Last updated: October 19, 2026
Privacy policy
This policy explains what data CanQuiz processes, for what purpose, and with which providers. It covers canquiz.com, app.canquiz.com and the CanQuiz apps for iPhone and Android.
Controller
The data controller is Michel Fernando Rodrigues Flores, an independent developer. For anything concerning your data, including exercising your rights, write to privacy@canquiz.com.
What data is processed
When you create an account: your email address, the name the provider sends along with it (the one on your Google, Apple, Discord or GitHub profile, kept as your display name) and that provider's identifier. If you sign in with the magic link, just your email. Either way, the country you sign up from is also recorded, as a two-letter code (ES, MX…) inferred from your connection at that moment, along with that connection's time zone (such as Europe/Madrid), so your days start and end at your local time; your IP address is not stored in your account. The sign-in service, Supabase, does record it for security, on each open session and in its access log; that log is included when you download your data and is deleted with your account. Vercel also sees it in its request logs, which it keeps for a short time, and to curb abuse the app briefly keeps a code computed from it, without the address itself. If your account has no time zone, the app records your browser's the next time you sign in, and setting an exam date sends your browser's. How you arrived is recorded too: the site you came from (just its domain, such as google.com or chatgpt.com, never the full address), the campaign if the link carried one, and the first page you visited. It is used to know which channels bring people in, counted in aggregate. When you use the app: the quizzes you create, your answers, your review progress, the language and theme you pick, and the files you upload to generate quizzes. If you join the Android closed beta, your account also records the Google account email you type on the beta page (it can differ from your account's email), whether it is waiting or has been added to Google Play, and when you asked and when it was added. When the app asks you one of its questions about CanQuiz, your account records how many times you have seen them and whether you closed them, and, if you answer, your answers, any text you write (up to 2,000 characters) and whether you agree to be replied to by email. Answering is optional. If you write something, it is emailed (through Resend) to the person who develops CanQuiz, along with your answers, your language, the date you created your account and how many quizzes you have, with your email as the reply address only if you agreed to a reply. Your answers are deleted with your account. If you use app.canquiz.com installed from your browser and accept analytics, each day you open it (with the system: iOS, Android or other) and what you did with the install prompt are also recorded, linked to your account; this is deleted with your account and stops being recorded if you withdraw consent. No payment details are asked for, because there are no payments. If you connect your account to ChatGPT or Claude, each quiz and each review also records whether it was made on the web or from a chat, and with which kind of app: its own section explains it. And if your account has a password, Supabase stores it as a hash, never in plain text.
AI generation
CanQuiz's AI runs on two providers, each for a different job, and both receive the request on CanQuiz's key. Both process the material on CanQuiz's behalf as data processors, without using it to train their models. Requests always reach them through Vercel, which already hosts the app and acts as the gateway to them (Vercel AI Gateway): it only passes requests through, without keeping their content. OpenAI (the gpt-6-luna model) writes: quizzes, follow-ups, "Improve", explanations, what was missing from an open answer, the study plan for a topic and the replies in the conversation while creating. Depending on availability, Vercel AI Gateway serves each request from OpenAI, from Microsoft (Azure) or from Amazon (Bedrock), and if none of them responds, with another OpenAI model (gpt-5.6-luna). None of them uses the material to train its models, and each may keep it for a limited time to detect abuse, under its business terms. Marking an open answer is OpenAI's job too, with gpt-6-luna or with a version of it that only returns the mark (gpt-6-luna-decisions), served only by OpenAI. TypeSafe (the Jev model), a US company, does not write text: it decides. Depending on the feature, CanQuiz may ask it whether a short answer means the same as the correct one even when worded differently, whether a quiz can appear in Explore, what topic a quiz covers, or what you are asking the AI for while creating. If it does not answer in time, CanQuiz carries on without it: OpenAI or a rule in the app itself makes the call. Requests reach it through Vercel AI Gateway, which sends them only to TypeSafe and with zero data retention: neither the request nor the response is kept, and nothing is used for training. It is not only what you paste in to create a quiz. When you ask the AI to mark an open answer of yours, during a review or at the end of a quiz, your answer and the question go to OpenAI on CanQuiz's key, or to your provider if you have added your own API key. To check whether a short answer counts even when it is not worded like the correct one, your answer and the correct one may go to TypeSafe. They are not stored separately: they are used to give you the marking back. CanQuiz does not process videos. If you paste a YouTube link, it is not sent to any AI provider: the app tells you videos do not work and what you can paste instead. For other web pages CanQuiz extracts the text itself and only then sends that text to the provider. There are also two automatic reviews you do not ask for, run on CanQuiz's key. Before a quiz appears in Explore, the AI usually reads its text to decide whether it can be in the public catalogue; if that review