Privacy Policy

Last updated: September 26, 2026

1. Data Controller

The data controller responsible for your personal data is:

Julius Schröder
Eppendorfer Baum 34, 20249 Hamburg, Germany
Email: hello@quizcamapp.com

2. Overview

This Privacy Policy explains how we collect, use, store, and protect your personal data when you use the Quizcam mobile application ("App") and the website at quizcamapp.com ("Website"), collectively the "Service." We are committed to protecting your privacy and complying with the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), and other applicable data protection laws.

3. What Data We Collect

3.1 Account Data (optional)

If you choose to sign in, we collect:

• Apple Sign-In: Your Apple-provided user identifier and, if you choose to share it, your name and email address.
• Google Sign-In: Your Google-provided user identifier, name, and email address.

You may also use the App anonymously. Even in anonymous mode, a technical user identifier (Firebase UID) is created to enable the core functionality of the Service. This identifier is not linked to any personal information unless you choose to sign in.

3.2 User-Provided Content

When you create quizzes, we process:

• Photos captured via the camera for text extraction.
• PDF documents you upload for text extraction.
• Text you provide directly (e.g., pasted or typed content).

Files are uploaded via short-lived signed URLs directly to Google Cloud Storage. The generated quiz (title, questions, answer options, hints and explanations) is stored in Google Cloud Firestore. The text recognised in your material is stored together with the quiz in Google Cloud Firestore, so that further questions can be created from the parts of your material that have not been asked yet and so that the App can tell you which pages a quiz covers. This text is never shown to other users and is never part of a challenge. If you upload a long PDF, further pages of the uploaded file are read only when you ask for more questions. Additionally, OCR processing may produce temporary output artifacts in Cloud Storage, which are deleted after processing is complete.

3.3 App Usage and Diagnostic Data

As of version 1.0.4, the App uses the following services to collect pseudonymous usage and diagnostic data:

• Firebase Analytics (Google LLC): App usage patterns, session data, screen views, funnel events (e.g. "quiz created", "quiz completed"), device type, operating system version, app version, language, and approximate geographic region (country/city). Since version 2.0 this includes learning events: completed reviews with the number of questions and correct answers, the length of your study streak, hidden questions (with technical quiz and question identifiers only), and, when you set or change an exam date, a rough range until the exam (under two weeks, two weeks to two months, more than two months), never the date itself. Questions, answers and the content of your notes are not sent to Firebase Analytics. Data is processed by Google LLC.
• Firebase Crashlytics (Google LLC): Crash reports including stack traces, device model, iOS version, app version, and a technical session identifier. Used solely for stability analysis. Data is processed by Google LLC.
• Apple MetricKit: Aggregated performance diagnostics (hangs, energy usage, disk activity). Data is processed exclusively by Apple and only transmitted if you have consented in iOS Settings under "Privacy & Security → Analytics & Improvements".

No identification beyond the device identifier takes place. We do not use app tracking (no IDFA, no cross-app tracking). A separate consent banner is therefore not required; Apple's App Tracking Transparency framework handles user consent at the system level.

3.4 On-Device Data

Certain data is stored locally on your device and does not leave it. This includes: your learning history and review schedule (which question comes back when), the exact exam date, appearance preferences, layout preferences, cached quiz content (titles, questions, answers), and entitlement/subscription status. This data is not accessible to us. A few summarized values from it, such as the length of your study streak or the number of questions reviewed, are sent to Firebase Analytics as usage events (see 3.3). Your display name is also stored on your device; it leaves the device only when you start or play a challenge (see 3.9).

3.5 Payment Data

All payments are processed by Apple through In-App Purchase. We do not collect, process, or store any payment information such as credit card numbers. Apple's privacy policy governs the processing of your payment data.

