Privacy policy

1. Who we are

AshQuiz is a platform for creating, sharing and taking interactive tests. The operator of AshQuiz decides why and how your personal data is used (the "controller"). You can reach us at the contact details on our Contact page for anything in this policy.

2. What we collect

Account data:

• name, email address, username, a hashed password (never stored in readable form), optional photo, bio and website, language and other settings
• the identifier given to us by Google, Apple or Telegram if you sign in or link with them

Activity data:

• tests and questions you create; your attempts, answers, scores, time taken and certificates; reviews, comments, likes, bookmarks, follows, group memberships, messages and notifications; study progress, streaks and achievements

Device and security data:

• IP address, browser and device name and sign-in times for each signed-in device; failed sign-in counts

Files you add:

• images, audio, video, drawings and documents you upload, for example as an answer

Optional data:

• the email address of a parent or guardian you invite; your Telegram link; a browser push-notification subscription

Exam supervision data, only when a test owner turns it on (see the Exam monitoring notice):

• tab and full-screen events and, if camera or screen checks are on, a few small pictures

3. Why we use it

• To provide the service: sign you in, run and grade tests, show results, certificates and leaderboards, and let you message and follow others (contract)
• To keep the service safe: prevent abuse, cheating and account takeover, and investigate reports (legitimate interests)
• To send you emails and notifications you need, such as verification, password reset and reminders you ask for (contract and consent)
• To use your camera, screen sharing, browser notifications or optional emails, only after you agree (consent, which you can withdraw)
• To comply with the law

We do not sell your personal data and we do not show advertising.

4. Who can see it

• Everyone: your public profile, public tests, reviews and leaderboard position, unless you turn them off in Privacy settings. A certificate shows your name, the test, your score and the date to anyone who has its link.
• Test owners: when you take someone's test, its owner and editors see your name, username, email address, score, answers, time taken and any integrity warnings. The owner of a test is responsible for how they use this information.
• People in a conversation: your messages.
• A parent or guardian: only after they confirm by email, and only the summary described in the Children and guardians page.
• Our staff: only as needed to run the service, handle reports and give support.

5. Service providers

We share data with providers who process it for us, only for the purpose given:

• Google, Apple and Telegram, to sign you in or link your account if you choose them
• Cloudinary, to store and deliver images and files you upload
• an email delivery provider, to send verification, reset and notification emails
• our hosting and database providers
• Sentry, for error reports; we remove names, emails, request bodies, cookies and headers and keep only an internal user identifier
• your browser's push service, if you turn on push notifications
• AI providers, if you use AI features (see the AI features page)

6. International transfers

Our providers may process data in other countries. Where the law requires it, we rely on safeguards such as contractual clauses or the provider's own certifications. By using the service you understand that your data may be processed outside the country where you live.

7. Cookies and similar technologies

We use only the cookies and browser storage needed to keep you signed in and to remember your language, theme and unsent work. We do not use advertising or tracking cookies. Details are on the Cookies page: /info/cookies.

8. How long we keep it

• Account data: for as long as your account exists.
• Closed accounts: when you close your account it is switched off for 30 days so you can change your mind. After that your name, email, username, photo, bio, sign-in identifiers, settings, messages, notifications, follows, Telegram link, API keys, webhooks, push subscriptions and the supervision pictures taken during your attempts are erased or anonymised.
• Attempts and results: they stay on tests so test owners and other participants keep correct statistics and leaderboards, but they are shown as "Deleted user" and are no longer linked to your identity.
• Security logs and backups: for a limited period, after which they are deleted or overwritten.
• Anything we must keep by law.

9. Your rights

Depending on where you live, including under the personal data law of the Republic of Uzbekistan and, where it applies, the GDPR, you can:

• see and download your data (Settings: download your data)
• correct your details in Settings
• close your account and have your personal data erased (Settings, then Security)
• object to or ask us to limit some uses of your data
• withdraw consent you gave, such as for notifications
• complain to your data protection authority

Write to the contact details on our Contact page if you cannot do something yourself. We will answer within a reasonable time, normally within 30 days.

10. Children

AshQuiz is not meant for children under 13 and we do not knowingly collect their data. Younger users who are allowed to use it need a parent's or guardian's permission. See the Children and guardians page: /info/children.

11. Automated decisions

Tests are scored automatically, as the test owner designed them. Integrity signals such as leaving the test tab, or very similar wrong answers between two people, are only shown to the test owner as hints. They are not a verdict, and nobody is penalised by us automatically because of them. AI grading suggestions for written answers are reviewed by the teacher before they count.

12. Security

Passwords are hashed, connections use HTTPS, sign-in tokens live in httpOnly cookies that page scripts cannot read, and sensitive actions such as changing a password sign out your other devices. You can turn on two-factor authentication. No system is perfectly secure; if a breach affects you we will tell you as the law requires.

13. Changes to this policy

If we change this policy in a significant way we will tell you in the app or by email before the change applies. The date at the top shows when it was last updated.

14. Contact

Questions, requests or complaints about your data: the contact details on our Contact page.