Privacy Policy

Last updated: February 19, 2026

1. Data Controller

The data controller responsible for your personal data is:

Julius Schröder
Eppendorfer Baum 34, 20249 Hamburg, Germany
Email: hello@quizcamapp.com

2. Overview

This Privacy Policy explains how we collect, use, store, and protect your personal data when you use the Quizcam mobile application ("App") and the website at quizcamapp.com ("Website"), collectively the "Service." We are committed to protecting your privacy and complying with the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), and other applicable data protection laws.

3. What Data We Collect

3.1 Account Data (optional)

If you choose to sign in, we collect:

• Apple Sign-In: Your Apple-provided user identifier and, if you choose to share it, your name and email address.
• Google Sign-In: Your Google-provided user identifier, name, and email address.

You may also use the App anonymously. Even in anonymous mode, a technical user identifier (Firebase UID) is created to enable the core functionality of the Service. This identifier is not linked to any personal information unless you choose to sign in.

3.2 User-Provided Content

When you create quizzes, we process:

• Photos captured via the camera for text extraction.
• PDF documents you upload for text extraction.
• Text you provide directly (e.g., pasted or typed content).

Files are uploaded via short-lived signed URLs directly to Google Cloud Storage. The extracted text and generated quiz data are stored in Google Cloud Firestore. Additionally, OCR processing may produce temporary output artifacts in Cloud Storage, which are deleted after processing is complete.

3.3 App Usage Data

The App contains integrations for analytics services. As of the date of this policy, active analytics data collection has not been enabled. When activated, the following services may be used:

• Firebase Analytics: App usage patterns, session data, device type, operating system version, app version, crash data. Data is processed by Google LLC.
• Mixpanel: In-app events and interactions for product improvement. Data is processed by Mixpanel, Inc.

We will update this Privacy Policy before activating any analytics data collection. This data may then include device identifiers, interaction events, and aggregated usage statistics.

3.4 On-Device Data

Certain data is stored locally on your device using UserDefaults (iOS) and does not leave your device. This includes: your display name, streak progress, appearance preferences, layout preferences, cached quiz content (titles, questions, answers), and entitlement/subscription status. This data is not accessible to us.

3.5 Payment Data

All payments are processed by Apple through In-App Purchase. We do not collect, process, or store any payment information such as credit card numbers. Apple's privacy policy governs the processing of your payment data.

3.6 Website Access Data

When you visit the website, our hosting provider may log your IP address and access data for technical and security purposes.

3.7 Contact Inquiries

When you contact us by email, we process your email address and the content of your message to respond to your inquiry. The legal basis is your legitimate interest in having your inquiry processed (Art. 6(1)(f) GDPR) or the performance of pre-contractual measures (Art. 6(1)(b) GDPR).

3.8 Backend Logs

Our backend servers generate technical logs for security and debugging purposes. These logs may contain request identifiers, HTTP method and path, status codes, response times, error codes, and technical metadata. In some cases, file paths containing your technical user identifier may appear in log entries. We apply data minimization principles and do not use log data for profiling.

4. How We Use Your Data

We use your data for the following purposes:

• Service delivery: Processing your uploaded content via OCR (Google Cloud Vision API) and AI (Google Vertex AI) to generate quiz questions. Legal basis: Contract performance (Art. 6(1)(b) GDPR).
• Account management: Managing your user account and syncing quiz data across sessions. Legal basis: Contract performance (Art. 6(1)(b) GDPR).
• Analytics and improvement: When activated, understanding how the App is used to improve features and user experience. Legal basis: Legitimate interest (Art. 6(1)(f) GDPR).
• Technical operation: Maintaining, securing, and debugging the Service, including server logging. Legal basis: Legitimate interest (Art. 6(1)(f) GDPR).
• Contact inquiries: Responding to your emails. Legal basis: Legitimate interest (Art. 6(1)(f) GDPR) or pre-contractual measures (Art. 6(1)(b) GDPR).

5. AI and Automated Processing

We use two Google Cloud services to process your content:

• Google Cloud Vision API: Used for optical character recognition (OCR) to extract text from your uploaded images and PDF documents.
• Google Vertex AI (Gemini): Used to generate quiz questions from the extracted text.