is unavailable at the time, the quiz is listed anyway and reports remain. And for every quiz that is saved, private ones included, CanQuiz sends the AI the title, the description and up to eight of its questions with some of their options to find out what topic it covers, and uses that to count internally what people study on CanQuiz. For each quiz only its topic (a subject name written by the AI), its type, its level and its language are kept, without the quiz's text or your account, and that is deleted once no quiz with that content remains. That classification is also used with your account. CanQuiz uses it to suggest folders by subject in your Library, to pick the topics you see first when creating a quiz and to split the versions of some emails, as explained further down. It also decides which of the quizzes listed in Explore are offered to search engines: only the ones that look made from your own notes or syllabus. And every hour CanQuiz groups by place of study the accounts where that can be worked out, from the email domain or from their quizzes (the name of the school, a subject specific to one study plan, or a copy of a quiz from another account in the group). That grouping is used to keep each group's aggregate figures apart and to keep the quizzes those accounts list from being offered to search engines, and it changes nothing else about your account. If you object, your quizzes stop being sent for this and your account leaves that grouping. If you prefer to supply your own API key, the material is transmitted to your provider (Google, Anthropic or OpenAI, whichever you choose) and is subject to that provider's policy and to your relationship with them; that key is stored encrypted in your browser's local storage, travels with the request so the provider can be called on your behalf, and is not saved in CanQuiz's database. What CanQuiz does keep, linked to your account, is the key that decrypts it when you sign in, which is useless without the encrypted copy in your browser and is deleted with your account. Every AI operation is recorded: what was done (building a quiz, marking an answer, writing an explanation, checking a quiz before it goes on Explore), with which provider and which model, how many tokens it used and what it cost, linked to your account. Never the material, the question or what the model answered. It is used to keep track of the AI included each month and to know what the service costs to run, and it is included when you download your data. When something you send to the AI is rejected for being too large (text that is too long, a PDF or photos over the limit, a file that is too heavy), a record is kept, linked to your account, of when it happened, the reason and the size (characters, pages, photos, estimated tokens or file size) against the limit it hit. Never the content. It is used to know how many people hit each limit and decide whether it is worth raising; it is included when you download your data and deleted when you delete your account. Files you upload as attachments are kept so you can ask about them while you use the conversation (for example, whether the answers match your document) or get more questions from them in a new quiz; using them in a new conversation counts as using them. They delete themselves after 7 days without using that conversation, and never last more than 30 days from upload; if you never make a quiz with them, after 24 hours. A sweep runs once an hour. If you delete the conversation, its files are deleted right away. You can start making a quiz on app.canquiz.com before you sign in. Until you have an account, what you add (files, text and the choices on the quiz card) stays in your browser's storage and does not leave it: it is uploaded to your account when you sign in and then removed from the browser. Anything left unused for seven days is deleted the next time you open the create page in that browser. If you tap Generate before signing in, what you prepared is also saved on the server, in private Supabase storage under a random single-use code, so it is not lost if you finish signing in from another tab or browser (for example, by opening the email link on your phone). When you sign in, the files move to your account like any other attachment and the rest is deleted from the server; if nobody signs in with that code, everything is deleted after 24 hours. None of this reaches the AI until you have signed in and the quiz is generated. To limit how much one connection can prepare in an hour, a fingerprint of your IP address is computed with a secret key and the hour: it cannot be turned back into the IP or used to follow you from one hour to the next, the IP itself is not stored, and the fingerprint is deleted within three hours. When you ask for the explanation of a question that does not have one, the AI writes it and it is saved in that question, as part of the quiz: it stays there for next time, anyone who opens the quiz sees it if you share it, and it travels in copies and in the quiz file. It is deleted with the quiz, and in each copy, with the copy. So the same explanation is not written twice, it may also be kept separately, identified by a fingerprint of the question (its wording, its options and its correct answer), without your account or anything that identifies you: if someone else has that same question, they get that explanation instead of asking for another. Those entries are deleted ninety days after they are written and, as they do not carry your account, they are not deleted when you delete it. For the material you build a quiz from (the file or the pasted text), a fingerprint is also kept: a code computed from it that cannot be turned back into the content. It is linked to your account and is used only to measure how often the same material is uploaded, to decide whether it is worth not processing it again; today it is used for nothing else. It is deleted ninety days after anyone last uploads that material, and its link to your account disappears when you delete the account. It is included in your data download.