So that Premium also applies on our server, the app sends the transaction information of your subscription, as signed by Apple. We verify the signature and store the original transaction identifier together with the technical user identifiers that use this subscription (at most three, so that a subscription cannot be shared without limit). Identifiers that have not been used for a long time are removed automatically, yours immediately upon account deletion. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

3.6 Website Access Data

The website is hosted by Vercel Inc. When you visit it, Vercel processes your IP address and technical access data (time, requested page, browser type) to deliver the page and for security purposes. The website sets no cookies. To understand which pages are used, it loads Vercel Web Analytics, a cookieless first-party service: it records the page viewed, the referring page, the country derived from your IP address, and your browser, operating system and device type. Visitors are not identified or followed across websites; Vercel counts visits using a hash of request data that is discarded after 24 hours, and your IP address is not stored for this purpose. Legal basis: our legitimate interest in improving the website (Art. 6(1)(f) GDPR). The page on which challenges are played (quizcamapp.com/c/) does not load this service.

3.7 Contact Inquiries

When you contact us by email, we process your email address and the content of your message to respond to your inquiry. The legal basis is your legitimate interest in having your inquiry processed (Art. 6(1)(f) GDPR) or the performance of pre-contractual measures (Art. 6(1)(b) GDPR).

3.8 Backend Logs

Our backend servers generate technical logs for security and debugging purposes. The standard request logs of our hosting infrastructure (Google Cloud Run) contain your IP address, HTTP method and path, status code and response time. Our own log entries contain request identifiers, status codes, response times, error codes, challenge codes and technical metadata, plus pseudonyms of your technical user identifier, your IP address and, where applicable, your subscription transaction. These pseudonyms are formed with a secret key that exists only on our server and cannot be traced back to the original values without it. Quiz titles and quiz content are not logged. In some cases, file paths containing your technical user identifier may appear in log entries. Logs are stored in Google Cloud Logging, whose storage location is "global" and may therefore be outside the EU (see section 7). We apply data minimization principles and do not use log data for profiling.

3.9 Challenges

A challenge lets you send one round of a quiz to other people through a link (quizcamapp.com/c/ followed by a code). Starting or playing a challenge is optional.

• When you start a challenge: we store a copy of that quiz round (title, questions, answer options, correct answers and explanations), your display name and your score, linked to your technical user identifier. The copy never contains your photos, your PDF or the text extracted from them. Please do not start a challenge from a quiz whose questions contain personal information about other people.
• When you play a challenge: we store the name you enter, your score, which questions you answered correctly and the time you needed. A nickname is sufficient and no account is required. If you play in the App, the entry is linked to your technical user identifier so that it is deleted together with your account. If you play in the browser, the entry is not linked to any identifier, and the page stores your result in your browser's local storage so that it can show it again. No cookies are set.
• Who can see it: anyone who has the link can see the quiz round and the leaderboard with names, scores and times. Links are unlisted: they are not published, not searchable and excluded from search engines. There are no public profiles, friend lists or global leaderboards.
• Reports: every challenge can be reported. We store the reason you select. To prevent a single person from blocking a challenge, reports are counted per network: we store a pseudonym of your IP address (for IPv6 only its leading part), formed with a secret server key. It cannot be traced back to the address without that key and is deleted with the challenge. We review reports and remove content that violates our terms.
• Abuse protection: to limit automated requests we count requests per IP address in server memory for up to 24 hours. This counter is not written to a database. Independently of that, your IP address appears in the standard request logs of our hosting infrastructure (see 3.8).

Legal basis: performance of the service you request (Art. 6(1)(b) GDPR); for reports and abuse protection, our legitimate interest in a safe service (Art. 6(1)(f) GDPR).

3.10 App Integrity Check

To protect the Service against automated abuse, the App uses Firebase App Check with Apple's App Attest. Your device obtains a cryptographic confirmation from Apple that the request comes from a genuine copy of the App on a genuine Apple device. Google verifies this confirmation and issues a short-lived token, which the App sends with certain requests. The confirmation does not contain your name, your Apple ID or a device identifier that would allow tracking across apps. Legal basis: our legitimate interest in protecting the Service against abuse and the resulting costs (Art. 6(1)(f) GDPR).

