Privacy Policy
Effective: May 30, 2026 · Last updated: September 3, 2026
Overview
QUIZFORGE ("we", "us", "our") operates the quizforge.ai website and certification prep platform. This policy explains what data we collect, how we use it, and your rights regarding that data. We aim to be straightforward — no walls of legalese.
Data We Collect
Account Information
When you create an account, we collect your email address, name, and password (stored as a salted hash — we never store plaintext passwords). If you sign up via a social provider, we receive basic profile information from that provider.
Usage Data
We collect data about how you use the platform: quiz attempts, scores, flashcard progress, and topic performance. This data powers your personal analytics dashboard and helps us improve question quality.
For signed-in and guest visits, we also record which quiz screens are visible, how long pages and screens remain visible while the tab is in the foreground, quiz actions, navigation clicks, and technical failures. We use these records to understand where visitors encounter problems. This engagement tracking does not record videos of your screen, keystrokes, passwords, payment details, or the text you type into forms.
Technical Data
We automatically collect standard technical data: IP address (used for regional pricing), browser type, device type, and pages visited. We use this for security, analytics, and to detect abuse.
How We Use Your Data
- Provide and maintain the certification prep service
- Track your learning progress and generate performance analytics
- Process payments and manage subscriptions
- Determine regional pricing based on your location
- Send transactional emails (password resets, subscription confirmations)
- Improve question quality based on aggregate performance data
- Detect and prevent fraud or abuse
We do not sell your personal data. We do not use your data for advertising. We do not share your individual quiz performance with employers or certification bodies.
Cookies y seguimiento
Usamos cookies esenciales para autenticación, gestión de sesión y acceso como invitado, y Google Analytics 4 para entender los patrones de tráfico. No usamos rastreadores publicitarios de terceros, y el almacenamiento publicitario nunca está habilitado.
En el EEE, el Reino Unido y Suiza, Google Analytics está desactivado de forma predeterminada bajo Google Consent Mode v2 y solo se activa después de que lo permitas en el aviso. En el resto del mundo funciona con anonimización de IP activada. Puedes cambiar tu elección en cualquier momento borrando el almacenamiento de este sitio en tu navegador.
| Cookie o clave | Establecida por | Propósito | Retención |
|---|---|---|---|
| authToken | QuizForge | Te mantiene con la sesión iniciada | 30 días (el token de inicio de sesión que contiene caduca a las 24 horas) |
| refreshToken | QuizForge | Renueva tu sesión sin pedirte la contraseña de nuevo | Más duradera que authToken |
| qf_vid | QuizForge | Id. de visitante anónimo usado para el análisis agregado de tráfico | 365 días |
| qf_first_exam | QuizForge | Recuerda la primera página de examen que viste, para atribución | 30 días |
| qf_guest | QuizForge | Recuerda el límite de preguntas desbloqueadas de un invitado | 365 días |
| .AspNetCore.Antiforgery.* | QuizForge (ASP.NET Core) | Protección contra falsificación de solicitudes entre sitios en formularios (integrada en ASP.NET Core) | Sesión |
| qf-consent-v1 (local storage) | QuizForge | Recuerda tu elección de consentimiento de analítica | Hasta que borres el almacenamiento de este sitio |
| _ga, _ga_GKLBQRJM3M | Google Analytics 4 (property G-GKLBQRJM3M) | Distingue visitantes y sesiones para informes agregados de tráfico | Hasta 2 años; no se establece en absoluto para visitantes del EEE, el Reino Unido o Suiza hasta que lo permitan |
| _ga_PPKND2ZSLG | Google Analytics 4, etiqueta de sitio conectada G-PPKND2ZSLG configurada en el contenedor G-GKLBQRJM3M | Distingue visitantes y sesiones para informes agregados de tráfico | Hasta 2 años; no se establece en absoluto para visitantes del EEE, el Reino Unido o Suiza hasta que lo permitan |
Third-Party Services
We share limited data with the following service providers:
- Stripe — payment processing. Stripe handles all payment card data directly; we never see or store your full card number.
- AI Providers — question generation. We send exam topic data to AI models for question generation. No personal user data is included in AI requests.
- Email Service — transactional emails (password resets, receipts).
- Cloudflare Turnstile — bot protection on sign-in and sign-up forms. Turnstile analyzes technical signals from your browser (such as IP address and device characteristics) to distinguish humans from bots. See Cloudflare's privacy policy for details.
- Google Analytics 4 — analítica agregada de tráfico, propiedad G-GKLBQRJM3M. Google recibe tu dirección IP (anonimizada), la URL de la página, el referente y el tipo de dispositivo. Nunca recibe tus respuestas del examen, tu correo electrónico ni tu identificador de cuenta. En el EEE, el Reino Unido y Suiza está desactivado hasta que des tu consentimiento.
- Google Search Console y Site Kit — informes de rendimiento de búsqueda sobre datos agregados de tráfico, no sobre el contenido de tu examen.
Data Storage and Security
Your data is stored in a PostgreSQL database on servers located in the United States. We use encrypted connections (HTTPS/TLS), secure password hashing, and role-based access controls. We regularly review our security practices, but no system is 100% secure.
Your Rights
You have the right to:
- Access your data — view your profile and quiz history from your dashboard
- Correct your data — update your profile information at any time
- Delete your account — you can delete your account yourself from your profile: open Profile, go to the Danger Zone tab, and confirm with your password. This deletes your account and associated data. If you prefer, you can also email us and we will delete it for you.
- Export your data — contact us for a copy of your data in a standard format
To exercise these rights, email [email protected]. We will respond within 30 days.
California and EU/UK Privacy Rights
California (CCPA/CPRA)
We do not sell or share personal information as those terms are defined by the California Consumer Privacy Act (CCPA) as amended by the CPRA, and we do not use personal information for cross-context behavioral advertising. California residents may exercise their rights to know, access, correct, and delete personal information using the in-app tools described above or by emailing [email protected]. We do not discriminate against you for exercising these rights.
European Union and United Kingdom (GDPR)
Where the GDPR or UK GDPR applies, we process your personal data on these legal bases: performance of our contract with you (providing the platform and your account), our legitimate interests (security, fraud prevention, and service improvement), and your consent for optional processing (such as using an uploaded document to improve our AI, which you can decline). EU and UK users may exercise their rights of access, rectification, erasure, restriction, portability, and objection by using the in-app tools described above or by contacting [email protected]. You also have the right to lodge a complaint with your local supervisory authority.
Children
QUIZFORGE is designed for professionals preparing for certification exams. We do not knowingly collect data from children under 16. If you believe a child has created an account, contact us and we will remove it.
Document Upload Tool
QUIZFORGE offers a free tool that lets you upload a document (PDF, Word, text, or similar) and receive AI-generated practice questions from its content. When you use this tool, the file you upload and the text extracted from it are stored on our servers.
We store your document for three reasons: to generate your questions, to let you continue building a full exam after you create an account, and — unless you opt out — to analyze patterns and improve our AI question generation. The upload tool includes a checkbox (checked by default) that allows us to use your document for service improvement. If you uncheck it, your document is still stored so you can use it, but it is marked private and excluded from analytics and AI tuning.
Original uploaded files are deleted after 90 days. Anonymized extracted text and usage metadata may be retained longer for analytics purposes.
Changes to This Policy
We may update this policy as our practices evolve. Significant changes will be communicated via email to registered users. The effective date at the top of this page indicates when it was last updated.
Contact
Questions about this policy? Email us at [email protected].