Public quizzes
The quizzes you create are private by default, and from there it is two steps, not one. Sharing by link means anyone with the address can open it, including people without an account, but it appears in no listing and search engines do not pick it up. Listing it in Explore is the second step: on top of opening by link, it shows in the public listing and can be indexed. You can undo either step at any time, though anyone who already took a copy keeps it.
Using CanQuiz from ChatGPT or Claude
You can connect your CanQuiz account to ChatGPT or Claude. When you do, the assistant takes you to a CanQuiz screen where you authorise access, and from then on it can, when you ask it to, create quizzes in your account, open them, change them, delete them, share them with a link, make them private again and practice with you. The questions are written by the assistant's model, not by CanQuiz's AI: CanQuiz checks that the quiz has a valid shape, saves it, marks your answers in practice and decides when each question comes back. Nothing you do from the chat goes through CanQuiz's AI engine or uses your account's included AI. What CanQuiz receives: whatever the assistant sends for each action (the title and questions of a quiz it has written, which quiz you want to open or change, the option you pick in practice or your written answer, and the grade the assistant gives an open answer) and a note of which app it is. It does not receive your conversation or your history, and does not ask for them. ChatGPT adds data of its own to each request, such as your language, an approximate location and anonymous identifiers for your account and the conversation: CanQuiz neither uses nor stores them. What CanQuiz returns to the assistant: what your request needs, and nothing else. When opening or changing a quiz, its title, description, questions with their options, answers and explanations (the longest ones shortened), its visibility, the day it last changed, a number that identifies it and a version number that stops a more recent change from being overwritten. When opening, creating, changing or making it private, its link to open it in CanQuiz, which only opens for you while it is private; when sharing it, the link for other people. In practice, the question without its answer and a turn code to answer it, and after you answer whether you got it right, the correct answer, the explanation and when the question comes back; and, if you ask, how many questions you have left, how many you have done today and your accuracy over the last thirty days. Never your email, your account identifier or technical data about your device or connection. Sharing from the chat only makes a quiz reachable by link: it never lists it in Explore. What is stored: quizzes and reviews, as when you use the web, with a mark saying whether they were made on the web or from a chat and with which kind of app (ChatGPT, Claude, Claude Code or another). The permission you gave each app (which one and when), in Supabase. And usage counters per account, app, action and day (calls, per minute), which are there to set limits and prevent abuse: the ones tied to your account are deleted with it and, in any case, after ninety days; the per-app ones, which do not carry your account, after ninety days. All of this is included in your data export. What CanQuiz returns becomes part of your conversation, and that conversation is kept and processed by OpenAI or Anthropic under their own privacy policy and retention periods: each is responsible for its own part, as independent controllers. Deleting your CanQuiz account or disconnecting the app does not delete what is already in those conversations. How to cut it off: in Settings > Connected apps, inside the application, you can see which apps have access to your account and remove it. From that moment CanQuiz stops serving their requests, and the permission they already had expires shortly. Removing the connector only in ChatGPT or Claude does not withdraw the permission in CanQuiz: that is why that page exists. Deleting your account withdraws every permission.
iPhone and Android apps
The CanQuiz apps for iPhone and Android use the same account and talk to app.canquiz.com, so this whole policy applies to them as well. The app asks for camera access only when you tap Take photo to make a quiz from your notes. Photos from your library and PDFs are picked in the phone's own picker, and the app receives only what you pick. Before sending a photo, the app converts it to JPEG and shrinks it; from then on it is handled like any file you upload on the web to generate a quiz. The app does not ask for access to your microphone, location or contacts, and it does not use the phone's advertising identifier. The notification permission is covered in Phone notifications. To open instantly and let you review offline, the app keeps a copy on the phone of your quizzes, folders, the questions you have due, your settings and any quiz you left halfway. If you answer while offline, your answers wait on the phone and are sent when the connection comes back. Your session is stored encrypted, with its key in the system's secure storage. When you sign out, the app tries to send anything still pending (if it can't, it asks you before going on) and deletes that copy, keeping only your language, appearance, text size and whether it has already asked about notifications. On Android, the app's data is left out of the system backup. In the app you sign in with a code sent to your email, or with Apple, Google, Discord or GitHub, and CanQuiz receives the same data as on the web (see What data is processed). With Google, the sign-in screen is Google's own on the phone; with Apple on an iPhone, the system's; with Discord, GitHub, and Apple on Android, a window of the system browser. Each provider checks your account under its own policy. To request the email code, the app opens a page on app.canquiz.com with the Cloudflare Turnstile check described under Providers. If you create your account in the app, the app you used (iPhone or Android) is recorded as your first page. Each time it opens, the app asks Expo (650 Industries, Inc.) whether a new version of its code is available and downloads it if there is one. That request gives Expo the phone's IP address, its operating system, the app version and a random identifier the app creates for that installation. It carries nothing about your account or what you do in the app. The apps do not include PostHog or Sentry, so there is no product analytics or session recording on the phone. If something fails on the server while handling a request from the app, or on the email verification page, the error goes to error reporting without an identifier. To delete your account from the app, go to Settings > Delete account; see Deleting your account.