4. How We Use Your Data

We use your data for the following purposes:

• Service delivery: Processing your uploaded content via OCR (Google Cloud Vision API) and AI (Google Vertex AI) to generate quiz questions. Legal basis: Contract performance (Art. 6(1)(b) GDPR).
• Challenges: Storing and displaying challenge rounds and leaderboards for the people who have the link (see 3.9). Legal basis: Contract performance (Art. 6(1)(b) GDPR).
• Account management: Managing your user account and syncing quiz data across sessions. Legal basis: Contract performance (Art. 6(1)(b) GDPR).
• Analytics and improvement: Understanding how the App is used, identifying funnel friction, and detecting stability and performance issues to improve features and user experience. Legal basis: Legitimate interest (Art. 6(1)(f) GDPR).
• Technical operation: Maintaining, securing, and debugging the Service, including server logging. Legal basis: Legitimate interest (Art. 6(1)(f) GDPR).
• Contact inquiries: Responding to your emails. Legal basis: Legitimate interest (Art. 6(1)(f) GDPR) or pre-contractual measures (Art. 6(1)(b) GDPR).

5. AI and Automated Processing

We use two Google Cloud services to process your content:

• Google Cloud Vision API: Used for optical character recognition (OCR) to extract text from your uploaded images and PDF documents.
• Google Vertex AI (Gemini): Used to generate quiz questions from the extracted text.

Your content is sent to these services from our backend servers in Frankfurt, Germany (Google Cloud region europe-west3). Text recognition runs on Google's EU endpoint of the Vision API, and quiz generation runs on Vertex AI on Google's EU multi-region endpoint, which keeps the processing within the European Union. Google processes this data as a data processor on our behalf. We do not use your content to train AI models. The processing is solely for extracting text and generating your quiz questions. The generation pipeline includes safety checks that may reject content deemed inappropriate. If we ever move this processing to a different region, we will update this section before the change takes effect.

The questions are generated automatically and may contain errors. No decisions with legal or similarly significant effects are made about you by automated means.

6. Data Sharing and Third-Party Services

We share data with the following service providers, who act as data processors:

• Google Cloud Platform (Google LLC): Backend infrastructure (Cloud Run), Cloud Firestore (database), Cloud Storage (file storage), Cloud Vision API (OCR), and Vertex AI (quiz generation). This data is stored and processed in the European Union: Cloud Run in Frankfurt (europe-west3), Vertex AI on Google's EU multi-region endpoint, Firestore and Cloud Storage in Google's EU multi-region, the Vision API on its EU endpoint.
• Apple Push Notification service (Apple Inc.): If you allowed notifications, the message "someone played your challenge" (the player's chosen name, the score and the quiz title) is delivered to your device through Apple.
• Firebase (Google LLC): Authentication (including anonymous accounts, Apple Sign-In, and Google Sign-In linking), analytics (Firebase Analytics), crash reporting (Firebase Crashlytics), and the app integrity check (Firebase App Check). These Firebase services may process data in the United States.
• Apple Inc.: Authentication (Sign in with Apple), payment processing (In-App Purchase), the device confirmation used by the app integrity check (App Attest) and, only with your system-level consent, anonymized performance diagnostics via MetricKit.
• Vercel Inc.: Hosting and cookieless web analytics of the website quizcamapp.com, including the page on which challenges are played in the browser. Vercel may process access data in the United States.

We do not sell your personal data. We do not share your data with advertisers.

7. International Data Transfers

Your quizzes, uploads and challenge data are stored and processed within the European Union (see section 6). Some of our providers are based in the United States, and a transfer of personal data to the United States cannot be ruled out for Firebase Authentication, Firebase Analytics, Firebase Crashlytics, Firebase App Check, the storage of server logs in Google Cloud Logging (see 3.8), the website hosting by Vercel, and for support access by Google to the cloud infrastructure. For these cases we rely on the following safeguards:

• EU Standard Contractual Clauses (SCCs) with our service providers.
• The certification of Google LLC and Vercel Inc. under the EU-US Data Privacy Framework (DPF).
• Additional technical measures including encryption in transit (TLS/SSL) and at rest.

