Legal & Privacy

We are committed to protecting your privacy and handling your personal data in an open and transparent manner, in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR).

By accessing or using the Platform you confirm that you have read, understood, and agree to this Privacy Policy. If you do not agree, please discontinue use of the Platform immediately.

Quiz App is the data controller for personal data collected through the Platform. For the purposes of UK GDPR, our contact details are:

If you have questions about how we handle your personal data, or wish to exercise your rights, please contact us using the details above.

We collect only the minimum data necessary to provide the Platform's core functionality. The categories of data we collect are:

3.1 Data Provided Directly by Teachers

• Teacher name — entered during quiz creation to identify the session host.
• Quiz title and subject — content metadata entered when creating a quiz.
• Quiz configuration settings — question difficulty distribution, time limits, scoring options, and randomisation preferences.

3.2 Data Provided Directly by Students

• Display nickname — entered when joining a quiz session (does not need to be a real name).
• Avatar selection — a numeric avatar identifier chosen from a predefined set.
• Session code — the alphanumeric code used to join a specific quiz room.

3.3 Quiz Performance Data

• Answers submitted — which answer option was selected for each question.
• Response time — how many seconds were taken to answer each question.
• Scores and streaks — calculated points, correct/incorrect count, and answer streaks per session.

3.4 Technical & Automatically Collected Data

Data Type	Purpose	Stored
IP address	Rate limiting, abuse prevention	Redis (session-duration TTL)
Socket connection ID	Real-time quiz delivery	Redis (session-duration TTL)
Server-side request logs	Error diagnosis, performance monitoring	Ephemeral server logs
HTTP request metadata	Security, rate limiting	Ephemeral server logs
Session token (teacher)	Authentication of teacher actions	Client-side only (browser storage)

We do not collect: email addresses, passwords, payment information, government identifiers, location data, or device fingerprints. We do not use third-party advertising trackers or analytics SDKs.

We use the data we collect solely for the following purposes:

• Delivering the quiz service — creating sessions, routing questions to students, processing answers, and displaying live leaderboards and results.
• Real-time communication — using WebSocket connections (Socket.IO) to transmit quiz events (question delivery, answer acknowledgement, score updates) between teacher and students.
• Score calculation and results — computing points based on correctness, response time, and streaks, and displaying individual results to students and summary statistics to teachers.
• Security and abuse prevention — enforcing rate limits on API endpoints and socket events to protect the Platform from automated abuse, cheating, or denial-of-service attacks.
• Session recovery — using temporary Redis cache data to restore active quiz sessions in the event of a server restart, ensuring uninterrupted service.
• Error diagnosis and service improvement — using ephemeral server logs to identify and fix technical issues.

Under UK GDPR Article 6, we rely on the following lawful bases:

Processing Activity	Lawful Basis
Delivering the quiz session (answer collection, scoring, leaderboard)	Performance of a contract / Legitimate interests
Rate limiting and abuse prevention using IP address	Legitimate interests (Art. 6(1)(f)) — security of the Platform
Server logs for error diagnosis	Legitimate interests (Art. 6(1)(f)) — operational stability
Storing quiz performance data during and after a session	Consent implied by voluntary participation in the session

Where we rely on legitimate interests, we have conducted a balancing test and determined that our interests do not override the rights and freedoms of users, given the minimal and non-sensitive nature of the data processed.

We do not sell, rent, or trade your personal data to any third party.

Within a quiz session, the following data is visible to other session participants:

• Student nicknames and avatar selections are displayed on the live leaderboard visible to all session participants, including the teacher.
• Score rankings are visible to all session participants on the leaderboard and results screens.

We may share data with the following categories of third-party processors where strictly necessary to operate the Platform:

Processor Category	Purpose	Data Shared
Hosting / cloud infrastructure provider	Server and database hosting	All data stored on the Platform
Redis cache provider	Session state, rate limiting, real-time data	Session codes, IP addresses (hashed), socket IDs, scores

All processors are bound by data processing agreements and are required to process data solely on our instructions and in compliance with applicable data protection law.

We may disclose data to law enforcement or regulatory authorities where required by law, court order, or to protect the safety and security of the Platform or its users.

