Privacy Policy

Last updated: 2026-08-10

This policy explains what personal data StudyQuest collects, why we collect it, how long we keep it and what you can do about it. It covers the consumer service at studyquest.app. If you use StudyQuest through your school, see section 1.

1. Who is responsible for your data

StudyQuest is operated by VIKSE DEVELOPMENT AS, organisation number 937 865 163, Damsgårdsveien 18, 5058 Bergen, Norway. For the consumer service we are the data controller, and you can reach us at hello@studyquest.app.

If you use StudyQuest through a school, on an address like yourschool.studyquest.app, your school is the data controller for the data in its tenant and we act as a data processor on the school's instructions under a Data Processing Agreement. Direct your questions and requests to your school in the first instance; we will pass on anything that reaches us. School deployments load no third-party analytics at all.

2. What we collect and why

2.1 Account data

Your email address, a password hash (never the password itself), your display name, avatar and language preference. If you sign in with Google or GitHub, we receive your email address and basic profile from that provider instead of a password. We need this to create your account, sign you in and contact you about the service.

2.2 Study material you upload

The PDFs, Word documents, images and text you upload, the text extracted from them, and the questions the AI generates from that text. This is the core of the service: without it there is nothing to turn into a quiz. Anything you paste or upload is stored under your account until you delete it.

Please do not upload material containing other people's personal data, health information or anything else sensitive that is not necessary for studying.

2.3 How you use StudyQuest

Quiz attempts and answers, scores and high scores, XP, levels and streaks, which games you played, study plans and the topics you struggle with, Pomodoro sessions, and your progress through any modules assigned to you. We use this to show your progress, keep score, adapt questions to your weak topics, and to understand which parts of the product work.

2.4 Multiplayer and classroom games

In Knowledge Royale, Boss Battle and the other multiplayer modes, your display name and live score are visible to the other players in that session. Nothing else about your account is shared with them.

2.5 Subscription and payment

If you buy a subscription, the payment itself is handled by Stripe. We never see or store your card number. We store your subscription status, plan, billing period and Stripe customer and subscription identifiers, so we know what you have access to and can handle refunds and cancellations.

2.6 Support, feedback and email

Emails you send us, ratings and written feedback you leave on games, and game suggestions you submit. We use these to answer you and to improve the product. Service emails (verification, password reset, receipts, and notices about your subscription) are part of the contract. Product and marketing emails have an unsubscribe link in every message, and unsubscribing stops them without affecting your account.

2.7 Technical information

IP address, browser and device type, timestamps and requested paths, held in server logs, plus error reports when something breaks. We use these to keep the service running, to debug faults and to detect abuse.

2.8 Analytics (only with your consent)

If you accept analytics cookies, Google Analytics and DataFast record pseudonymous usage: page paths, referrer, a device or session identifier, and product events such as which game was started. We use this in aggregate to see what people use and where they get stuck. If you decline, neither is loaded and no analytics identifiers are created. You can change your mind at any time through the "Cookies" link in the footer.

Analytics is never loaded on school deployments, whatever the visitor chooses.

3. Legal basis

Under Article 6 GDPR we rely on:

  • Performance of a contract — your account, uploads and generated questions, learning progress, multiplayer sessions, subscription handling and service emails. Without this data there is no service to provide.
  • Consent — analytics and product-marketing email. You can withdraw consent at any time, and withdrawing is as easy as giving it.
  • Legitimate interests — keeping the service secure and available, debugging, preventing abuse and fraud, and defending legal claims. We have weighed these against your interests, and they are limited to what is needed for those purposes.
  • Legal obligation — retaining billing records for the period required by Norwegian accounting law.

We do not make decisions with legal or similarly significant effects on you by automated means, and we do not sell personal data.

4. How long we keep it

  • Your account and its content — for as long as the account exists. Deleting your account removes it.
  • Inactive consumer accounts — 24 months after your last sign-in, followed by deletion.
  • Uploaded material and generated question packs — until you delete them or close your account.
  • Server access logs and error reports — 90 days.
  • Billing records — as long as tax and accounting law requires, currently 5 years.
  • Backups — a rolling 7 days, after which deleted records are overwritten in the ordinary backup cycle.

