Privacy Policy

01. Introduction, Scope & Core Principles

This Privacy Policy constitutes a legally binding document that governs your access to and interaction with the Quizs mobile application (available on Google Play Store and Apple App Store under package identifier com.quizs.application.arknox), its associated backend application programming interfaces (APIs), web endpoints hosted at https://quizs.in, and any associated customer support and notification channels (collectively designated as the "Service").

By downloading, installing, launching, creating an account on, or otherwise utilizing Quizs, you acknowledge that you have read, understood, and consented to the collection, disclosure, storage, and processing practices detailed within this comprehensive policy. If you do not agree with any provision contained herein, you must refrain from downloading the application, terminate existing sessions, and delete any associated user accounts immediately.

Our operations are firmly rooted in modern international data protection standards, including the General Data Protection Regulation (EU & UK GDPR), the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), the Children's Online Privacy Protection Act (COPPA), the Information Technology Act, 2000 and Digital Personal Data Protection Act, 2023 (India), and the strict developer guidelines promulgated by the Google Play Developer Distribution Agreement and the Apple App Store Review Guidelines.

We adhere strictly to four foundational privacy tenets:

• Data Minimization: We only collect information strictly required to authenticate your identity, calculate your educational test scores, preserve your learning streaks, present relevant ads that sustain free access, and maintain application stability.
• No Selling of Personal Data: We never monetize, sell, trade, broker, or lease your private personal identifiable information (PII) to data aggregators or third-party marketing firms for direct cash remuneration.
• Explicit User Control: You maintain continuous, uninhibited authority to inspect, update, download, or permanently eradicate your personal profile and gameplay records directly through in-app self-service mechanisms.
• Security by Design: Every communication channel utilizes modern TLS 1.3 cryptographic protocols, sensitive authentication secrets are stored within hardware-backed device keystores, and server passwords undergo non-reversible salt-hashed cryptographic stretching.

02. Data Controller & Contact Information

For the purposes of applicable data protection legislation (including Art. 4(7) of the GDPR and equivalent definitions under global statutes), the designated Data Controller responsible for the stewardship of your personal data collected via the Quizs platform is:

Any questions, formal inquiries, notices of data subject requests, or regulatory communications regarding our data stewardship should be directed via registered electronic transmission to quizsappliaction@gmail.com. We strive to acknowledge all legitimate inquiries within twenty-four (24) to forty-eight (48) business hours and provide substantive responses within statutory time limits (no later than 30 calendar days).

03. Categories of Personal Data We Collect

Depending on whether you navigate the Quizs application as an authenticated account holder, a guest explorer, or an active competitive quiz participant, we may collect and process specific categories of data outlined in the detailed taxonomy below:

3.1 Information You Explicitly Provide to Us

• Registration & Profile Identifiers: When creating a direct user account, you provide your legal or chosen display name, a valid electronic mail address (used for account verification, password recovery, and transactional notifications), and an encrypted authentication password. If you choose to personalize your avatar, you may upload an image via your camera or local photo library.
• Google OAuth Identity Tokens: If you elect to authenticate using "Continue with Google", our application communicates via the official Google Sign-In SDK. Google transmits a cryptographically signed OAuth2 identity token containing your verified primary email address, public display name, unique Google Subject ID, and public profile avatar URL. We do not receive, store, or have access to your Google account password.
• Preferences & Customization Settings: Your preferred instructional language (English or Hindi), in-game sound effect preferences (audio toggles), and notification preference flags stored within the app's secure preferences storage.
• Inquiries, Feedback & Support Content: Any voluntary communications you transmit to our support desk, including bug descriptions, screenshots, feature suggestions, or dispute claims regarding quiz answer keys.

