We respect your data. We collect the minimum necessary to provide the service, we never sell your information, and we give you control over your account and content.
1. Data We Collect
Account information: When you create an account, we collect your email address and display name. If you sign in via Google or Microsoft, we receive your name and email from the identity provider. We do not receive or store your Google or Microsoft password.
Educator registration (optional): Educators may tell us the name of the school, college or business where they teach, and its country. Both are optional and we do not verify them. They are not shown to anyone, and naming an establishment does not link your account to it or make you its representative.
Quiz content: Quizzes, images, and other content you upload are stored on our servers and in cloud object storage. This content belongs to you.
Quiz responses: When you take a quiz, we record your answers, scores, and timing information to provide results and progress tracking.
Technical data: We collect standard server logs including IP addresses, browser type, and request timestamps. These are used for security, debugging, and service reliability.
Cookies: We set two cookies, and both are strictly necessary to keep you signed in: a short-lived access token and a refresh token. Both are httpOnly and Secure, so they cannot be read by JavaScript and are only ever sent over HTTPS. We set no advertising, analytics or tracking cookies, and we load no third-party scripts. Because we use no non-essential cookies, there is nothing here that requires a consent banner under the ePrivacy Directive — and no consent for you to withdraw.
Analytics: We measure traffic by reading our own web server logs, not by tracking you in the browser. There is no analytics tag, no pixel and no third-party analytics service. IP addresses are anonymised before they appear in any report, and the underlying logs are deleted after 90 days.
2. How We Use Your Data
- To provide the service: authenticating you, storing your quizzes, recording your attempts and scores
- To enable quiz authors to enrol students by email address
- To understand, in aggregate, which countries and kinds of establishment our educators come from. The optional establishment name and country are used for this alone — never to decide anything about your account, what you pay, or who you are connected to
- To maintain security and prevent abuse
- To improve the service based on aggregate, non-identifying usage patterns
We do not use your data for advertising, profiling, or automated decision-making. We do not sell, rent, or share your personal data with third parties for their own purposes.
3. Legal Basis for Processing (GDPR)
If you are in the European Economic Area (EEA) or United Kingdom, we process your data under the following legal bases:
- Contract: Processing necessary to provide the service you signed up for (account management, quiz delivery, score tracking)
- Legitimate interest: Security monitoring, fraud prevention, and service improvement
- Consent: Where required, such as for optional communications
4. Data Sharing
We share data only in these limited circumstances:
- Quiz authors can see the email address, display name, attempt count, and best score of students enrolled in their quizzes
- Infrastructure providers (hosting, object storage) process data on our behalf under data processing agreements
- Legal requirements: We may disclose data if required by law, court order, or to protect safety
We do not share data with advertising networks, data brokers, or social media platforms.
5. Data Storage and Security
Your data is hosted in Germany, inside the European Union. The application server, the database, the object storage holding quiz files and images, and the encrypted off-site backups are all located in EU data centres operated by Hetzner Online GmbH. Nothing in the core service is stored outside the EU. All connections to the service use TLS encryption (HTTPS).
As an EU-hosted service we are subject to the General Data Protection Regulation (GDPR), and the rights set out in section 7 apply to everyone who uses the service, not only to users in Europe.
Passwords (for email/password accounts) are hashed using bcrypt and never stored in plain text. Authentication tokens are stored in secure, httpOnly cookies that are not accessible to JavaScript.
6. Data Retention
- Account data: Retained while your account is active. You can request deletion at any time.
- Quiz content: Retained while associated with an active account. Deleted when you delete a quiz or your account.
- Quiz responses and scores: Retained while the associated quiz exists. Deleted when the quiz is deleted.
- Server logs: Retained for up to 90 days for security and debugging purposes.
7. Your Rights
Regardless of where you are located, you have the right to:
- Access your personal data — view your account information and quiz history within the app
- Correct inaccurate data — update your display name and account details
- Delete your data — delete individual quizzes (including all associated data) or request full account deletion
- Export your data — your quiz content is in standard Markdown format and can be downloaded
- Withdraw consent — where processing is based on consent, you may withdraw it at any time
Additional rights under GDPR (EEA/UK): You have the right to data portability, the right to restrict processing, and the right to lodge a complaint with your local data protection authority.
Additional rights under US state privacy laws (CCPA, CPA, etc.): You have the right to know what personal information is collected, to request deletion, and to opt out of the sale of personal information. We do not sell personal information.
8. Children's Privacy
Accounts are for people aged 16 or over. Ireland's digital age of consent is 16, and everyone creating an account must confirm they meet it — we do not knowingly collect personal data from children under 16. We ask for confirmation rather than a date of birth, because we need to know the requirement is met, not how old you are.
If you are under 16, you can still use every practice quiz. The quizzes at whoiswilson.com/q need no account and no sign-up. They run entirely in your browser, and your answers are never sent to us or stored anywhere — so using them creates no personal data at all.
Schools wishing to use the service with students under 16 should contact us, so the arrangement can be set up with the school as the party holding the relationship with parents and guardians.
If you believe a child under 16 has provided us with personal data, please contact us and we will delete it promptly.
9. International Transfers
The service itself stores nothing outside the EU (see section 5). A small number of specialist providers we rely on do operate outside the European Economic Area, and limited data reaches them in the course of doing their job:
- Google and Microsoft — only if you choose to sign in with one of them, and only to confirm who you are.
- Stripe — payment and subscription details, only if you subscribe to a paid plan. We never see or store your card number.
- Resend — your email address, in order to deliver the emails the service sends you.
Each of these transfers is covered by the European Commission's Standard Contractual Clauses or an equivalent approved safeguard. If you use a free account and sign in with a password rather than with Google or Microsoft, your personal data does not leave the EU at all.
10. Changes to This Policy
We may update this privacy policy from time to time. Material changes will be communicated through the service. The "Last updated" date at the top reflects the most recent revision.
11. Contact
If you have questions about this privacy policy, wish to exercise your rights, or want to request account deletion, please contact us at:
Email: support@whoiswilson.com