grant date. Account settings include filing preferences, access status and expiry, grant source and upgrade interest when requested. Import hashes and accepted-question usage records help detect duplicates and enforce allowances.

When billing operates, records include subscription and reservation references, plan and payment status, invoice and payment references, amounts, currency, a broad payment-method category, refund amounts, verified paid-period dates and cancellation information. Webhook delivery records and account-linked billing-funnel events support payment reliability. Those funnel events do not store an IP address or user agent.

QuizCaddy uses this information to sign you in, save and organise study content, check answers, resume sessions, show your own progress, manage connected apps, apply access and usage limits, and maintain account and payment security.

Insights are calculated from saved answers. QuizCaddy does not send your questions to an AI service for analysis. A study prompt includes short examples of your wrong questions only if you enable that option; you decide whether to copy it into a third-party chatbot.

The website is served through Vercel. Supabase provides account authentication and the application database. Authentication-message delivery is managed through the authentication service and its configured delivery services.

Where payment features are enabled, Razorpay processes payment and mandate information. QuizCaddy does not store card details, UPI addresses or UPI PINs from payment payloads. The application keeps only the payment records described above. The account email may be prefilled in Checkout after you choose to subscribe.

A connected chatbot can submit question batches you authorise. Revoking a connection does not remove content already imported or copies held by the chatbot. Vercel, Supabase, Razorpay and any chatbot you choose also process information under their own applicable terms and privacy policies.

Service-provider processing locations, operational records and backup controls are separate from QuizCaddy's application deletion controls. This policy does not promise a particular storage location or an automatic deletion deadline for third-party systems.

Sign-in cookies keep you authenticated. The application sets its authentication cookies as HttpOnly, SameSite=Lax and Secure in production. Cookie lifetime also depends on the authentication service and its configuration.

Short-lived signed cookies protect password recovery and sensitive account actions. Account-action proofs expire after ten minutes, are tied to the current session and action, and can be used once.

During email verification, this tab can remember the email address, flow purpose, safe return destination and resend time in sessionStorage for up to thirty minutes from the last step. The app does not save passwords or one-time codes there.

Browser storage remembers theme, practice-timer preferences, worksheet options, pending practice answers, unsent exam selections and dismissed study suggestions. Session storage can cache practice content, results and deck listings, and remember a pending subscription introduction. This introduction record does not grant paid access. These records can remain on the device until cleared or removed by the relevant flow.

Clearing site data can discard unsent answers and saved preferences. Use care on a shared device. Authentication and payment services may use their own cookies or storage when you use their services.

Operational records can include request paths, status codes, timings, authentication outcomes, rate-limit events and error diagnostics. Some abuse controls use hashed identifiers. Service errors and infrastructure logs can contain personal information, including connection details recorded by hosting or authentication services.

A browser performance-diagnostic option can keep timings in memory or write diagnostics to the browser console. It does not create an advertising profile. No blanket promise is made that all operational logs exclude personal information.

Deleting a question or deck removes the associated question content, attempts and progress from the active application database. Accepted-question usage history can remain for allowance enforcement, so deletion does not restore an import allowance.

You can export your account data and delete your account from Account. Export and deletion are available on every plan. Deletion removes your active decks, questions, practice history, folders and account connections. It first confirms subscription cancellation and disconnects your connected apps. It does not remove copies you separately hold in a chatbot or other external service.

Payment and invoice records and the subscription references needed to understand them remain after account deletion for accounting and legal obligations. They are detached from your active account. No fixed retention period is currently promised.

Data-export downloads can use temporary server storage. Normal completion, cancellation and handled errors remove that copy; hosting cleanup applies after a process failure.

No fixed backup, log or third-party deletion period is promised. Cancelling paid access does not itself delete study content.

Depending on applicable law, you may have rights concerning access, correction, deletion, consent and complaints. You can already delete individual study items and revoke connected apps using the account tools.

For a privacy request, email support@quizcaddy.com. Describe the request and identify the account involved. Verification of account ownership may be needed before information can be disclosed or changed. Do not send passwords or access tokens.

Account provides self-service data export and deletion. You may also contact support about your data. Your rights under applicable law remain unaffected.