Phone notifications
CanQuiz's mobile app can notify you on your phone about what is due for review today, an exam that is close or happening today, and a quiz that CanQuiz's AI was generating and that is now ready. They are only sent if you allow notifications in the system. You choose each type and the quiet hours (22:00 to 08:00 unless you change them) in the app's settings: a type you turn off is not sent, and without the phone's permission none is. At most one reminder and one exam notice arrive per day, and none during quiet hours; the quiz-ready notice answers something you just asked for, so it does not count toward that limit and does not wait for quiet hours to end. To send them, CanQuiz stores your phone's notification identifier (Expo's), its system and time zone, your settings and, for each notification, its type, when it was sent and whether you opened it. The text of a notification is not stored, but it passes through Expo and then through Apple on an iPhone or Google on an Android phone, and may name one of your quizzes or folders. The basis is your consent: you withdraw it by turning notifications off in the app or in the phone's settings. CanQuiz deletes everything it stores for this when you delete your account.
Providers
Hosting and delivery: Vercel, which runs the application in its Frankfurt region and keeps request logs for a short period. Database and authentication: Supabase, in Frankfurt. Product analytics and session recording: PostHog, in its European region, without storing your IP address. Error reporting: on app.canquiz.com, Sentry, in its German region, without IP address and with events expiring after ninety days; on canquiz.com, this site, JavaScript errors are collected by PostHog, which is all that is set up here. Support chat: Crisp, in Amsterdam, which is not loaded until you open the chat and keeps the conversation until you ask for its deletion. Email: Resend. Sign in with Google, Discord or GitHub: the company you choose, all three based in the United States, checks your account under its own policy and gives CanQuiz your email, your name, an identifier and basic profile details, such as the link to your photo, which CanQuiz does not display. Sign in with Apple: Apple, if you choose Continue with Apple. It checks your Apple account and gives CanQuiz a user identifier and your email, or a private Apple address if you would rather not share yours. Updates to the mobile apps: Expo (650 Industries, Inc.), which receives the request the app makes when it opens (explained in iPhone and Android apps). Notifications on your phone: Expo, which receives your phone's notification identifier, the text of each notification and the data it carries (its type and which quiz, folder or conversation it opens), and Apple's notification service, which delivers it to your iPhone. On an Android phone, Google's Firebase Cloud Messaging (Google LLC) delivers it: it receives the push token that identifies CanQuiz on your phone and the text and data of the notification (explained in the Phone notifications section). Automated-traffic detection: Vercel BotID, on the routes that use CanQuiz's AI and on the view counter of public quizzes, so that a script cannot spend the engine CanQuiz pays for or inflate the counters; it looks at signals from your browser to decide whether there is a person behind it and returns only a yes or a no to CanQuiz, storing nothing. Protection against automated programs at sign-in: Cloudflare Turnstile, on the access screens of app.canquiz.com, including the one the mobile apps open (signing in or signing up with your email, and signing in with a password). It looks at signals from your browser and your connection to decide, without you having to do anything, whether there is a person behind it, and CanQuiz only receives a single-use code that Supabase checks. Cloudflare processes that data under its Turnstile Privacy Addendum: https://www.cloudflare.com/turnstile-privacy-policy/. AI generation (what each one is used for is explained in «AI generation»): OpenAI (gpt-6-luna), served by OpenAI, Microsoft Azure or Amazon Bedrock through Vercel AI Gateway; and TypeSafe (Jev), in the United States, through Vercel AI Gateway with zero data retention and no training. Or Google, Anthropic or OpenAI if you bring your own key. Each provider processes data on CanQuiz's behalf; the exceptions are an AI provider you reach with your own key, which acts under your relationship with them, Cloudflare, which for Turnstile follows its own addendum, Google, Discord and GitHub, which handle your account with them under their own policy when you sign in, Apple, which handles your Apple account and the delivery of notifications to your iPhone under its own policy, and Google Play, which handles the