3.2 Information Generated Through Quiz Play & Gamification

Quizs is an active educational gaming environment. In order to provide competitive leaderboards, dynamic question algorithms, attendance rewards, and performance metrics, our servers record and evaluate:

• Quiz Session Metrics: The specific category identifier (e.g., Mathematics, Science & Nature, World History, General Knowledge), subcategory or topic selected, quiz initiation timestamp, conclusion timestamp, completion duration per question, chosen option indices, and correctness evaluations.
• Scoring, XP & Level Progression: Accumulated experience points (XP), numeric user level (calculated via cumulative achievement curves), accuracy percentages (ratio of correct responses across all lifetime or periodic attempts), and earned in-game virtual coins.
• Attendance & Streak Records: Consecutive daily login check-in dates, streak continuity records, missed days, bonus coin multiplier milestones, and calendar history visible on the Attendance Screen.
• Public Leaderboard Rankings: Your display name, avatar, level, accuracy rate, and total points as compiled and publicly displayed on the Daily, Weekly, and All-Time global and regional leaderboards.

3.3 Automatically Collected Device, Diagnostic & Network Telemetry

When your device interacts with our APIs or loads application views, our automated telemetry capture mechanisms and integrated software development kits (SDKs) process:

• Hardware & Platform Telemetry: Device manufacturer (e.g., Samsung, Xiaomi, Apple, Google), device model designation, CPU architecture, screen dimensions, pixel density, operating system name and version (e.g., Android 14, iOS 17), system language locale, and time zone setting.
• Network & Connectivity Data: Internet Protocol (IP) address utilized upon connection (used transiently for geolocation country determination and DDoS security mitigation), internet service provider (ISP), connection medium (Wi-Fi, Cellular LTE, 5G), and HTTP request headers.
• Advertising & Vendor Identifiers: The Google Advertising ID (GAID on Android devices) or Identifier for Advertisers (IDFA on iOS devices, collected solely where permitted by Apple App Tracking Transparency framework). These pseudonymous identifiers facilitate the delivery, frequency capping, and reporting of in-app banner, interstitial, and rewarded advertisements.
• Crash & Exception Telemetry (Firebase Crashlytics): In the event of an unhandled runtime exception or application crash, Crashlytics records stack traces, memory usage metrics at the moment of failure, storage availability, orientation state, and application build number to enable our engineering team to rapidly isolate and patch defects.
• Push Notification Tokens (FCM): A unique Firebase Cloud Messaging registration token generated by Google services on your device, used exclusively to address push alerts to your individual handset.

04. Methods & Technologies of Data Collection

We employ industry-standard, secure methodologies to capture and synchronize data across your mobile hardware and our cloud servers:

• Direct API Transmission: When you tap to answer a quiz question, update your profile, or verify your email, structured JSON payloads are securely transmitted across TLS 1.3 encrypted HTTPS tunnels to our Laravel cloud endpoints.
• Secure Device Storage: Session authentication tokens (Bearer JWTs) and user cryptographic secrets are stored client-side utilizing FlutterSecureStorage, which binds secrets to the Android Keystore or iOS Keychain hardware security module (HSM). Non-sensitive user preferences (e.g., audio toggle state, cached language) reside in sandboxed SharedPreferences.
• Third-Party Mobile SDKs: Google Play Services, Firebase SDKs, and Google Mobile Ads SDK run embedded within the application client to safely collect hardware telemetry, deliver localized banner slots, and manage push notifications.

05. Legal Bases for Processing (GDPR & Global Standards)

Under European, British, and corresponding global data protection jurisdictions, data controllers must establish an express lawful basis for each processing activity. We process your personal data under the following legitimate legal frameworks:

06. Detailed Purposes of Data Processing

We process the personal information we accumulate exclusively for the legitimate, transparent operational objectives set forth below:

• Provision of Interactive Quizzes: Dynamically retrieving category-specific questions in your chosen language (English or Hindi), evaluating submitted options against authorized answer keys, calculating real-time score additions, and delivering detailed explanations to augment your educational learning journey.
• Progression & Gamification Architecture: Calculating accurate user Level milestones, updating lifetime and category-specific accuracy percentages, tracking consecutive attendance check-in streaks, awarding bonus virtual coins, and maintaining persistent user statistics across sessions and device upgrades.
• Community & Social Motivation: Publishing real-time rank positions on the Daily, Weekly, and All-Time Leaderboard rosters. If you prefer anonymity, you may choose an abstract display pseudonym and default avatar.
• Communications & Service Notices: Transmitting necessary administrative notices regarding your account security, policy revisions, OTP verification codes for password resets, or responses to customer service inquiries initiated through support channels.
• Push Notifications: Delivering opt-in reminders to encourage daily learning habits, prevent attendance streak loss, notify you of newly published quiz topics, or highlight periodic competitive tournaments.
• Platform Security & Fair Play Enforcement: Monitoring API traffic patterns to block distributed denial of service (DDoS) threats, detect automated scripts, prevent decompiled client exploits, and ban accounts attempting to inject fraudulent scores onto leaderboards.