We retain data for the minimum period necessary:

Data Category	Retention Period
Active question (Redis cache)	5 minutes after question is served
Session leaderboard (Redis cache)	2 minutes after last update
Student session data (Redis cache)	1 hour after session ends
Quiz session settings (Redis cache)	2 hours
Full quiz session data (PostgreSQL)	Retained until deletion request or account termination
Student answers and scores (PostgreSQL)	45 minutes (Redis); persistent in PostgreSQL until deletion
IP address (rate limit logs — Redis)	60-second rolling window
Server request logs	Up to 30 days, then automatically purged

Upon request, we will delete your personal data from our PostgreSQL database within 30 days, subject to any legal obligation to retain records.

We implement appropriate technical and organisational measures to protect your data, including:

• HMAC-SHA256 teacher authentication — teacher session tokens are cryptographically signed to prevent unauthorised control of quiz sessions.
• Rate limiting — Redis-backed sliding-window rate limits protect all API endpoints from brute force and automated abuse.
• Input validation and sanitisation — all user-supplied input is validated and sanitised before processing.
• Parameterised database queries — all database operations use parameterised queries to prevent SQL injection.
• CORS policy — cross-origin requests are restricted to authorised origins in production.
• Transport security — all data in transit is protected by TLS/HTTPS.
• Principle of least data — we do not collect data beyond what is necessary for the Platform to function.

The Platform uses browser storage mechanisms as follows:

Storage Type	Data Stored	Purpose	Duration
sessionStorage / localStorage	Teacher token, session code	Maintain teacher session across page navigation	Until browser session ends or user clears storage
Socket.IO connection	Socket ID (in memory)	Real-time communication	Duration of connection only

We do not use advertising cookies, analytics cookies, or any third-party tracking cookies. We do not use cookies to track you across other websites.

Where browser storage is used for functional purposes only (i.e., strictly necessary to provide the service you have requested), we rely on the legitimate interests lawful basis and the "strictly necessary" exemption under PECR Regulation 6(4). No consent banner is required for strictly necessary storage.

The Platform is designed for use in educational environments where students of all ages, including minors under the age of 13 and under the age of 18, may participate.

The Platform is intended to be used by students under the supervision of a teacher or responsible adult. Teachers and educational institutions using the Platform for students under 13 are responsible for ensuring that appropriate consents and safeguards are in place in accordance with their own institutional data protection policies and applicable law (including the Children's Code / Age Appropriate Design Code in the UK).

We do not knowingly collect personal data from children beyond the minimal session participation data described in Section 3, and we do not use any such data for profiling, marketing, or any purpose beyond delivering the quiz session.

Subject to applicable law, you have the following rights regarding your personal data:

• Right of access (Art. 15) — You may request a copy of the personal data we hold about you.
• Right to rectification (Art. 16) — You may request correction of inaccurate personal data.
• Right to erasure (Art. 17) — You may request deletion of your personal data where there is no legitimate reason for us to continue processing it.
• Right to restriction of processing (Art. 18) — You may request that we restrict processing of your data in certain circumstances.
• Right to data portability (Art. 20) — Where processing is based on consent or contract, you may request your data in a structured, machine-readable format.
• Right to object (Art. 21) — You may object to processing based on legitimate interests at any time.
• Rights related to automated decision-making — We do not carry out solely automated decision-making that produces significant effects on individuals.

To exercise any of these rights, please contact us at [email protected]. We will respond within one month of receipt of your request. We may need to verify your identity before processing your request.

If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk, telephone 0303 123 1113.

Where we use infrastructure or processors located outside the United Kingdom or European Economic Area, we ensure that appropriate safeguards are in place for the transfer of personal data, such as:

• UK adequacy regulations;
• Standard contractual clauses approved by the ICO; or
• Other lawful transfer mechanisms.

We will provide details of applicable transfer mechanisms upon request.

We may update this Privacy Policy from time to time to reflect changes in the Platform, applicable law, or our data practices. We will post the updated policy on this page with a revised "Last Updated" date. Where changes are material, we will take reasonable steps to notify users (for example, by a prominent notice on the Platform).

Continued use of the Platform after the effective date of any changes constitutes acceptance of the updated Privacy Policy.