beta tester list and your installs as the store you install from, under Google's own policy. OpenAI and Anthropic appear here in more than one role. OpenAI is also one of CanQuiz's AI providers, and in that role it processes the material on CanQuiz's behalf. If you add your own key on the web, OpenAI or Anthropic is the AI provider you choose. If you use CanQuiz from ChatGPT or Claude, what happens in the chat is not received on CanQuiz's behalf: they process your conversation as independent controllers, under their own policy (explained in «Using CanQuiz from ChatGPT or Claude»). Google also has several roles: if you sign in with Google, it checks your account under its own policy; if you add your own key, it is the AI provider you choose; and for notifications on Android phones it processes data on CanQuiz's behalf, under Firebase's Data Processing and Security Terms. If you join the Android beta, Google Play receives the email of the Google account that you give on the beta page, because CanQuiz adds it to the beta's tester list so that Google Play lets you install the beta. Google Play handles it as the store you install from, under Google's own policy. CanQuiz takes it off the list after you delete your CanQuiz account (see Legal basis and retention). Transfers outside the European Economic Area: OpenAI, Microsoft, Amazon, TypeSafe, Resend, Cloudflare, Apple, Expo (650 Industries), Google (Firebase Cloud Messaging and Google Play) and, for some auxiliary functions, Vercel, are US companies. Supabase, Sentry (Functional Software) and PostHog are too: they keep the data in the European Union, but may access it from outside to provide support or keep the service running. Apple acts under its own privacy policy and applies its own safeguards to the transfer. Transfers to Expo and to Google rely on their certification under the EU-US Data Privacy Framework. For the other providers, they rely on the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914), and on that framework where the provider is certified. Those clauses are part of CanQuiz's agreement with each provider. For the AI providers reached through Vercel AI Gateway (OpenAI, Microsoft, Amazon and TypeSafe), CanQuiz's agreement is Vercel's data processing agreement, with its standard contractual clauses, and Vercel makes the request under its own agreement with each one; with TypeSafe, a zero data retention agreement for Jev. For Google, Firebase's terms also include standard contractual clauses that apply if the EU-US Data Privacy Framework is not available. You can request a copy of those safeguards by writing to privacy@canquiz.com.
Analytics and cookies
On canquiz.com analytics run without cookies and without persistent storage: no identifier is placed in your browser, which is why there is no consent banner. Your IP address is not stored either, nor the approximate location that could be inferred from it: IP enrichment is switched off on this site, so not even the country survives the visit. What is collected, without identifying you: which pages are viewed, which links to the app are clicked, and the JavaScript errors the page throws, so it can be fixed. When you go from canquiz.com to the app, the link carries the site you reached canquiz.com from (just its domain, such as google.com), the campaign if there was one, and the first page you saw. It travels in the address of the link itself and nothing is stored in your browser. If you create an account, it is recorded with it, as explained in the data section. On app.canquiz.com, until you accept, analytics run with no memory: no cookie is set to measure you, no event about you is sent to PostHog, the days you open app.canquiz.com installed from your browser are not recorded, and no identifier that outlasts the visit is assigned to you. What can be left on your device is whatever makes the app work the way you left it (your language, light or dark theme, an unsaved draft, where you were in a quiz, your API key if you have supplied one, the sign-in method you used last time, the email address you asked for a sign-in code for (only in that tab and for an hour at most), a marker saying your account has already sent its time zone from this browser, so it isn't sent again, and, if you ask for your browser not to be counted, the cookie, the same for everyone, that remembers it) plus the marker saying analytics are off, which is exactly what keeps them off. None of it leaves your browser and none of it is used to measure you. If you accept, the app also stores the day of your last visit in your browser, to count a return only once a day. If you decline, anything left over from an earlier visit is deleted as well, including campaign attribution and that day. You can change your mind at any time in Settings > Privacy and account. What is counted without asking, on the sign-in screen, are overall figures per day: how many people arrive and from what kind of site (only the domain of the previous page), how many pick a sign-in method and how many get in or create an account, how long the page takes to respond, whether something is tapped before it responds, and which errors show up. Each figure is counted on its own or with a single extra detail (device type, browser family, country or what you came to do), never several combined. On the way to creating a quiz it is also counted, as before, by where people came from (for example ChatGPT, Google or canquiz.com) and by whether they use a phone or a computer. So the same visit isn’t counted twice, it carries a random number that lives in the page and in the return link: it isn’t stored in your browser, isn’t linked to your account, expires after three hours and is deleted from the database within six. Your IP address and the text your browser identifies itself with aren’t stored, and the figures are deleted after 25 months. If you’d rather not be included, you can ask in the app’s Help for your browser not to be counted, and if your browser sends the Global Privacy Control signal, it already isn’t. Public quizzes count how many times they are opened and taken, and each visitor counts at most once a day. For that, a code computed from your IP address, the quiz and the day is stored, which cannot be turned back into the address; it is deleted after two days. There are two session recorders and both run only with your consent: PostHog's and Sentry's. In both, what is recorded is where you click, how you move and the app's own text, which is the same for everyone: menus, buttons, notices and error messages. Masked: everything you type into a field; the content of quizzes, yours or other people's (titles, descriptions, questions, answers and explanations); what you paste or upload and your conversation with the AI; and your email. The messages the app writes to the browser console are not recorded either. Recordings expire after ninety days. Error reporting always runs, without cookies, because it is what catches the failures that happen before anyone has had the chance to accept anything. If you have not accepted analytics it also runs without an identifier: the report arrives with nothing tying it to your account. If you have accepted, it carries your account identifier, which is what makes it possible to see whether a failure is happening only to you. The support chat, Crisp, does not load, and therefore stores nothing, until you open it, and before it loads you are told what that means. If you have ever opened it, from then on it does load on arrival: that is what makes it possible to tell you that you have a reply. You can undo that at any time in Settings > Privacy and account, and from then on it goes back to not loading until you ask for it. What you do from ChatGPT or Claude does not go to PostHog: from the chat there is no way to ask you, so nothing is sent. It is counted inside CanQuiz's own database, without sending it to anyone, to know how many accounts use it. Errors in that connection go to error reporting without an identifier. The cookies someone using CanQuiz may come across, with what each one does, whose it is and how long it lasts: On app.canquiz.com: sb-…-auth-token (Supabase, on CanQuiz's behalf): your session, so you stay signed in when you come back; it may be split into several, and while you sign in with Google, Apple, Discord or GitHub another one is added with a code to complete the sign-in. Up to 400 days, or until you sign out. canquiz-idioma (CanQuiz): the language you choose. One year. cq-enlace-correo (CanQuiz): holds the sign-in link from an email while you confirm which account you are signing in to. Ten minutes. cq-preparado (CanQuiz): remembers which quiz prepared before signing in was opened in this browser, so it can be picked up when you sign in. 24 hours. cq_no_contar (CanQuiz): asks for your browser not to be counted in the sign-in screen figures; it holds the same value for everyone. 13 months. ph_…_posthog (PostHog, on CanQuiz's behalf): only if you accept analytics; the identifier PostHog uses to recognize your browser. It is set for the whole canquiz.com domain, although canquiz.com does not read it. One year. crisp-client/… (Crisp, on CanQuiz's behalf): only if you have opened the support chat; it keeps your conversation. Up to six months. On canquiz.com: NEXT_LOCALE (CanQuiz): the language of the page you are visiting. Until you close the browser. Your analytics choice is kept in the browser's local storage (canquiz.consent.analytics.v1), as is the theme you pick on canquiz.com, and lasts until you change it or clear the site's data.