07. Ad-Free Policy & No Commercial Tracking

Quizs is dedicated to delivering an uninterrupted, privacy-respecting educational trivia experience. The Application is operated as a completely ad-free platform.

We do not integrate the Google Mobile Ads SDK (AdMob) or any third-party ad network. We do not display banner advertisements, interstitial pop-ups, or rewarded video advertisements. Furthermore, Quizs does not collect, record, or transmit device advertising identifiers (such as Google Advertising ID / GAID on Android or IDFA on iOS) to ad technology vendors, data brokers, or behavioral tracking entities.

08. Third-Party Service Providers & Subprocessors

We do not sell your personal data. To deliver a seamless, scalable, and resilient application experience, we entrust specialized third-party cloud infrastructure and software vendors ("Subprocessors") with limited processing duties. All subprocessors are vetted for compliance with global privacy regulations and operate under binding Data Processing Agreements (DPAs):

09. Push Notifications & Local Alerts

Quizs utilizes push notifications via Firebase Cloud Messaging (FCM) and scheduled local reminders via flutter_local_notifications to keep you informed and motivated.

• Types of Notifications: Daily study alerts, notices that your consecutive attendance streak is about to expire, notifications when new educational categories or challenge quizzes are published, and milestone alerts when you achieve a new player Level or leaderboard rank.
• User Consent: In compliance with Android 13+ (API level 33) and iOS requirements, Quizs explicitly requests runtime notification permission (POST_NOTIFICATIONS) before dispatching remote alerts.
• Granular Control: You can completely disable push notifications at any time directly within the application by navigating to Profile Screen > Notification Toggle, or via your handset's system settings under Settings > Apps > Quizs > Notifications.

10. Device Permissions & Hardware Access Explained

Our mobile application requests only the minimum device permissions strictly required to execute core functionality. We provide complete transparency regarding each permission requested:

11. Data Storage, Architecture & Cryptographic Security

Protecting your personal data against unauthorized disclosure, interception, destruction, or compromise is a core engineering priority. We maintain industry-standard physical, organizational, and electronic safeguards:

• Encryption in Transit: All data exchanged between your mobile device and our backend servers travels exclusively across encrypted Transport Layer Security (TLS 1.3 and TLS 1.2) tunnels with forward secrecy and strict HTTPS enforcement. Plaintext HTTP traffic is rejected at the edge.
• Client-Side Hardware Keystore: All sensitive authentication tokens (Bearer JWTs), refresh credentials, and cryptographic keys stored on your mobile hardware are encrypted via FlutterSecureStorage. On Android, keys are generated and shielded within the hardware-backed Android KeyStore provider with AES-256-GCM cipher suites. On iOS, tokens reside in the encrypted iOS Keychain.
• Password Hashing: User account passwords are never stored in readable plaintext. Passwords undergo irreversible salt-hashed stretching utilizing the modern bcrypt algorithm with a high work factor, rendering them immune to rainbow table lookups.
• Database Security at Rest: Cloud databases containing user profiles and quiz records reside within private virtual cloud networks (VPCs) with strict firewall rules, inaccessible from the public internet, and protected with AES-256 disk encryption at rest.
• Access Controls & Rate Limiting: All administrative endpoints enforce strict role-based access control (RBAC), multi-factor authentication, and automated rate-limiting algorithms to mitigate brute-force credential stuffing and credential harvesting.

11.2 Security Incident Response & Data Breach Notification Protocol

Quizs maintains a formalized, documented Information Security Incident Response Plan (IRP) designed to identify, contain, remediate, and report potential security compromises involving personal data without undue delay.

