Legal
Privacy Policy
Version 1 · Effective 2026-09-08
This policy explains what personal data QuizQuest collects, why, where it is stored, who else touches it, and what you can ask us to do about it.
It covers both QuizQuest apps: the admin app used by institutions and their staff, and the player app used by students and public players.
We have tried to write it plainly and to be specific. Where we name a company or a country below, that is because your data really does go there.
1. Who we are
Craftura Innovations (OPC) Private Limited (CIN U62013AP2026OPC126908), 3-639, Near SLN Function Hall, Gorantla, Sri sathya Sai District - 515231, Andhra Pradesh, India, operates QuizQuest.
Under the Digital Personal Data Protection Act, 2023, our role depends on whose data it is:
- For staff accounts and public players, we are the Data Fiduciary. We decide what is collected and why.
- For student data belonging to an institution, we act on that institution's instructions and for its purposes. The institution is the one with the relationship to the student and their parents, and the one responsible for obtaining consent.
2. What we collect
2.1 Everyone with an account
- Name, email address, and password. Passwords are handled by Google Firebase Authentication and are never visible to us or stored in our database.
- Phone number, where given.
- Profile photo, where uploaded.
- Which role the account has, and which institution and classes it belongs to.
- Account timestamps: when it was created, when it was last updated.
- A device notification token, if you allow notifications. This identifies a device, not a person, and is removed when you turn notifications off.
2.2 Institutions
Institution name, address, contact phone number, type (school, college, coaching), examination board, state, and logo. The names of its classes, and which staff and students belong to each.
2.3 Students and players
- Everything in 2.1.
- Quiz and exam activity: which sets were played, answers given, scores, time taken, ranks, and results.
- Progress: experience points, level, daily streak, badges earned, and the summaries and leaderboards derived from those.
- Homework and assignment submissions, where an institution sets them.
- For a hosted live quiz: the display name shown to the class, the answer chosen for each question, and when it was submitted.
2.4 Content you create or upload
Question sets, papers, notes, notices and assignments you author. Material you scan or paste to generate questions from, together with your confirmation that you had the right to use it, your account, and the date and time (see 4.3).
2.5 Technical data
- Error reports when something in the app fails, including the screen it happened on and the account it happened to.
- A record of each artificial-intelligence request made from your account: which feature, which model, how much it cost, and when.
We do not collect location data, contacts, advertising identifiers, or browsing activity outside the app.
2.6 What we deliberately do not do
- We do not sell personal data. To anyone. Ever.
- We do not show advertising, and we do not profile anyone for advertising.
- We do not track children's behaviour for any purpose other than showing them and their teacher their own progress.
- We do not use your content or your students' data to train artificial-intelligence models.
3. Where it comes from
Most of it you give us directly, when you create an account or use the app.
Some student data reaches us from the institution: when a school enrols a class in bulk, or invites a student by email, it gives us that student's name and email address before the student has an account. If you are a student or a parent and want to know what your institution has given us, ask the institution first — they hold that list.
Some is generated by using the app: your scores, your streak, your progress.
4. Why we use it, and on what basis
| What for | Data used |
|---|---|
| Creating and securing your account | 2.1 |
| Putting you in the right institution and class, and showing you the right content | 2.1, 2.2 |
| Running quizzes, exams and homework, and marking them | 2.3 |
| Showing progress, leaderboards and reports to you and your teacher | 2.3 |
| Generating draft questions and notes when you ask for them | 2.4 |
| Sending notifications you have opted in to | 2.1 |
| Fixing faults and keeping the service secure | 2.5 |
| Meeting our legal obligations | as required |
We rely on your consent, given when you create an account and accept this policy; and for students under 18, on the consent obtained by the institution from a parent or lawful guardian. Where the law allows us to process data for a legitimate use without consent — for example, to comply with a court order — we do so only to the extent it allows.
4.1 Automated decisions. Marking a quiz is automated. Nothing else about you is decided automatically, and no automated decision has a legal effect on you.
4.2 Scanned pages stay on your device. When you scan a page in the admin app, the photograph is read on the device itself. Only the recognised text is sent onwards. The image never leaves your phone and we never receive it.
4.3 Confirmations about uploaded material. When a staff member supplies material to an AI feature, we record their confirmation that they had the right to use it, what they said it was, their account, and the time. We keep these for as long as we may need them to answer a rights holder's complaint. They are visible only to us.
5. Who else touches your data
We use these providers to run QuizQuest. They process data on our instructions.
| Provider | What for | Where |
|---|---|---|
| Google (Firebase Authentication) | Sign-in and passwords | United States |
| Google (Cloud Firestore) | The main database — accounts, content, results | India (Mumbai) |
| Google (Realtime Database) | Live quiz sessions while they are running | United States |
| Google (Cloud Functions) | Server-side processing | India (Mumbai) |
| Google (Firebase Cloud Messaging) | Push notifications | United States |
| Expo | Delivering push notifications to devices | United States |
| Cloudflare (R2) | Files: published question sets, notes, images, logos | Outside India |
| OpenAI | Generating questions and notes when asked | United States |
5.1 What goes to the AI provider. Only what a feature needs: a description of what you asked for, and where you supplied material, that material's text. Your name, your students' names, and your account identifiers are not sent. We have instructed the provider not to use it to train their models.
