Privacy policy

Kuizoo (kuizoo.com) is operated from Malaysia. For anything about your data, write to luxlabsio@gmail.com. We answer within 7 days.

• Account details. Your name, email address, account type (teacher, student or event organizer) and a password, which we store only as a one-way hash.
• What you make. Classes, homework, quizzes, worksheets, uploaded worksheet photos and homework attachments, and the names and logos organizers add to live games.
• How students do. Answers, marks, hand-in times and teacher comments on homework, and scores in live games. Teachers see this for their own classes.
• Guests. Anyone joining a live game or handing in guest homework with a code gives only a nickname. We do not ask guests for an email or create an account for them.
• Payments. If you subscribe to Kuizoo Pro, our payment provider Stripe handles your card. We never see or store card numbers; we keep the subscription status, plan, dates and invoice references.
• Technical records. Our hosting provider keeps standard server logs (IP address, browser type, pages requested) for security and to fix faults. We do not use advertising trackers or analytics cookies.

We set one cookie, kuizoo_session, which keeps you logged in for up to a week. A few preferences, such as whether sound is on, are kept in your browser's own storage and never sent to us. Nothing on Kuizoo tracks you across other websites.

• To run the service: show teachers their classes, mark homework, keep live games in sync and bill Pro subscribers.
• To send the emails you would expect: confirming your address, resetting a password, telling a student about new or marked homework, receipts. Students can switch homework emails off in Settings.
• To keep the service safe: spotting abuse and fixing faults.

We do not sell personal data, and we do not use it for advertising.

When a teacher or organizer asks Kuizoo to write a quiz or a lesson plan, what they typed for it (the topic, year, subject and any notes, and the questions of a quiz or worksheet they chose to build a lesson around) is sent to OpenAI to generate the text. No student data, names or email addresses are sent, and nothing received from Google is sent. The result comes back to the teacher to check and edit before anyone sees it.

If you log in with Google or a DELIMa ID, Google tells us your name, email address and a Google account number, and nothing else. We use them only to create or find your Kuizoo account.

A teacher can choose to import classes from Google Classroom. Kuizoo then reads, once, the classes that teacher teaches and the names and school email addresses of the students in the classes they tick. This access is read-only, lasts under an hour, and is not kept: we never change anything in Google Classroom and never store the key Google gives us. The students listed get a Kuizoo account under their school email so they are already in the class when they log in. We do not use Google data for advertising, and we do not share or sell it.

Kuizoo's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Google Workspace APIs, including Google Classroom, adheres to the Google Workspace API User Data and Developer Policy, including its Limited Use requirements.

Data received from Google, including Google Classroom class lists, student names and email addresses, is never sent to OpenAI or any other AI service, and is never used to create, train or improve any artificial intelligence or machine learning model. Kuizoo's AI features work only on what a teacher types into them.

Student accounts are meant to be created with the knowledge of the school, teacher or parent, and we collect no more than a name and email address from a student. Students never pay and are never shown pricing. A parent or school can ask us to see, correct or delete a child's data at any time by emailing luxlabsio@gmail.com.

We use a small number of providers to run Kuizoo. Each one handles only what it needs:

• Vercel hosts the application and stores uploaded files, with servers in Singapore.
• Prisma runs the database.
• Stripe takes payments for Kuizoo Pro.
• DigitalOcean hosts the mail server that sends our emails.
• OpenAI generates quiz questions and lesson plans from the topic a teacher types. It receives no data from Google.

Some of these providers are outside Malaysia. We choose providers that protect data to a standard at least as strong as the PDPA requires.

Your data stays while your account exists so that classes, homework and results keep working. When an account is deleted, its classes, homework, quizzes, worksheets, uploads and results are deleted with it. Invoices for Pro subscriptions are kept by Stripe for as long as tax law requires. Server logs are kept for a short period for security and then discarded.

Under the PDPA you can:

• See the personal data we hold about you.
• Correct it. Your name, email and password can be changed in Settings.
• Delete your account and everything in it.
• Withdraw consent to emails that are not essential, from Settings or the link in the email.

To exercise any of these, email luxlabsio@gmail.com from the address on your account. We will act within 21 days, as the PDPA requires, and usually much sooner.

Everything travels over HTTPS. Passwords are hashed, uploaded files are stored privately and served only to the people who should see them, and payment details never touch our servers. If we ever learn of a breach that affects you, we will tell you promptly.

If this policy changes in a way that matters, we will say so on this page and, for anything significant, by email. The date at the top shows the latest version.

See also our terms of service and the FAQ.