Your content is sent to these services on our backend servers hosted in the United States (region: us-central1). Google processes this data as a data processor on our behalf. We do not use your content to train AI models. The processing is solely for extracting text and generating your quiz questions. The generation pipeline includes safety checks that may reject content deemed inappropriate.

6. Data Sharing and Third-Party Services

We share data with the following service providers, who act as data processors:

• Google Cloud Platform (Google LLC): Backend infrastructure (Cloud Run), Cloud Firestore (database), Cloud Storage (file storage), Cloud Vision API (OCR), and Vertex AI (quiz generation). Data is processed in the United States (us-central1) under EU Standard Contractual Clauses and the EU-US Data Privacy Framework.
• Firebase (Google LLC): Authentication (including anonymous accounts, Apple Sign-In, and Google Sign-In linking) and, when activated, analytics and crash reporting.
• Mixpanel, Inc.: Product analytics (when activated). Mixpanel processes data in the US under EU Standard Contractual Clauses.
• Apple Inc.: Authentication (Sign in with Apple) and payment processing (In-App Purchase).

We do not sell your personal data. We do not share your data with advertisers.

7. International Data Transfers

Our backend infrastructure is hosted in the United States (Google Cloud, region us-central1). Personal data is therefore transferred from the EU/EEA to the United States. We ensure appropriate safeguards are in place, including:

• EU Standard Contractual Clauses (SCCs) with our service providers.
• Google's certification under the EU-US Data Privacy Framework (DPF).
• Additional technical measures including encryption in transit (TLS/SSL) and at rest.

8. Data Retention

• Account data and quiz data are retained as long as you maintain an active account.
• Uploaded files (photos, PDFs) are retained in Cloud Storage as long as your account is active. Upon account deletion, all uploaded files are permanently removed.
• Temporary OCR processing artifacts (vision-output files) are deleted after processing is complete.
• Backend logs are retained for a limited period for security and debugging purposes, typically no longer than 30 days.
• Analytics data, when collection is activated, will be retained according to the retention policies of the respective providers (typically up to 14 months for Firebase, configurable for Mixpanel).
• Upon account deletion, your personal data, quiz data, and uploaded files are permanently deleted from our servers, subject to any legal retention obligations.

9. Your Rights Under GDPR

As a data subject, you have the following rights:

• Right of access (Art. 15 GDPR): You may request confirmation of whether we process your data and obtain a copy.
• Right to rectification (Art. 16 GDPR): You may request correction of inaccurate personal data.
• Right to erasure (Art. 17 GDPR): You may request deletion of your personal data. You can delete your account directly in the App's Settings.
• Right to restriction (Art. 18 GDPR): You may request restriction of processing in certain circumstances.
• Right to data portability (Art. 20 GDPR): You may request your data in a structured, machine-readable format.
• Right to object (Art. 21 GDPR): You may object to processing based on legitimate interests, including analytics.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at hello@quizcamapp.com. We will respond within one month as required by law.

10. Additional Rights for California and Other US Residents

If you are a resident of California, Virginia, Colorado, Connecticut, or other US states with comprehensive privacy laws, you may have additional rights:

• Right to know: You may request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to delete: You may request deletion of your personal information. You can delete your account directly in the App's Settings, or contact us to request deletion.
• Right to correct: You may request correction of inaccurate personal information.
• Right to opt-out of sale/sharing: We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising. If this changes in the future, we will provide an opt-out mechanism.
• Non-discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise these rights, contact us at hello@quizcamapp.com. We will verify your identity before processing requests. You may also designate an authorized agent to submit requests on your behalf.

11. Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority. The competent authority for our business is:

Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany
Website: https://datenschutz-hamburg.de

12. Children's Privacy

The App is suitable for users of all ages. We do not knowingly collect personal data from children under 16 without parental consent. If you believe we have inadvertently collected data from a child without proper consent, please contact us immediately and we will take steps to delete such data.

13. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include encrypted data transmission (TLS/SSL), short-lived signed upload URLs, secure cloud infrastructure, access controls, and safety checks in our content processing pipeline. However, no method of electronic storage or transmission is 100% secure.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes — including the activation of analytics services — we will notify you through the App or by other reasonable means. The "Last updated" date at the top indicates the most recent revision. Your continued use of the Service after changes constitutes acceptance of the updated Privacy Policy.

15. Contact

For any questions or concerns about this Privacy Policy or our data practices, please contact:

Julius Schröder
Email: hello@quizcamapp.com