5.2 Live quiz data leaves India while a quiz is running. A hosted live quiz runs in the United States for technical reasons — the display name shown to the class, each answer, and each score, for as long as the session lasts. When the quiz ends, the results are written to the database in India and the live copy is deleted.
5.3 Cross-border transfer. As the table shows, some processing happens outside India. We transfer personal data outside India only to these providers and only for the purposes above, and we do not transfer it to any country the Government of India has restricted.
5.4 Others. We will disclose personal data to a court, regulator or law enforcement agency where we are legally required to. If our business is sold or merged, data may transfer to the buyer, who will be bound by this policy or one no less protective; we will tell you first.
6. Children
Most QuizQuest students are children. We take this seriously and it constrains what we build.
- We do not show advertising to anyone, and we do not profile or behaviourally track children.
- A student's account holds only what teaching needs: who they are, which class they are in, and how they are doing.
- Where a student joins through an institution, that institution confirms to us that it has the consent required — including a parent's or guardian's verifiable consent where the student is under 18.
- A parent or guardian may ask us, through the institution or directly, what data we hold about their child, ask us to correct it, or ask us to delete it. See section 9.
If you believe a child's data is on QuizQuest without proper consent, write to crafturainnovations@gmail.com and we will act on it.
7. Where it is stored, and for how long
7.1 Storage. As set out in section 5. Our primary database is in India.
7.2 Retention.
- Your account and its content: kept while the account exists.
- Quiz and progress history: kept while the account exists, because it is the student's own record of what they have done.
- Live quiz session data: deleted as soon as the quiz ends.
- Error reports: deleted automatically after a short retention period.
- AI request records: deleted automatically after 90 days.
- Confirmations about uploaded material (4.3): kept for as long as we may need them to answer a complaint, and not deleted with the account that made them.
- Records the law requires us to keep: kept for as long as it requires.
7.3 When an institution leaves. Its content, rosters, reports and staff accounts are permanently deleted from every system that holds them, including file storage. Student accounts are not deleted — the student keeps their account, their history and their progress, and becomes an ordinary player who can join somewhere else.
8. Security
- Everything travels over encrypted connections, and is encrypted at rest by our providers.
- Access is enforced at the database itself, not only in the app: rules stop one institution from reading another's data, and stop any client from reading answer keys.
- Passwords are handled by Google and are never stored by us.
- Photographs you scan never leave your device (4.2).
- Access to production systems is limited to those who need it.
No system is perfectly secure. If a breach occurs that is likely to affect you, we will notify you and the Data Protection Board of India as the law requires.
9. Your rights
Under the DPDP Act 2023 you may:
- Ask what we hold about you, and why.
- Ask us to correct anything inaccurate, incomplete or out of date.
- Ask us to delete your personal data, where we do not need it for a legal reason.
- Withdraw consent — though this may mean you can no longer use the service.
- Nominate someone to exercise these rights for you if you die or become incapacitated.
- Complain to us first, and to the Data Protection Board of India if we do not resolve it.
To exercise any of these, write to crafturainnovations@gmail.com. We will respond within 30 days. We may need to verify your identity first.
If you are a student at an institution: ask your institution as well. They control your enrolment, and much of what you want changed can be changed by them faster than by us.
10. On your device
The apps store some information locally on your device so they work well: your sign-in session, your theme preference, cached content so the app opens quickly, and any unsaved draft so a crash does not lose your work. The admin app on the web uses browser storage for the same purposes. None of this is used for advertising or shared with anyone. Clearing the app's data, or signing out, removes it.
11. Notifications
If you allow notifications, we send them for things that concern you: an assignment set, a quiz starting, a notice from your institution. You can turn them off in your device settings at any time; nothing else stops working.
12. Changes to this policy
We may update this policy. When we make a change of substance we will publish the new version and ask you to accept it the next time you open the app, telling you what changed. Older versions are retained and available on request.
You can read the current version at any time at https://quiz-quest.org/legal/privacy, and inside either QuizQuest app from the profile screen. If you would prefer a copy by email, write to the address in section 13 and we will send you one.
13. Contact
For anything about your personal data:
Data Protection contact: Gandham Sreedhar Email: crafturainnovations@gmail.com
For complaints, including under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021:
Email: crafturainnovations@gmail.com
Postal address for both:
Craftura Innovations (OPC) Private Limited CIN: U62013AP2026OPC126908 3-639, Near SLN Function Hall, Gorantla Sri sathya Sai District - 515231, Andhra Pradesh, India
If we do not resolve your complaint, you may complain to the Data Protection Board of India.