Student data
The short version: students do not have accounts, we do not store their names, and we do not track them. Here is the full list.
What we collect
- Teachers and admins: name and email (from the school's spreadsheet or invite), role, which school they belong to, when they were invited, when they accepted and when they were last active.
- Sign-in: a teacher or admin signs in with an email link and a code from an authenticator app. The authenticator setup is held by our sign-in provider, Supabase Auth, which also keeps a security log of teacher and admin sign-ins, including the address they signed in from.
- Quizzes: the questions, answers and titles teachers create, and a monthly count of AI-generated quizzes per teacher.
- Class results: for each saved snapshot, the percent of the class that answered each question correctly and how many chose each answer. Snapshots hold no student names, nicknames or player identifiers.
- During a game only: each student's nickname, their answers, and how fast they answered, linked to a random player number, so the leaderboard works. The student's browser keeps the player number and nickname in session storage, which the browser clears when the tab closes.
- School branding: logo, colours and the names the school chooses.
- Admin record: a log of admin actions (invites, branding changes, deactivations, license changes) with who did them and when.
What we do not collect
- No student accounts, student emails or student real names.
- No nicknames after the game. When a school game ends, every nickname is replaced with "Player 1", "Player 2" and so on. A game that is abandoned without ending is cleared the same way by a daily job within a day.
- No IP addresses, browser details or device identifiers for students in our database.
- No advertising, no analytics trackers and no selling of data. The school pages load no third-party trackers.
One honest note: like any website, our hosting provider (Vercel) and our database and live-game provider (Supabase) keep short-lived technical request logs, which can include the network address of any device that loads a page or joins a live game. We do not copy those logs into our database or use them to identify anyone.
Where it is kept
In our database at Supabase, in the United States (Ohio). The app runs on Vercel. School emails are sent through Resend.
How long
- Student nicknames: until the game ends (or within a day for an abandoned game).
- Anonymous answers and class results: until the teacher or school deletes them, or the school is deleted.
- Teacher and admin details and quizzes: while the school uses Quiz Showdown for Schools. When a license ends nothing is deleted automatically: teachers can sign in and download their work for 30 days, then the school's address shows a "license ended" page until the school renews or asks us to delete everything.
Who can see it
- A teacher sees their own quizzes and class results.
- The school's admins see their teachers, usage and branding. District admins see this across their district's schools.
- Nobody at one school can see another school's data. We test this automatically: a teacher and an admin from one school try to read another school's quizzes, members, branding, class results and usage, and every attempt fails.
- Quiz Showdown staff can see school data to run and support the service.
How a school deletes everything
Teachers can delete any quiz themselves. To delete the whole school (teachers, admins, quizzes, games, class results, branding and the school's address), a school or district admin emails hello@quizshowdown.live from their school address. We confirm, delete it, and reply when it is done.