Privacy Policy

Last updated 31 October 2026

1. Who we are

QuizMySkill is a live quiz and skills-assessment platform operated from Australia. This policy explains what personal information we collect, why, who we share it with, and what you can ask us to do about it.

If you have a question about privacy, or want to access or correct your information, email privacy@quizmyskill.com.

2. What we collect depends on how you use QuizMySkill

There are two very different relationships, and we deliberately collect far less in the first.

If you join a quiz as a participant

You enter a session PIN and a display name. That's it. We do not ask for, and do not store, your email address, phone number, date of birth, or any login credential. No account is created for you.

While the quiz runs we record your display name, the answers you select, your response times and your score, so the quiz can be scored and the host can show results.

If you create an account

Quiz hosts, and learners who choose to register, give us:

• Email address — used to sign in, to verify the account, to reset a password, and to send service messages such as payment receipts and failed-payment notices.
• Password — stored only as a one-way cryptographic hash. We cannot read it, and nobody at QuizMySkill can tell you what it is.
• Display name, and for hosts an organisation name.
• Content you create — quizzes, questions, answers, any images you upload, and any documents you submit for AI question generation.
• Activity records — quizzes you run, sessions you host, and for learner accounts your progress and badges.

If you pay for a subscription

Payment is taken on Stripe's own hosted checkout page. Card numbers never reach our servers. We receive and store only Stripe's customer and subscription identifiers, your plan, and its status — enough to know what you're entitled to and when it renews.

Technical information

• IP address — used to rate-limit quiz-join attempts, which is what stops someone guessing session PINs. These counters are short-lived and held in memory, not in our database.
• Server logs — requests to our API, for diagnosing faults and investigating abuse.
• Browser storage — after you sign in we keep an authentication token in your browser's local storage so you stay signed in. It isn't an advertising cookie and isn't shared with anyone.

3. Why we use it

• To run quizzes, score them, and show results.
• To create and secure accounts, and to let you recover one.
• To take payment, apply the right plan limits, and tell you if a payment fails.
• To generate quiz questions when you ask us to, from material you provide.
• To keep the service available and to detect abuse — PIN guessing, fraudulent payments, and attempts to misuse the AI features.
• To meet legal and tax obligations, including Australian GST records.

We do not use your information for advertising, and we do not profile you for marketing.

4. Who else receives information

We use a small number of service providers. Each receives only what it needs, and none of them is permitted to use your information for their own purposes.

Provider	What they receive	Why
Amazon Web Services	All application data — accounts, quizzes, session results, uploaded files	Hosting, database, file storage, and email delivery. Sydney region.
Stripe	Your email address and the plan you buy. Card details go directly to Stripe and never pass through us.	Payment processing and subscription billing.
Amazon Bedrock	The text or document content you submit for AI question generation	Generating draft quiz questions. Runs in AWS's Sydney region.
Cloudflare	Your IP address and browser signals, at sign-up only	The "are you human" check that stops automated account creation.
AbuseIPDB	The IP address of a device joining a quiz	Checking whether an address is a known source of abuse, to protect live sessions.
Forward Email	Mail sent to our @quizmyskill.com addresses	Delivering email sent to us to the inbox we monitor.

We may also disclose information if we're legally required to, or where it's necessary to protect someone's safety or our legal rights.

We do not sell personal information, and we do not share it with advertisers or data brokers.

5. Where your information is stored

Our database, cache, file storage, email sending and AI processing all run in Amazon Web Services' Asia Pacific (Sydney) region — that is, in Australia.

Two exceptions, both limited to technical data rather than quiz content: our content delivery network serves images and static files from locations around the world, and the abuse-prevention checks described above are operated by providers outside Australia and receive only an IP address.

6. How long we keep it

Information	Kept for
Account details	While the account exists. Deleting an account removes it, along with the quizzes, sessions, progress and badges belonging to it.
Quiz and session results	While the host's account exists, so they can review past sessions.
Payment records	Seven years, to meet Australian tax record-keeping requirements. Held by both us and Stripe.
Rate-limiting counters	Minutes.
Server logs	A short operational period, then discarded.

Deleting an account is permanent and cannot be undone.

7. How we protect it

• All traffic to the site is encrypted in transit (HTTPS).
• Passwords are stored only as one-way hashes, never in a readable form.
• Card details never reach our systems.
• Administrative actions on accounts are recorded in an audit log.
• Changing a password signs out every other session on the account.

No system is perfectly secure. If we ever become aware of a data breach likely to cause serious harm, we'll notify those affected and the Office of the Australian Information Commissioner as the law requires.

8. Your choices and rights

You can ask us to:

• Give you a copy of the personal information we hold about you.
• Correct it if it's wrong. Note that an email address is your sign-in identity, so we change it only after confirming the request and verifying the new address.
• Delete your account and the information attached to it, subject to records we're legally required to keep, such as tax records of payments.
• Stop sending you service email. Be aware that verification, password-reset and payment-failure messages are part of operating the account; if you don't want those, the option is to close the account.

Email privacy@quizmyskill.com and we'll respond within a reasonable time. If you're unhappy with how we've handled a privacy matter, you can complain to the Office of the Australian Information Commissioner.

9. Children, schools and training organisations

QuizMySkill is designed to be used by educators and trainers with groups that may include children. This shaped the product: participants never create an account and never give us an email address or any other contact detail.

Accounts — which do require an email address — are intended for the adult running the quiz. If a learner account is created for someone under 18, we expect that to be done with the involvement of a parent, guardian, teacher or institution.

If you're a school or training organisation, you decide what your participants type as a display name, and you remain responsible for your own privacy obligations to them. If you believe a child's personal information has been given to us and shouldn't have been, contact us and we'll remove it.

10. Cookies and similar technologies

We use no advertising or analytics cookies. What we do use:

• An authentication token in browser local storage, so you stay signed in.
• A short-lived token identifying your place in a live quiz session.
• A cookie set by Cloudflare's human-verification check on the sign-up page.

11. Changes to this policy

If we change this policy we'll update the date at the top. If a change materially affects how we handle your information, we'll tell account holders by email rather than relying on you noticing.