• Continuous Intrusion Detection: Our hosting infrastructure employs automated intrusion detection systems (IDS), web application firewalls (WAF), rate-limiting algorithms, and automated anomaly log analysis to identify brute-force credential stuffing, suspicious API payload patterns, or unauthorized database access attempts.
• Containment & Eradication Protocols: Upon detection of a confirmed or suspected security incident, our security engineering team immediately initiates isolation measures, including revoking compromised API credentials, rotating database encryption keys, severing affected compute instances, and inspecting historical audit trails.
• Regulatory Notification Mandate (72 Hours): In the unlikely event of a security incident resulting in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data, and where such breach presents a risk to the rights and freedoms of natural persons, Quizs will notify competent supervisory authorities (including the relevant European Data Protection Authorities under GDPR Art. 33 and the Indian Computer Emergency Response Team - CERT-In under applicable cyber security directives) within seventy-two (72) hours of becoming aware of the incident.
• Direct User Notification: If a data breach is determined to present a high risk to the rights and freedoms of affected individuals (such as unauthorized disclosure of login credentials), we will communicate the breach directly to affected account holders via an urgent notice sent to their registered electronic mail addresses and via an prominent in-app security bulletin. Such notification will describe the nature of the breach, the name and contact details of our Data Protection Officer, the likely consequences of the incident, and the specific mitigation measures implemented or recommended to users (such as credential resets).

12. Data Retention & Disposal Schedules

We do not retain personal information longer than is strictly necessary to fulfill the purposes described in this Privacy Policy, satisfy our contractual obligations, or comply with legal mandates:

• Active User Accounts: Your profile data, level progression, badges, virtual coins, accuracy rates, and attendance records remain preserved in our active database for as long as your account remains open and in good standing.
• Quiz Attempt History: Granular question-by-question attempt logs are retained to compute historical accuracy trends, leaderboard rankings, and anti-cheat validation for up to twenty-four (24) months, after which they are either aggregated into non-identifiable statistical totals or deleted.
• Crash & Diagnostic Reports: Firebase Crashlytics telemetry data is automatically purged on a rolling ninety (90) day retention schedule per Google's default security standard.
• Server Access Logs: Web server connection logs (recording IP address, timestamp, requested URI, and user agent string) are preserved for thirty (30) days for intrusion detection and security auditing, then permanently overwritten.
• Inactive Accounts: If an account demonstrates no login activity or API interactions for a continuous period of twenty-four (24) consecutive months, we reserve the right to archive or purge the inactive profile after transmitting advance notice to the registered email address.

13. Account Deletion & Data Erasure (Play Store §13.3 Compliance)

In accordance with Google Play's User Data Policy regarding Account Deletion and international privacy rights (such as GDPR Art. 17 "Right to Erasure"), Quizs provides seamless, transparent, and direct pathways for users to permanently delete their accounts and all associated data.

13.1 Instant In-App Deletion

You do not need to send an email or submit a help ticket to delete your account. You can trigger immediate, permanent deletion directly inside the application at any time:

1. Open the Quizs application and sign in to your account.
2. Navigate to the Profile Screen (bottom navigation tab).
3. Tap the edit pencil icon or open Edit Profile (/edit-profile).
4. Scroll down and tap the red Delete Account button.
5. Review the permanent deletion warning modal and confirm your decision.

Once confirmed, our backend executes an automated cascading deletion procedure that permanently eradicates your user row, profile details, password hashes, email address, custom avatars, attendance calendar check-ins, quiz attempt records, notification preferences, and push device tokens from our active database. Client-side authentication tokens stored in your device keystore are cleared immediately, and you are logged out.

13.2 Direct Web-Based Deletion Portal

If you have uninstalled the application or cannot access your mobile handset, you can permanently delete your account directly through our official web deletion portal at https://quizs.in/delete-account. Simply enter your registered account email and confirm your deletion request. Our servers will immediately execute the cascading purge procedure and wipe your account.

Alternatively, you may transmit an email from your registered email address to quizsappliaction@gmail.com with the subject line "Account Deletion Request".

