Privacy Policy

Last updated: 2026-11-06

This policy explains what personal data StudyQuest collects, why we collect it, how long we keep it and what you can do about it. It covers the consumer service at studyquest.app and the StudyQuest iPhone app. If you use StudyQuest through your school, see section 1.

1. Who is responsible for your data

StudyQuest is operated by VIKSE DEVELOPMENT AS, organisation number 937 865 163, Damsgårdsveien 18, 5058 Bergen, Norway. For the consumer service we are the data controller, and you can reach us at hello@studyquest.app.

If you use StudyQuest through a school, on an address like yourschool.studyquest.app, your school is the data controller for the data in its tenant and we act as a data processor on the school's instructions under a Data Processing Agreement. Direct your questions and requests to your school in the first instance; we will pass on anything that reaches us. School deployments load no third-party analytics at all.

2. What we collect and why

2.1 Account data

Your email address, a password hash (never the password itself), your display name, avatar and language preference. If you sign in with Google or GitHub, we receive your email address and basic profile from that provider instead of a password. We need this to create your account, sign you in and contact you about the service.

Sign in with Apple (in the iPhone app) works the same way. Apple sends us the email address you choose to share, either your own or a private relay address from Apple that forwards to you. If you share your name, Apple sends it only the first time you sign in, and we save it on your account. Apple never shares your Apple password with us.

2.2 Study material you upload

The PDFs, Word documents, images and text you upload, the text extracted from them, and the questions the AI generates from that text. This is the core of the service: without it there is nothing to turn into a quiz. Anything you paste or upload is stored under your account until you delete it.

Please do not upload material containing other people's personal data, health information or anything else sensitive that is not necessary for studying.

2.3 How you use StudyQuest

Quiz attempts and answers, scores and high scores, XP, levels and streaks, which games you played, study plans and the topics you struggle with, Pomodoro sessions, and your progress through any modules assigned to you. We use this to show your progress, keep score, adapt questions to your weak topics, and to understand which parts of the product work.

2.4 Multiplayer and classroom games

In Knowledge Royale, Boss Battle and the other multiplayer modes, your display name and live score are visible to the other players in that session. Nothing else about your account is shared with them.

2.5 Subscription and payment

If you buy a subscription, the payment itself is handled by Stripe. We never see or store your card number. We store your subscription status, plan, billing period and Stripe customer and subscription identifiers, so we know what you have access to and can handle refunds and cancellations.

In the iPhone app, you buy a subscription through Apple's App Store. Apple handles the payment, and we never see your card or other Apple payment details. RevenueCat manages these subscriptions for us. It receives your StudyQuest account id and the App Store purchase history for that account: which plan you bought, when it started, when it renews or ends, and the transaction identifiers. If you buy before signing in, RevenueCat moves the purchase to your account when you sign in. From RevenueCat we store your plan, its status, whether it renews, when it ends and Apple's subscription identifier, so Premium works both in the app and on studyquest.app. Apple handles refunds and cancellations for App Store subscriptions.

2.6 Support, feedback and email

Emails you send us, ratings and written feedback you leave on games, and game suggestions you submit. We use these to answer you and to improve the product. Service emails (verification, password reset, receipts, and notices about your subscription) are part of the contract. Product and marketing emails have an unsubscribe link in every message, and unsubscribing stops them without affecting your account.

2.7 Technical information

IP address, browser and device type, timestamps and requested paths, held in server logs, plus error reports when something breaks. We use these to keep the service running, to debug faults and to detect abuse.

When you sign in with email and password, sign up or reset your password, on the website or in the iPhone app, Cloudflare Turnstile checks that you are a person and not a bot. Most of the time this happens without you noticing. To do this, Cloudflare looks at signals from your browser or device, such as your IP address and browser type. These signals are used only to stop bots, fraud and abuse.

2.8 Analytics (only with your consent)

If you accept analytics cookies, Google Analytics and DataFast record pseudonymous usage: page paths, referrer, a device or session identifier, and product events such as which game was started. We use this in aggregate to see what people use and where they get stuck. If you decline, neither is loaded and no analytics identifiers are created. You can change your mind at any time through the "Cookies" link in the footer.

Analytics is never loaded on school deployments, whatever the visitor chooses.