5. Who we share it with

We use a small number of processors to run the service, each under a data processing agreement:

  • Supabase — database, authentication, file storage and serverless functions. Stockholm, Sweden.
  • Netlify — hosting and content delivery.
  • OpenAI — generates quiz questions from your uploaded material, powers the study assistant and the mini-game builder. Inputs and outputs are not used to train OpenAI's models.
  • Stripe — payment processing.
  • Resend and Brevo — transactional and product email.
  • Google Analytics and DataFast — analytics, only with your consent, and never on school deployments.

The current list, with regions, data categories and links to each provider's terms, is at studyquest.app/legal/sub-processors.

Beyond these, we disclose personal data only where the law requires it, to establish or defend legal claims, or to a purchaser as part of a business transfer — in which case this policy continues to apply until you are told otherwise.

We serve our own fonts from our own servers, so loading a StudyQuest page does not reveal your IP address to a font provider.

6. Transfers outside the EEA

Your account data and uploads are stored in the EEA (Stockholm). Some processors handle data in the United States: OpenAI, Resend, Netlify's edge network, and Google Analytics onward from Ireland. Those transfers rely on the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914) and, where the provider is certified, the EU-US Data Privacy Framework. Ask us at hello@studyquest.app for a copy of the relevant safeguards.

7. Your rights

You have the right to:

  • access the personal data we hold about you and receive a copy;
  • correct data that is wrong or incomplete;
  • delete your data ("right to be forgotten");
  • restrict or object to processing based on legitimate interests;
  • receive your data in a structured, machine-readable format and have it transferred to another provider;
  • withdraw consent at any time, without affecting processing that already happened.

You can edit your profile and delete your account yourself from the Account page — that removes your account, your uploads and your learning history, and cancels any active subscription. For anything else, write to hello@studyquest.app with the subject "Data subject request". We answer within one month, and free of charge. Our full procedure is in our data subject request policy.

If you think we are handling your data wrongly, you can complain to the Norwegian Data Protection Authority, Datatilsynet, or to the supervisory authority where you live or work.

8. Cookies and local storage

StudyQuest stores things in your browser in three categories:

  • Necessary — your sign-in session (Supabase), your language, your cookie choice, and Stripe's fraud-prevention cookies during checkout. These are required for the service to work and are not optional.
  • Functional — game progress, high scores, Pomodoro state, tutorial and onboarding flags. These stay on your device and make the app behave the way you left it.
  • Analytics — Google Analytics (`_ga`, `_ga_*`, `_gid`) and DataFast, set only if you accept. Declining, or withdrawing later, stops them and deletes the ones already set.

You can change or withdraw your choice at any time through the "Cookies" link in the footer, and you can clear everything by clearing site data in your browser.

9. Children and age limits

StudyQuest is built for students, and we take that seriously. You must be at least 13 years old to create your own StudyQuest account. Where the law where you live sets a higher age for consenting to online services on your own — the GDPR lets member states set it anywhere from 13 to 16 — you need your parent or guardian's permission below that age, or you should use StudyQuest through your school, where the school is the controller and the arrangement is covered by its agreement with us.

We do not knowingly collect data from children below these limits. If you believe a child has given us personal data without the required permission, write to hello@studyquest.app and we will delete it.

10. Security

Data is encrypted in transit. The database enforces row-level security, so one account cannot read another's rows. Access to production systems is limited to those who need it, and payment card details never touch our servers. No system is perfectly secure, but if a breach occurs that puts your rights at risk we will notify you and the supervisory authority as the GDPR requires.

11. Changes to this policy

We update this policy when the service changes. The date at the top always reflects the current version, and we will tell you about significant changes by email or in the app before they take effect.

12. Contact

  • Controller — VIKSE DEVELOPMENT AS (org. 937 865 163)
  • Address — Damsgårdsveien 18, 5058 Bergen, Norway
  • Email — hello@studyquest.app
  • Supervisory authority — Datatilsynet, datatilsynet.no