Privacy Policy — BrushUpQuiz

Effective date: August 9, 2026 Last updated: August 9, 2026

BrushUpQuiz (“we”, “us”, “the app”) is a classroom quiz application. This Privacy Policy explains what information we collect, how we use it, and the choices you have.

We designed BrushUpQuiz to collect as little personal information as possible. There is no account with email or password, and we do not ask for your real name.

1. Information we collect

1.1 Information you provide

Nickname — a display label you type on first launch. You choose whatever you like. It is not verified and does not need to be your real name.
Role — whether you use the app as an instructor or a student.
Quiz content — if you are an instructor, the questions, options, correct answers, and explanations you create.
Quiz answers — if you are a student, the option you select in response to a quiz.

1.2 Information generated automatically

Anonymous user ID — an opaque, device-scoped identifier issued when you first launch the app. It has no link to your real identity and cannot be used to contact you outside the app.
Usage data — app opens, sessions, screen views, device model, OS version, app version, approximate country (from IP), and language. Recorded against the anonymous identifier only.
Diagnostic data — crash reports (stack traces, device model, OS version, timestamp) collected when the app crashes. No personal data is intentionally included in crash reports.

1.3 Camera

BrushUpQuiz uses the camera only when a student chooses to scan a join-code QR. Frames are processed on-device by AVFoundation and are not stored, transmitted, or shared. No photos or media are collected.

1.4 What we do NOT collect

We do not collect: your email address, real name, password, phone number, physical address, contacts, photos or media beyond the QR scan described above, microphone audio, health or fitness data, financial or payment data, precise or coarse location beyond country-from-IP, or any advertising identifier. We do not show the App Tracking Transparency prompt because we do not track.

2. How we use information

We use the information above to:

Sign you in and keep you signed in on your device.
Show you your role-appropriate screens.
Save the quizzes you create and the responses you submit.
Display each student’s nickname next to their response so instructors can see who answered.
Diagnose crashes and understand aggregate usage to improve the app.

We do not use your information for advertising, ad targeting, ad measurement, or sale to third parties.

If you are located in the European Economic Area, United Kingdom, or Switzerland, our legal bases under the General Data Protection Regulation are:

Performance of a contract (GDPR Art. 6(1)(b)) — for the data required to provide the app’s core functions (anonymous account, quizzes, responses).
Legitimate interests (GDPR Art. 6(1)(f)) — for aggregate analytics and crash diagnostics that help us maintain and improve the app. Our interest is limited and balanced against your rights.
Consent (GDPR Art. 6(1)(a)) — where we ask for it, such as for camera access to scan QR codes. You can revoke camera access at any time in your device Settings.

If GDPR applies to you, you have the right to:

Access the data associated with your anonymous account.
Rectify inaccurate data (e.g. change your nickname — you can currently do this by uninstalling and reinstalling, since accounts are device-scoped).
Erase your data (“right to be forgotten”) — see §7 below on how to request deletion. Note that anonymous accounts cannot always be linked back to a specific person, which limits what can be located and deleted.
Restrict or object to processing.
Portability — receive your data in a portable format.
Lodge a complaint with your local data protection authority.

To exercise any of these rights, contact us at brushupquiz@gmail.com.

5. Your rights under CCPA (California residents)

If you are a California resident, you have the right to:

Know what personal information (if any) we have collected.
Request deletion of personal information.
Opt out of the “sale” or “sharing” of personal information — although we do not sell or share personal information for any purpose.
Non-discrimination for exercising these rights.

We are not a “business” as defined by the CCPA (we do not meet the revenue or data-volume thresholds), but we honor these rights regardless. To exercise them, contact us at brushupquiz@gmail.com.

6. Third-party service providers

To operate the app we rely on services provided by Google (Firebase platform). We disclose them here so you know who processes your data:

Purpose	Provider	Data handled
Anonymous authentication	Firebase Authentication	Anonymous user identifier
Storage of nicknames, quizzes, and responses	Cloud Firestore	User content
Aggregate usage metrics	Firebase Analytics	Anonymised session/device events
Crash and diagnostic reports	Firebase Crashlytics	Stack traces, device metadata
AI-assisted quiz generation	Firebase AI (Gemini model)	Instructor-provided topic and objective text
Device attestation to prevent abuse	Firebase App Check	Device attestation token only

Google’s handling of this data is governed by the Google Privacy Policy.

We do not integrate any advertising SDK, and we do not share your data with any third party beyond the providers listed above.

7. Data retention and deletion

Anonymous accounts persist on your device until you uninstall the app or clear its data. There is no cross-device account.
Quizzes and responses stored in Cloud Firestore remain indefinitely and are keyed by opaque anonymous IDs.
Analytics and crash data are retained per our providers’ default retention policies (typically up to 14 months for analytics; longer for aggregate data).
On request, if you can supply your anonymous user ID (or the join code of a quiz you created), we will bulk-delete the associated data from our storage. Email brushupquiz@gmail.com.

8. Children

BrushUpQuiz may be used by minors in classroom settings. We do not knowingly collect personal information from children. All identifiers are opaque, and no field asks for a child’s name, email, address, phone, photo, or precise location.

If you are a parent, guardian, or school administrator and believe a minor has provided data you want removed, contact brushupquiz@gmail.com and we will act promptly.

We comply with the U.S. Children’s Online Privacy Protection Act (COPPA) by design: the app does not collect the categories of personal information that COPPA regulates.

9. International data transfers

Our service providers (see §6) may store data on servers located outside your country, including in the United States. They implement safeguards (such as Standard Contractual Clauses) to protect international transfers. By using the app you understand that your data may be processed in these locations.

10. Security

We rely on industry-standard security controls: encryption in transit via TLS, encryption at rest, per-user access rules that limit each user to their own data, and device attestation to prevent abuse of the service. We do not knowingly transmit personal data outside the providers listed in §6.

No system is 100% secure. If you become aware of a vulnerability, please email brushupquiz@gmail.com.

11. Changes to this policy

We may update this policy. When we do, we will update the “Last updated” date at the top. If the change is material, we will make a reasonable effort to notify you inside the app.

12. Contact

For any privacy question, request, or complaint:

Email: brushupquiz@gmail.com