Legal basis and retention
Account and content data are processed to deliver the service you asked for, including when you use CanQuiz from ChatGPT or Claude with your account connected. The same goes for the email you give to join the Android beta. Counting how much CanQuiz is used from the chat relies on the legitimate interest of knowing whether that connection is useful and of setting limits that prevent abuse: they are counts per account, app, action and day, with nothing of what you write. On app.canquiz.com, product analytics and session recording rely on your consent, which you can withdraw at any time. The same goes for notifications on your phone in the mobile app: you turn them on, and you can turn them off at any time. On canquiz.com, this site, the measurement is different and that is why there is no banner: it counts page views without writing anything to your device, without identifying you and without storing your IP address, and it rests on the legitimate interest of knowing which pages are any use. There is nothing to withdraw because nothing of yours is kept; if you would still rather not appear, any blocker stops it. Error reporting relies on the legitimate interest of keeping the service running and secure. The anonymous count on the sign-in screen relies on the legitimate interest of knowing whether people can get in and where it fails; you can object in the app’s Help (Don’t count this browser) or with your browser’s Global Privacy Control signal. Keeping separately, by the fingerprint of its question, an explanation the AI has already written, to give it to anyone with that same question, relies on the legitimate interest of not paying twice for the same thing: those entries carry neither your account nor anything that identifies you, serve only that purpose and expire on their own. Classifying the content of quizzes by topic to understand what people study on CanQuiz, grouping accounts by place of study for aggregate figures, and using both to decide which Explore quizzes are offered to search engines rely on the legitimate interest of understanding what the service is used for and of not asking search engines to index material that may belong to others; you can object by writing to privacy@canquiz.com. Using your quizzes' topics to suggest folders and topics when you create is part of the service you asked for. The emails CanQuiz sends about your account and your own material rely on the legitimate interest of helping you keep going with what you started. They are the welcome, the first review of a quiz, a quiz you left unsaved, the questions left pending in a quiz or a quiz you have not opened for weeks, the questions now due for review, one asking you back when you have gone a week without studying, the one saying you are in the Android beta (if you asked to join it) and, if you set an exam date, the notices a week before and the day before. You can turn them off in Settings > Privacy and account or from the link in any of them. Opening the link in one of those emails records that the email worked, when, and which of its links was opened, even if you are not signed in on that device. Nothing else about you or your device is kept, not your IP address or your browser. That is what makes it possible to stop sending the ones that do not work; you can object by turning the emails off. CanQuiz can use that same record to compare versions of some of these emails (different subject lines, different sending times, or sending one only to some people) and see which works better. Your account records which version you got, and the versions are split by your language, the kind of site you came to CanQuiz from (a search engine, an AI assistant or something else) and the level of study worked out from your quizzes' topics (school, university or other). Some features of the app can also be tried in two or more versions: each account gets one, the same one every time, and which one is recorded so the versions can be compared by how they are used. Both rely on the legitimate interest of knowing which changes make CanQuiz better; what is recorded is deleted with your account, and you can object by writing to privacy@canquiz.com. At most once a month CanQuiz also writes to you with product updates, on that same basis. To send them, Resend keeps your email, your first name, if your profile name includes one, how long ago you last signed in (in bands) and your language: the one you use in the application or, if that is not recorded, the one your quizzes are written in. All of it is deleted from Resend when you delete your account. Every update carries a link to unsubscribe from updates only or from everything, and unsubscribing never affects the email you sign in with. When there is a CanQuiz app for your kind of phone, CanQuiz can email you about it once, on that same basis. To know which phone you use, it reads the system (Android or iOS) that your open sessions report to Supabase at the moment of sending, and keeps only the fact that the email went out. If you sign up on the chat page to hear when CanQuiz is in ChatGPT, your email and the language of the page are stored at Resend, based on your consent and only for that notice: you get one email the day it is available and then your address leaves the list. If you have an account, the contact is the same one used for product updates, and an earlier unsubscribe is respected. To leave sooner, use the unsubscribe link in the notice or write to privacy@canquiz.com. The questions about CanQuiz inside the app, with whatever you answer and the email the person who develops CanQuiz receives if you write something, rely on the legitimate interest of knowing what to improve and of not asking you the same questions again; answering is optional. The data in a content report (your name and email, if you provide them) is processed so the report can be reviewed and answered, under the Digital Services Act. How long each thing is kept: your quizzes and progress, as long as the account exists. The material you send to the AI to build a quiz, ninety days: its purpose is served once the quiz exists. The fingerprint of that material, ninety days from the last time it was seen. The topic of a quiz, for as long as some quiz with that content remains. An explanation saved in a question, as long as the quiz exists (and in each copy, as long as the copy exists); one kept separately by the fingerprint of the question, ninety days from when it was written. Files you upload, up to 7 days without using their conversation, 30 at most (sooner if you delete