2.9 The iPhone app

The iPhone app uses the same account as the website and collects the same kinds of data, as described above. The first time the app is about to send your notes, photos, files or a topic to an AI service to make questions, it asks for your permission. When you ask the app why an answer is wrong, the question goes to the AI service too. If you choose "Not now", nothing is sent, and the app asks again the next time. If you choose "Allow", the app remembers that on your phone. Your material is not used to train AI models.

The app does not load Google Analytics or DataFast. It keeps your sign-in and settings on your phone.

3. Legal basis

Under Article 6 GDPR we rely on:

  • Performance of a contract — your account, uploads and generated questions, learning progress, multiplayer sessions, subscription handling and service emails. Without this data there is no service to provide.
  • Consent — analytics and product-marketing email. You can withdraw consent at any time, and withdrawing is as easy as giving it.
  • Legitimate interests — keeping the service secure and available, debugging, preventing abuse and fraud, and defending legal claims. We have weighed these against your interests, and they are limited to what is needed for those purposes.
  • Legal obligation — retaining billing records for the period required by Norwegian accounting law.

We do not make decisions with legal or similarly significant effects on you by automated means, and we do not sell personal data.

4. How long we keep it

  • Your account and its content — for as long as the account exists. Deleting your account removes it.
  • Inactive consumer accounts — 24 months after your last sign-in, followed by deletion.
  • Uploaded material and generated question packs — until you delete them or close your account.
  • Server access logs and error reports — 90 days.
  • Billing records — as long as tax and accounting law requires, currently 5 years.
  • Backups — a rolling 7 days, after which deleted records are overwritten in the ordinary backup cycle.

5. Who we share it with

We use a small number of processors to run the service, under data processing agreements:

  • Supabase — database, authentication, file storage and serverless functions. Stockholm, Sweden.
  • Netlify — hosting and content delivery.
  • OpenAI — generates quiz questions from your uploaded material, powers the study assistant and the mini-game builder. Inputs and outputs are not used to train OpenAI's models.
  • TypeSafe (TypeSafe AI, Inc.) and OpenRouter (OpenRouter, Inc.) — read the text of feedback you send us to sort it by type and severity. OpenRouter passes the request on to TypeSafe. We send only the feedback text, not your name, email or account details. TypeSafe states it does not train its models on what we send it. TypeSafe has not published a data processing agreement, and we do not have one with TypeSafe yet.
  • Scrimba (Scrimba AS, Norway) — builds a narrated video lesson from passages of your uploaded material and the questions you got wrong, only when you ask for a lesson. The lesson is deleted when you delete the upload or your account. A data processing agreement with Scrimba is being put in place.
  • Stripe — payment processing.
  • RevenueCat (RevenueCat, Inc.) manages subscriptions bought through the App Store in the iPhone app. It receives your StudyQuest account id and the App Store purchase history for that account, as described in section 2.5.
  • Cloudflare (Cloudflare, Inc.) runs the Turnstile bot check on email sign-in, sign-up and password reset, on the website and in the iPhone app. It looks at signals from your browser or device, such as IP address and browser type, only to tell people from bots and to prevent fraud.
  • Resend and Brevo — transactional and product email.
  • Google Analytics and DataFast — analytics, only with your consent, and never on school deployments.

Apple runs Sign in with Apple and App Store purchases under its own terms and privacy policy. Apple handles the payment for App Store subscriptions; we receive your subscription status, not your card details.

The current list, with regions, data categories and links to each provider's terms, is at studyquest.app/legal/sub-processors.

Beyond these, we disclose personal data only where the law requires it, to establish or defend legal claims, or to a purchaser as part of a business transfer — in which case this policy continues to apply until you are told otherwise.

We serve our own fonts from our own servers, so loading a StudyQuest page does not reveal your IP address to a font provider.

6. Transfers outside the EEA

Your account data and uploads are stored in the EEA (Stockholm). Some processors handle data in the United States: OpenAI, TypeSafe, OpenRouter, RevenueCat, Resend, Netlify's edge network, Cloudflare's network, and Google Analytics onward from Ireland. Those transfers rely on the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914) and, where the provider is certified, the EU-US Data Privacy Framework. TypeSafe has not published which transfer safeguard it relies on. Ask us at hello@studyquest.app for a copy of the relevant safeguards.