14. Your Global Privacy Rights (GDPR, CCPA/CPRA, DPDPA)

Depending on your place of domicile, you are endowed with statutory legal rights regarding the personal information held about you:

14.1 Rights for European Economic Area (EEA) and United Kingdom Residents (GDPR)

• Right of Access (Art. 15): You have the right to obtain confirmation as to whether your personal data is being processed, and request a structured copy of that data.
• Right to Rectification (Art. 16): You may correct inaccurate or incomplete profile details at any time via Profile > Edit Profile.
• Right to Erasure ("Right to be Forgotten", Art. 17): You may demand the permanent deletion of your personal records, as detailed in Section 13.
• Right to Restrict Processing (Art. 18): You have the right to request a temporary pause on the processing of your personal data under specific contested circumstances.
• Right to Data Portability (Art. 20): You may request an export of your account and quiz statistics in a machine-readable JSON or CSV format.
• Right to Object (Art. 21): You may object to data processing grounded in our legitimate interests, including the right to opt-out of behavioral profiling and direct marketing.
• Right to Withdraw Consent (Art. 7(3)): Where processing relies on your consent (e.g., push notifications, personalized ads), you can withdraw consent at any time without penalty.

14.2 Rights for California Residents (CCPA / CPRA)

• Right to Know: California consumers have the right to request disclosure of the specific categories and pieces of personal information collected, the sources of collection, the commercial purposes of collection, and the categories of third parties with whom data is shared over the preceding 12 months.
• Right to Delete: You have the right to request the deletion of your personal information, subject to statutory exceptions (such as detecting security incidents or complying with legal obligations).
• Right to Correct: You have the right to request rectification of inaccurate personal records.
• Right to Opt-Out of Sale or Sharing: Quizs does not sell personal information for monetary remuneration. However, under the CCPA's broad definition of "sharing" for cross-context behavioral advertising, transferring advertising identifiers (such as GAID/IDFA) to ad networks may constitute "sharing". You can opt out via operating system ad tracking toggles or our in-app consent preferences.
• Right to Non-Discrimination: We will never deny services, charge different prices, or degrade your gameplay experience because you exercised any of your CCPA rights.

14.3 Rights for Indian Residents (Digital Personal Data Protection Act, 2023)

• Right to Access Summary: The right to obtain a summary of personal data being processed and the processing activities undertaken.
• Right to Correction & Erasure: The right to have misleading, inaccurate, or outdated personal data rectified or permanently erased.
• Right to Grievance Redressal: The right to readily accessible grievance redressal mechanisms through our Grievance Officer at quizsappliaction@gmail.com.
• Right to Nominate: The right to nominate an individual who, in the event of death or incapacity, shall exercise your privacy rights.

14.4 Notice to Residents of Other US States (Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana)

If you reside in Virginia (Virginia Consumer Data Protection Act), Colorado (Colorado Privacy Act), Connecticut (Connecticut Data Privacy Act), Utah (Utah Consumer Privacy Act), Texas (Texas Data Privacy and Security Act), Oregon, Montana, or another US state with enacted comprehensive consumer privacy statutes, you are endowed with rights analogous to those outlined for California residents. Specifically:

• Right of Access & Portability: You have the right to confirm whether Quizs processes your personal data and obtain a copy in a portable, readily usable format.
• Right to Correct Inaccuracies: You have the right to require correction of inaccuracies in your personal data, taking into account the nature of the data and purposes of processing.
• Right to Delete: You have the right to delete personal data provided by or obtained about you.
• Right to Opt Out of Targeted Advertising & Profiling: You have the right to opt out of the processing of your personal data for purposes of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects. Quizs does not engage in profiling producing legal consequences, and targeted advertising can be opted out of via operating system controls.
• Appeals Process: If Quizs declines to take action regarding your consumer rights request, you have the right to appeal our decision within forty-five (45) calendar days of receiving our denial notice. To submit an appeal, please email quizsappliaction@gmail.com with the subject line "Privacy Rights Appeal". We will respond within forty-five (45) days (or sixty (60) days where permitted by state statute) explaining our reasoning and providing instructions on how to submit a complaint to your state Attorney General if you remain dissatisfied.

