Privacy

This notice says what we collect, why we are allowed to, how long we keep it, and what you can make us do about it. It describes what the software actually does — not what a template says a company like ours usually does.

Who is responsible

Quizdi, is the controller of the personal data described here. Write to [email protected] about anything on this page.

If you only gave us an email

We store the address, which page you entered it on, the exam you said you were interested in, the date, the wording of the consent line you agreed to, and the IP address you sent it from. The last two exist for one reason: to show, if asked, what you agreed to and when.

We send one confirmation email. If you do not click the link in it, we never email you again and your address stays unused. Every email we do send has a one-click unsubscribe.

If you study here

We store your answers, the time you spent, your estimated ability per exam domain, your review schedule, and your streak. This is what makes the practice adapt to you — without it the app cannot tell a strong domain from a weak one.

You can study without an account. When you do, we still create a row to hang your progress on and a long-lived cookie pointing at it. If you later sign up, that progress merges into your account.

If you sign in, we also store what your sign-in provider tells us: your email address, and the display name and avatar URL if the provider sends them.

If you switch on email reminders in Settings, we email that address at the time you picked, only on days you have not practiced yet. They are off until you turn them on, and one click in any reminder turns them off again.

If you tick “Email me after my exam”, we send one email the day after each exam date you set, asking how it went. It is off until you tick it, and it stops for good with one click in that email or in Settings. The score you report is how we check how accurate our estimates are.

Two more records keep the question bank from being copied wholesale. When you study as a guest, we note the IP address that started your guest session, so we can cap how many guests one network can create and how many questions they can answer each day. When you download a set of questions for offline practice, we note the IP address it was downloaded from.

Why we are allowed to hold it

If you are in the EU or the UK, the law wants us to name a legal basis for each thing we do. Ours:

Withdrawing consent stops future emails. It does not delete your study data, because that is not held on the basis of consent — ask us to delete your account for that.

Cookies

Two, and both are needed for the site to work at all:

• qz_guest — lasts one year, and is what lets you study without an account. It holds a random identifier pointing at your progress, and nothing else. A year is deliberate: people prepare for certifications over months, and a cookie that expires mid-preparation loses everything they did.
• A session cookie, set only if you sign in, so you stay signed in.

That is the whole list. There are no advertising cookies, no analytics cookies, and no third-party cookies — which is why you are not being asked to click a consent banner. If that ever changes, this page changes first and the banner comes with it.

Speed and visit counts

The app times how long two things take — opening it until the home screen is usable, and until the first practice question appears — and sends those two numbers to us. That is the whole message: a label and a number of milliseconds.

It carries no account, no cookie, no IP address and nothing about your device, and we store it the same way. We cannot tell whose measurement is whose, including our own. It exists so we can find out when the app is slow for real people instead of guessing.

While you get started, the app also notes which setup steps you reached — picking an exam, the exam date, the daily goal, the placement quiz, your study plan, the home screen, your first practice answer — and on which day, at most once per step per day. Unlike the timings above, this is stored with your progress, because the point is to see where people stop. It holds the step name and the date, nothing else: no IP address, no browser details, no page addresses. It adds no cookie of its own — it rides on the progress record you already have — and it is deleted with your account. Opening one of our public pages sends a single word the same way, tied to no one. We only ever look at the totals.

We also count page views with Cloudflare Web Analytics, so we know how many people visit and which pages they find useful. A small script sends the address of the page, the page you came from, your browser and device type, and how fast the page loaded. It sets no cookie, stores nothing on your device and does not fingerprint your browser, so it cannot follow you from one visit to the next or to other sites. We only ever see the totals.

What we do not do

We do not sell, rent or share your personal information — in the sense California law gives those words, and in the ordinary sense too. We do not run advertising trackers. We do not buy email lists. We do not profile you for anyone else’s purposes, and nothing here makes an automated decision that has a legal effect on you.

Who else sees it

As few companies as we can manage, and each of them only sees the part it needs:

• Our own server, which holds everything described above.
• Cloudflare, which sits in front of the site to serve it quickly and absorb attacks. It sees the IP address and request details of everyone who visits, including you reading this page. It also runs the visit counts described above.
• Resend, which delivers our email. It sees the addresses we send to and the content of what we send.
• Your sign-in provider — Google or GitHub, if you choose to use one. They tell us who you are; we tell them nothing about what you study.

Where your data is

Our server is in the United States, and the companies listed above process data in the United States and the European Union. If you are in the EU or the UK, that means your data leaves your region.

Where the law requires a safeguard for that transfer, we rely on the European Commission’s standard contractual clauses in our agreements with those providers.

How long we keep it

• Email addresses — until you ask us to remove them, or until you unsubscribe and we have no other reason to keep the record.
• An address that never confirmed — it is never emailed and never used for anything. We remove it whenever you ask, and we delete these in batches when we review the list.
• Study data — while your account exists. Deleting your account deletes it.
• IP addresses tied to guest sessions and offline downloads — as long as the guest session or account they belong to. Deleting your account deletes them.
• Guest progress — while the cookie lives, which is one year. Clear the cookie and the row it pointed at is left behind with no way to reach it; we remove those when we review the database.
• Payment records, once there are any — kept as long as tax law requires, which is longer than anything else here and is not ours to shorten.

Deleting an account is permanent and we cannot undo it.

What you can make us do

Whether or not you live somewhere that grants these rights by law, we apply them to everyone:

• Get a copy of what we hold about you.
• Correct anything that is wrong.
• Have it deleted.
• Stop us emailing you, without deleting anything else.
• Object to a use of your data, or ask us to pause one while we look into it.
• Take your data elsewhere in a machine-readable form.

The fastest route for the fourth one is the unsubscribe link at the bottom of any email — it needs no reply from us. For the rest, write to [email protected]. We answer within 30 days, and normally much sooner. Deleting your account is also a button inside the app, in Settings.

If you are in the EU or the UK and you think we have handled your data badly, you can complain to your national data protection authority. We would rather you told us first, but it is your right either way.

Having it deleted

Write to [email protected] and say which address to remove. We delete the row itself, including the IP address we kept as proof of consent — not a flag saying it was deleted. We may ask you to confirm you control the address, because otherwise anyone could remove anyone.

If you want us to stop emailing but keep nothing else in question, the unsubscribe link at the bottom of any email is faster and needs no reply from us.

Age

Quizdi is for people preparing for professional IT certifications and is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has given us data, write to us and we will delete it.

Keeping it safe

Everything travels over HTTPS. The email list sits behind a database policy that returns nothing to any part of the system that has no business reading it, not just behind application code. We never hold card numbers — the payment provider does, and we have no way to see them.

No system is perfect. If we ever have a breach that puts you at risk, we will tell you and the relevant authority, and we will say what actually happened.

Changes

When this changes, the date at the top changes with it. We keep a record of which wording each person agreed to, so an old consent still points at the text that was actually shown.