7. Your rights

You have the right to:

  • access the personal data we hold about you and receive a copy;
  • correct data that is wrong or incomplete;
  • delete your data ("right to be forgotten");
  • restrict or object to processing based on legitimate interests;
  • receive your data in a structured, machine-readable format and have it transferred to another provider;
  • withdraw consent at any time, without affecting processing that already happened.

You can edit your profile and delete your account yourself from the Account page. That removes your account, your uploads and your learning history, and cancels any active subscription bought on the website. In the iPhone app, you can delete your account under Profile. A subscription bought through the App Store is managed by Apple, so cancel it yourself in the Settings app on your iPhone. Deleting your account does not remove RevenueCat's record of your App Store purchases; write to us and we will have it deleted. For anything else, write to hello@studyquest.app with the subject "Data subject request". We answer within one month, and free of charge. Our full procedure is in our data subject request policy.

If you think we are handling your data wrongly, you can complain to the Norwegian Data Protection Authority, Datatilsynet, or to the supervisory authority where you live or work.

8. Cookies and local storage

StudyQuest stores things in your browser in three categories:

  • Necessary — your sign-in session (Supabase), your language, your cookie choice, and Stripe's fraud-prevention cookies during checkout. These are required for the service to work and are not optional.
  • Functional — game progress, high scores, Pomodoro state, tutorial and onboarding flags. These stay on your device and make the app behave the way you left it.
  • Analytics — Google Analytics (`_ga`, `_ga_*`, `_gid`) and DataFast, set only if you accept. Declining, or withdrawing later, stops them and deletes the ones already set.

You can change or withdraw your choice at any time through the "Cookies" link in the footer, and you can clear everything by clearing site data in your browser.

9. Children and age limits

StudyQuest is built for students, and we take that seriously. You must be at least 13 years old to create your own StudyQuest account. Where the law where you live sets a higher age for consenting to online services on your own — the GDPR lets member states set it anywhere from 13 to 16 — you need your parent or guardian's permission below that age, or you should use StudyQuest through your school, where the school is the controller and the arrangement is covered by its agreement with us.

We do not knowingly collect data from children below these limits. If you believe a child has given us personal data without the required permission, write to hello@studyquest.app and we will delete it.

10. Security

Data is encrypted in transit. The database enforces row-level security, so one account cannot read another's rows. Access to production systems is limited to those who need it, and payment card details never touch our servers. No system is perfectly secure, but if a breach occurs that puts your rights at risk we will notify you and the supervisory authority as the GDPR requires.

Connected assistants (ChatGPT, Claude and MCP clients)

When you ask a connected assistant to create a set, ChatGPT, Claude or your chosen client authors the questions. StudyQuest receives and stores the completed questions, answer options, correct-answer indexes and any set name, language, topic or subject you supply. This MCP saving flow does not send them to another AI service or perform its own AI generation. Format validation is not a check of factual accuracy. The separate StudyQuest upload and REST generation features still use the AI processing described elsewhere in this policy.

Connecting an assistant is optional. StudyQuest asks for your permission before giving it access to your study sets, questions and subjects. If you allow write access, the assistant can also create study sets and subjects, rename sets and organize them. We do not give the assistant your StudyQuest password, payment details or developer API keys.

When you ask an assistant to retrieve existing material, the requested study content is sent back to that assistant. Its provider handles received content under its own privacy policy and your account settings. Connect only assistants you trust and send only material you want processed. Sets and play links remain private to the owning StudyQuest account.

We store the connected application's identity, approved permissions, connection dates, last-use time and hashed credentials, together with monthly usage and save-request records needed to enforce allowances and avoid duplicate saves. Access tokens last up to ten minutes. Refresh tokens rotate and expire after thirty days without use; connections expire after ninety days. Revoked connection records are removed after thirty days and expired connections after one day during subsequent authorization-service maintenance. Study content follows the retention rules in section 4.

You can disconnect an application under Account → Connected apps. This immediately prevents future use of its connection, but cannot recall content already received by the assistant. You may delete saved study sets through StudyQuest and use the assistant provider's controls for copies held there.

11. Changes to this policy

We update this policy when the service changes. The date at the top always reflects the current version, and we will tell you about significant changes by email or in the app before they take effect.

12. Contact

  • Controller — VIKSE DEVELOPMENT AS (org. 937 865 163)
  • Address — Damsgårdsveien 18, 5058 Bergen, Norway
  • Email — hello@studyquest.app
  • Supervisory authority — Datatilsynet, datatilsynet.no