Privacy Policy

Last updated: 15 April 2026

In short: QuizCards is an educational app designed for students and teachers. We only collect the data we need to run the service. We never sell your data. Voice recordings are processed on your device and are never stored on our servers. Students under 16 will never receive marketing emails — we ask students their age band at signup to enforce this. If you're under 18, your school or parent/guardian should be aware you're using QuizCards.

1. Who we are

QuizCards ("we", "us", "our") is a UK-based educational platform that helps students develop oracy skills through voice-powered quizzes. Our website is www.quizcards.co.uk and our app is available at app.quizcards.co.uk.

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, QuizCards is the data controller.

If you have any questions about this policy, contact us at: info@quizcards.co.uk

2. What data we collect

We collect different data depending on how you use QuizCards:

Data	Why we collect it	Lawful basis
Full name	To personalise your account and let teachers identify students	Legitimate interest / Contract
Email address	Account creation, login, and important service communications	Contract
Password	Account security (stored securely hashed by Firebase Authentication — we never see your password)	Contract
Role (Student / Teacher / Other)	To provide the right experience and features for your role	Contract
Age band (students only: "16 or older" / "Under 16")	To determine whether a student is eligible to receive optional marketing emails under UK GDPR. This is a self-declaration — see Section 3.	Legal obligation / Legitimate interest
Marketing preference	Whether you have opted in to receive product updates and news. Collected at signup and changeable at any time in your profile settings.	Consent
School name and school ID	To associate student accounts with a school so teachers can view their class results	Legitimate interest / Contract
Account status and subscription tier	To determine which features you have access to (free or premium plan)	Contract
Quiz results and scores	To track progress and provide feedback to students and teachers	Legitimate interest
Usage counts (quizzes completed, daily activity)	To enforce fair-use limits on the free plan and to display progress statistics	Legitimate interest / Contract
Voice / speech input	To check spoken answers against quiz questions (processed on-device, not stored)	Consent
Usage analytics events (e.g. quiz started, quiz completed, page views)	To understand how the platform is used and to improve it. No name or email is linked to these events.	Legitimate interest
Contact form messages	To respond to enquiries sent through our website	Legitimate interest

3. Children and young people

    Important for students, parents, and teachers: QuizCards is designed for use in educational settings. We take the privacy of children and young people very seriously.
  

QuizCards is intended to be used by students in schools, typically aged 11 and above. We are committed to complying with the ICO's Age Appropriate Design Code (Children's Code).

If you are under 13

You should only use QuizCards with the knowledge and permission of your parent, guardian, or teacher. We recommend that schools obtain parental consent before providing access to students under 13.

If you are 13–17

You can create an account, but we recommend your school or parent/guardian is aware you are using QuizCards.

Age band and marketing

Under UK GDPR and the EU GDPR, children under 16 (under 13 in some jurisdictions) cannot give valid consent for marketing communications. To comply with this, we ask students to select an age band — "16 or older" or "Under 16" — when creating an account.

Students who select "Under 16" will never see a marketing opt-in checkbox and will never be added to any marketing list.
Students who select "16 or older" will see an optional marketing opt-in checkbox. Only those who tick it will receive product update emails.
This selection is a self-declaration. We do not independently verify age. If a user provides a false age declaration to obtain marketing consent, they accept responsibility for that misrepresentation, and QuizCards cannot be held liable for relying on the declaration in good faith.
The age band selected at signup is stored on your account and can be reviewed by contacting us at info@quizcards.co.uk.

What we do to protect young users

We collect the minimum data needed to provide the service
We never send marketing emails to students under 16
Marketing opt-in for students is gated behind an age self-declaration
We do not show advertising
We do not sell or share student data with third parties for commercial purposes
Voice data is processed on-device and is never recorded or stored on our servers
Privacy settings are set to high by default
We use clear, plain language in this policy

4. Voice and speech data

QuizCards uses speech recognition so students can answer quiz questions by speaking. Here's what you need to know:

On-device processing: Speech recognition uses your device's built-in capabilities (such as the Web Speech API in your browser or on-device speech services on mobile). Your voice is processed locally.
Not recorded: We do not record, store, or transmit audio recordings of your voice to our servers.
Text-to-speech: QuizCards reads questions aloud using your device's text-to-speech engine. This is entirely on-device.
Permission required: Your browser or device will ask for microphone permission before speech recognition is used. You can deny this and still use QuizCards by typing answers instead.

Note: Some browsers (such as Google Chrome) may send audio to cloud servers for processing as part of the Web Speech API. This is controlled by your browser, not by QuizCards. You can check your browser's privacy settings for more information.