8. Data Retention

• Account data and quiz data are retained as long as you maintain an active account.
• Uploaded files (photos, PDFs) are deleted from Cloud Storage automatically 30 days after upload, and immediately when you delete your account.
• The text recognised in your material is kept for as long as a quiz created from it exists. It is deleted when you delete the last quiz created from that material, and when you delete your account.
• If you allow notifications, the App registers a push token of your device with us so that we can tell you when someone has played your challenge. It is stored with your account, used for nothing else, removed when Apple reports it as no longer valid, and deleted with your account. You can switch notifications off in the iOS settings at any time.
• An exam date you enter stays on your device. When you set or change it, only a rough range until the exam is sent to Firebase Analytics as a usage event (see 3.3), never the date.
• Challenges can be played for 48 hours. After that the leaderboard remains visible to people with the link for another 30 days, then the challenge and all its entries are deleted automatically. Deleting the quiz or your account deletes its challenges immediately. Deleting your account also removes your entries in other people's challenges. An entry made in the browser is not linked to you; write to us with the link and the name you used and we will remove it.
• Temporary OCR processing artifacts (vision-output files) are deleted after processing is complete.
• Backend logs are kept for security and debugging purposes and deleted automatically after 30 days.
• Firebase Analytics data is retained per Google's default retention policy for up to 14 months.
• Firebase Crashlytics reports are retained for up to 90 days.
• MetricKit diagnostics are stored exclusively on Apple's servers; we have no control over their retention.
• Upon account deletion, your personal data, quiz data, and uploaded files are deleted from our servers, subject to any legal retention obligations. This includes your challenges, your challenge entries, and your user identifier in subscription assignments. The app also deletes your learning history on the device.
• Deleted data can remain in our database backups and in the Cloud Storage recovery store for up to 7 days before it is removed for good automatically. We use these copies only to restore the service after a technical failure.

9. Your Rights Under GDPR

As a data subject, you have the following rights:

• Right of access (Art. 15 GDPR): You may request confirmation of whether we process your data and obtain a copy.
• Right to rectification (Art. 16 GDPR): You may request correction of inaccurate personal data.
• Right to erasure (Art. 17 GDPR): You may request deletion of your personal data. You can delete your account directly in the App's Settings.
• Right to restriction (Art. 18 GDPR): You may request restriction of processing in certain circumstances.
• Right to data portability (Art. 20 GDPR): You may request your data in a structured, machine-readable format.
• Right to object (Art. 21 GDPR): You may object to processing based on legitimate interests, including analytics.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at hello@quizcamapp.com. We will respond within one month as required by law.

10. Additional Rights for California and Other US Residents

If you are a resident of California, Virginia, Colorado, Connecticut, or other US states with comprehensive privacy laws, you may have additional rights:

• Right to know: You may request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to delete: You may request deletion of your personal information. You can delete your account directly in the App's Settings, or contact us to request deletion.
• Right to correct: You may request correction of inaccurate personal information.
• Right to opt-out of sale/sharing: We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising. If this changes in the future, we will provide an opt-out mechanism.
• Non-discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise these rights, contact us at hello@quizcamapp.com. We will verify your identity before processing requests. You may also designate an authorized agent to submit requests on your behalf.

11. Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority. The competent authority for our business is:

Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany
Website: https://datenschutz-hamburg.de

12. Children's Privacy

The Service is intended for users aged 13 and older. It is not designed for younger children, and we do not knowingly collect personal data from children under 13. Users under 16 (or the applicable age of digital consent in their jurisdiction) need the consent of a parent or legal guardian. Challenges require no personal information: a nickname is sufficient, and the app and the challenge page explicitly ask for a nickname rather than a real name. If you believe we have inadvertently collected data from a child under 13, or from a child under 16 without proper consent, please contact us immediately and we will take steps to delete such data.

13. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include encrypted data transmission (TLS/SSL), short-lived signed upload URLs, secure cloud infrastructure, access controls, and safety checks in our content processing pipeline. However, no method of electronic storage or transmission is 100% secure.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, including the activation of analytics services, we will notify you through the App or by other reasonable means. The "Last updated" date at the top indicates the most recent revision. Your continued use of the Service after changes constitutes acceptance of the updated Privacy Policy.

15. Contact

For any questions or concerns about this Privacy Policy or our data practices, please contact:

Julius Schröder
Email: hello@quizcamapp.com