15. Children's Privacy (COPPA & Global Standards)

Quizs provides educational, general audience trivia and quiz content encompassing school science, history, geography, mathematics, and literature. However, the application is strictly designed for individuals aged 13 years or older (or 16 years old in relevant European jurisdictions where mandated by local member state legislation).

We do not knowingly solicit, collect, or process personal identifiable information from children under the age of 13. If you are under 13 years of age, you are prohibited from creating an account or providing your name, email address, or photos to the application.

If a parent, legal guardian, or educator discovers that a child under 13 has registered an account with Quizs without parental verification, please notify us immediately at quizsappliaction@gmail.com. Upon receipt of verified notice, we will immediately delete the associated account and purge all related personal data from our cloud databases.

16. International Cross-Border Data Transfers

Quizs operates globally and serves users across multiple continents. Your personal information may be transferred to, stored at, and processed in cloud servers located outside your country of residence (including India and the United States, where Google and cloud hosting data centers are situated).

Whenever we transfer personal data across international borders, we ensure that adequate safeguards are instituted in full compliance with applicable statutory requirements:

• Utilizing the European Commission's approved Standard Contractual Clauses (SCCs) for data transfers between EU and non-EU entities.
• Relying on adequacy decisions promulgated by relevant regulatory authorities where applicable.
• Enforcing strict technical safeguards, including end-to-end transport layer encryption and AES-256 database storage encryption.

17. Cookies, Tracking Technologies & Local Cache

On our mobile client, we do not utilize traditional web browser cookies. Instead, our app utilizes localized native persistence mechanisms:

• Secure Storage (FlutterSecureStorage): Used exclusively to hold your authenticated session authorization token.
• Shared Preferences (SharedPreferences): Used to remember your selected language (English or Hindi), sound effects toggle state, and notification preference flags so that your app experience remains personalized upon restart.
• Web Portal Cookies: If you visit our public web portal at https://quizs.in, minimal session cookies and Cloudflare security tokens may be stored in your browser solely to route traffic and protect the server cluster against malicious web scrapers.

18. Anti-Cheat Telemetry & Fair Play Auditing

To ensure fair educational competition on our global leaderboards and protect our virtual coin economy from malicious manipulation, our backend automated systems monitor game telemetry for anomalies:

• Submitting answer responses at physiologically impossible speeds (e.g., answering 20 questions in 200 milliseconds).
• Repeated automated API calls indicative of headless bot scripts or scrapers.
• Attempting to alter client-side scoring logic or intercept and forge HTTP API payloads.

Telemetry collected for anti-cheat verification (such as response duration timestamps and client app build signatures) is strictly utilized for security and integrity verification and is never shared with third-party advertisers. Accounts verified to have utilized cheats, automation bots, or memory injectors are subject to immediate disqualification and permanent termination.

19. Policy Amendments, Versioning & Notifications

As the Quizs platform evolves with new features, expanded quiz categories, or altered regulatory frameworks, we may periodically revise this Privacy Policy.

When substantive, material changes are introduced to how we collect, store, or share your personal data, we will provide conspicuous notice before the updates take effect. Such notification may be delivered via an in-app banner modal, an alert displayed upon login, or an electronic transmission sent to your registered email address.

The date of the most recent revision will always be displayed prominently at the top and bottom of this document. We encourage you to periodically review this page to stay informed of our data protection practices. Continued utilization of the Quizs platform after the effective date of an amended policy constitutes affirmative acceptance of the revised terms.

20. Redressal, Supervisory Authorities & Contact

If you have questions, concerns, comments, or grievances regarding this Privacy Policy, our data stewardship, or if you wish to exercise any of your statutory privacy rights, please reach out to our dedicated privacy desk:

If you reside within the European Union, United Kingdom, or another jurisdiction with a designated Data Protection Authority (DPA) and believe that our processing of your personal data infringes applicable data protection statutes, you retain the right to lodge a formal complaint with your local supervisory regulatory authority (such as the Information Commissioner's Office in the UK, the CNIL in France, or the BfDI in Germany). However, we encourage you to contact us directly first so that we may promptly resolve your concerns in good faith.