it). What you prepare before signing in, 7 days in your browser and 24 hours on the server. The permission you give a chat app, until you remove it or delete your account. The chat usage counters, ninety days. Your email on the ChatGPT waitlist, until the notice goes out. Session recordings, ninety days. Figures from the sign-in screen, twenty-five months. Your answers to the app's questions and the version you got in each trial, as long as the account exists. The phones registered for notifications, your notification settings and the notifications sent, as long as the account exists. Your request to join the Android beta, while the account exists; once it is added to Google Play's tester list, only its email, status and dates survive deletion, as explained below. Analytics events, up to eighty-four months or until you delete your account, whichever comes first. A report about content, while it stays open and for a year after it is resolved, which is what it takes to account for the decision; after that the whole thing is deleted. And if the person who reported it deletes their account, their name and email disappear from the report at that same moment. These things outlive deletion, and it is worth saying why: quizzes other people copied, which are their content and stop being linked to you, with any explanations they carried; explanations kept separately by the fingerprint of their question, which never carried your account and expire after ninety days; the AI usage figures (which feature, which model, how many tokens and what it cost), which lose their link to your account and keep the day but not the time, so the service's accounts do not depend on who stays; the email, status and dates of your request to join the Android beta, if you had already been added to Google Play's tester list, which stay without your account until CanQuiz takes you off that list by hand and then deletes them; database backups, which exist only to restore the service and expire under Supabase's retention; error logs, which expire after ninety days; the record of emails already sent to you, which Resend keeps for thirty days; the email the person who develops CanQuiz received if you wrote something in the app's questions, until you ask for it to be deleted by writing to privacy@canquiz.com; your support chat conversation, if you ever used it, which stays at Crisp until you ask for its deletion by writing to privacy@canquiz.com; and whatever CanQuiz returned to ChatGPT or Claude if you connected your account, which is part of those conversations and is kept by OpenAI or Anthropic under their own policy. Withdrawing consent stops analytics and recording from that moment and clears what was in your browser, but it does not by itself delete recordings and events already collected: for that, delete your account or write to privacy@canquiz.com. Your email is required to have an account: it is the only way to recognise you when you come back and to give you access again if you lose it. Without it an account cannot be created. The name and email on the content report form, by contrast, are optional: if you leave them out, the report is still reviewed, but there is no way to tell you what was decided.
Minors
CanQuiz is for people aged fourteen and over, as the Terms of Use say, including when it is used from ChatGPT or Claude, which also have their own minimum ages. Fourteen is the age from which, in Spain, you can consent to the processing of your data yourself (article 7 of Organic Law 3/2018). In other countries that age can be higher; in the European Union it goes up to sixteen. If you live in one of those countries and are not that age yet, whatever relies on your consent (analytics and session recording, phone notifications and the ChatGPT waitlist) also needs the permission of a parent or guardian, and without it you should not turn it on. You can use CanQuiz without turning on any of it. Nobody is asked their age and it is not verified: if an account is found to belong to someone under fourteen, it is deleted along with all its content. If you are a parent or guardian and believe there is an account belonging to someone under fourteen in your care, write to privacy@canquiz.com and it gets sorted.
Your rights
You can request access, rectification, erasure, restriction, portability and objection by writing to privacy@canquiz.com. Erasure does not need to be requested: you can delete your account yourself on the web or in the mobile app, as explained in Deleting your account. On app.canquiz.com, under Settings > Privacy and account, you can also download your data as a JSON file, your access log included, and turn off emails. Whatever the file leaves out (the files you uploaded, which delete themselves within days, and what other services such as PostHog or Crisp keep) CanQuiz sends you if you ask by writing to privacy@canquiz.com. In Settings > Connected apps you can see which chat apps have access to your account and remove it, and the export also includes those apps, the chat usage counters and the mark saying whether each quiz and review was made on the web or from a chat. And you can lodge a complaint with the Spanish Data Protection Agency.
Deleting your account
You can delete your CanQuiz account and its data in any of these ways: In the iPhone or Android app: Settings > Delete account. On the web, at app.canquiz.com: Settings > Privacy and account. Without the app or the web: email privacy@canquiz.com from your account's address and ask for it to be deleted. Once you confirm, the account is deleted right away and this cannot be undone. Your quizzes, folders, review progress, AI conversations, uploaded files, the phones registered for notifications and the access of any chat apps you connected and your access log are deleted with it, along with your PostHog profile and events and your Resend contact. If you had joined the Android beta and were still waiting, that request is deleted too. If you had already been added to Google Play's tester list, CanQuiz keeps only the email, its status and the dates, no longer linked to your account, until it has taken you off that list; then that is deleted as well. If you signed in with Apple and delete the account from the iPhone app, Apple asks you to confirm, and CanQuiz also revokes the app's access to your Apple account. If you delete it on the web, or if Apple's confirmation fails, the account is still deleted and you can remove CanQuiz yourself in your Apple account settings. What remains after deletion, and for how long, is explained under Legal basis and retention.