5. How we use your data

We use your personal data to:

Create and manage your account
Provide the quiz and learning experience
Allow teachers to view student progress and results
Send you important service emails (e.g. welcome email, password reset)
Send optional product update emails to users who have explicitly opted in (see Section 6)
Respond to contact form enquiries
Improve and develop the QuizCards platform using anonymised analytics data

We never use your data to:

Show you adverts
Sell to third parties
Build advertising profiles
Send marketing emails to students under 16
Send marketing emails to any user who has not explicitly opted in

6. Marketing communications

We may send optional product update emails (new features, platform news) to users who have explicitly opted in at signup or via their profile settings. The following rules apply:

Teachers and Other roles: Can opt in at any time via the marketing preference checkbox at signup or in profile settings.
Students aged 16 or older: Can opt in at signup after confirming their age band. This is a self-declaration — see Section 3.
Students under 16: Cannot opt in and will never receive marketing emails.
Withdrawing consent: You can opt out at any time by unchecking the marketing preference in your profile settings, or by clicking the unsubscribe link in any marketing email we send. Withdrawal of consent does not affect the lawfulness of processing before withdrawal.

We use Brevo to send marketing emails. Only your name, email address, and role are shared with Brevo for this purpose. See Section 7 for more detail.

7. Who we share your data with

We use a small number of trusted third-party services to run QuizCards. These are all established providers with their own GDPR-compliant privacy policies:

Service	What it does	Data shared	Location
Google Firebase	Authentication, database, file storage, and hosting	Name, email, role, age band (students), quiz data, usage counts	EU/UK servers
Firebase Analytics (Google Analytics 4)	Usage analytics to understand how the platform is used and improve it	Anonymised usage events (e.g. quiz started, quiz completed). No name or email is linked to these events.	EU/US (Google)
Brevo	Transactional emails (welcome email) and optional marketing emails for opted-in users	Name, email, role. Marketing emails are only sent to users who have opted in.	EU

We do not share data with any other third parties. Teachers can see the results and progress of students who take their quizzes — this is a core feature of the educational platform.

8. International data transfers

Some of our service providers (such as Google) may process data outside the UK. Where this happens, we ensure appropriate safeguards are in place, such as:

UK adequacy decisions
Standard Contractual Clauses (SCCs)
The provider's own GDPR and data protection commitments

9. How long we keep your data

Account data (including age band and marketing preference): Kept for as long as your account is active. If you delete your account, we will delete your personal data within 30 days.
Quiz results: Kept for as long as your account is active, so you and your teachers can review progress.
Analytics data: Retained for 14 months in Google Analytics 4, then automatically deleted.
Contact form messages: Kept for up to 12 months, then deleted.
Voice data: Not stored — processed in real-time on your device only.

10. Your rights

    Under UK GDPR, you have the following rights. These apply to all users, including students.
  

Right of access — You can ask us for a copy of the personal data we hold about you.
Right to rectification — You can ask us to correct any inaccurate data, including your age band if it was entered incorrectly.
Right to erasure — You can ask us to delete your data ("right to be forgotten").
Right to restrict processing — You can ask us to limit how we use your data.
Right to data portability — You can ask for your data in a machine-readable format.
Right to object — You can object to our processing of your data where we rely on legitimate interest.
Right to withdraw consent — Where we rely on your consent (e.g. microphone access, marketing opt-in), you can withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, email us at info@quizcards.co.uk. We will respond within 30 days.

If you are a student under 18, your parent, guardian, or school can make these requests on your behalf.

11. Data security

We take the security of your data seriously. We use the following measures to protect it:

All data is transmitted over HTTPS (encrypted in transit)
Passwords are securely hashed — we never store or see your password in plain text
Access to our database and systems is restricted to authorised personnel only
We use Firebase Authentication, which is built and maintained by Google with industry-standard security
We regularly review our security practices

12. Cookies

QuizCards uses only essential cookies required for the service to function (e.g. authentication tokens to keep you logged in). We do not use:

Advertising or tracking cookies
Third-party analytics cookies placed by us
Social media tracking pixels

Because we only use strictly necessary cookies, we do not require a cookie consent banner under UK GDPR.

Note on Google Analytics: We use Firebase Analytics (Google Analytics 4) to understand how the platform is used. This does not set cookies that track you across other websites and does not link usage events to your name or email address.

13. Changes to this policy

We may update this privacy policy from time to time. If we make significant changes, we will notify users through the app or by email. The "last updated" date at the top of this page will always show when the policy was last revised.

Continued use of QuizCards after a policy update constitutes acceptance of the updated policy.

14. How to complain

If you are unhappy with how we handle your data, please contact us first at info@quizcards.co.uk and we will do our best to resolve your concern.

You also have the right to lodge a complaint with the UK's data protection regulator:

Information Commissioner's Office (ICO)
Website: ico.org.uk
Helpline: 0303 123 1113