This Privacy Policy applies to the mobile application Testdroid Quiz free (com.mlcorrea.testdroidfree), developed by mlcorrea and operated under the brand CramSnap (“we”, “our”, “us”). We respect your privacy. This policy explains how we collect, use, and protect your data when you use our mobile application.
1. Information We Collect
1.1 Account Information
- Email address — when you sign up or log in
- Display name — your chosen username
- Google account token — for Google Sign-In authentication
1.2 Data You Create
- Quizzes — questions, answers, categories you create and share
- Quiz results — your scores, completion status, time taken
- Community content — comments, ratings, shared quizzes
1.3 Usage Data
- App interaction events — quiz starts, completions, AI generation usage, battle activity (collected via Firebase Analytics)
- Device information — device model, OS version (anonymized)
- Crash reports — technical data when the app crashes (collected via Firebase Crashlytics)
- Daily streak data — app open dates, streak count (stored locally and synced to your account)
1.4 Data We Do NOT Collect
- We do NOT collect your AI API keys — they are stored locally on your device only
- We do NOT access your photos, camera, or files except when you explicitly use the document scanner feature
- We do NOT track your location
- We do NOT sell your data to third parties
2. How We Use Your Data
- Provide and improve the CramSnap service
- Sync your quizzes and progress across devices
- Enable community features (sharing, battles, leaderboards)
- Send push notifications (streak reminders, battle challenges) — you can disable these in app settings
- Analyze usage patterns to improve the app (anonymized via Firebase Analytics)
- Detect and fix crashes (via Firebase Crashlytics)
2.1 Your AI Keys
CramSnap uses a “Bring Your Own Key” (BYOK) model for AI quiz generation. When you add an API key (e.g., Google Gemini, Groq), it is:
- Stored locally on your device only
- Never transmitted to our servers
- Used directly by your device to communicate with the AI provider
- Subject to the AI provider’s own privacy policy
3. Advertising
CramSnap uses Google AdMob to show advertisements. AdMob may collect your device’s Advertising ID (AAID), approximate region (derived from your IP address), and usage data to serve and measure ads.
This data is governed by Google’s Privacy Policy and Advertising Privacy controls.
EU, UK and EEA users: When you first open CramSnap, a consent dialog powered by Google’s User Messaging Platform (UMP) asks whether you agree to personalised ads. Your choice is stored on your device. You can withdraw your consent at any time via app settings or by contacting us.
All regions: You can opt out of personalised ads by resetting your Advertising ID in your device settings (Android: Settings → Privacy → Ads → Reset advertising ID).
4. Data Sharing
We only share data with:
- Firebase (Google) — for authentication, analytics, crash reporting, and push notifications
- AdMob (Google) — for serving advertisements
- Other users — only the content you explicitly share (quizzes, comments, ratings, battle challenges)
We do NOT sell, rent, or trade your personal data.
5. Data Retention
- Your account data is retained while your account is active
- Analytics data is retained for up to 2 months
- Crash reports are retained for 90 days (Firebase Crashlytics default)
- When you delete your account, your personal data is removed immediately; any shared content kept for other users is anonymised at the same time. See the next two sections for details.
5.1 What happens to content you’ve shared
When you delete your account, we permanently remove your personal information — name, email, profile photo, friends list, gameplay history, daily streaks, coin balance, purchases and login credentials.
Content you have shared with other users — quizzes used in a tournament, quizzes assigned to a teacher’s class, or quizzes other users are currently playing — will remain available to those users so their experience isn’t broken. In all of those places, your name is replaced with “Deleted user” so the content can no longer be linked back to you.
This retention is based on the legitimate interests of other users (Article 6(1)(f) GDPR) and on the carve-outs in Article 17(3)(a) and (e) of the GDPR. Quizzes you created that aren’t being used by anyone else are deleted in full.
If a specific piece of your content contains information you want removed — for example, your name in a quiz title or a question you wrote — contact us at [email protected] and we’ll review the request individually.
5.2 Operational data kept briefly after deletion
- Hashed copy of your email — 20 days. A one-way hash (SHA-256) of your email is stored so you can’t immediately re-register with the same address. This is an anti-abuse measure. After 20 days the hash is removed and the email can be used again. A different email address can be used at any time.
- Analytics events — up to 2 months. Anonymous gameplay events tagged with your account identifier while you were signed in. The device-side identifier is cleared the moment your account is deleted, so no new events are linked to you.
- System logs — up to 90 days. Server-side audit logs of significant events (sign-in, account deletion, security events) for fraud detection and legal-claim defence.
See our Data Deletion page for the full breakdown.
6. Your Rights (GDPR)
As a user in the UK/EEA, you have the right to:
- Access — request a copy of your data by emailing us
- Rectification — correct inaccurate data
- Erasure — delete your account (Settings → Delete Account). See our Data Deletion page for what happens to personal data versus content shared with others
- Data Portability — request a copy of your quizzes and account data by emailing us
- Object — opt out of analytics tracking
- Withdraw Consent — at any time via app settings or by contacting us
7. Data Security
We implement industry-standard security measures:
- Authentication via JWT tokens (JSON Web Tokens)
- All API communication encrypted via HTTPS/TLS
- Firestore security rules prevent unauthorized data access
- Account deletion permanently removes personal data and anonymises any shared content (see §5.1)
8. Children’s Privacy
CramSnap is directed at users aged 13 and over. It is not designed for children under 13.
The app’s classroom and assignment features are intended for teacher-led use with secondary-school students (ages 13+) and adult learners, not for primary-school children.
We do not knowingly collect personal data from children under 13. If we become aware that a child under 13 has provided data, we will delete it promptly and remove the account.
As a precaution for younger users in our target audience, CramSnap configures Google AdMob to request non-personalised advertisements for all users in the EU, UK and EEA, regardless of age. This complies with GDPR-K (the under-age-of-consent variant of GDPR) and Google Play’s Families Policy requirements.
9. Changes to This Policy
We may update this policy from time to time. We will notify you of significant changes via the app or email. Continued use after changes constitutes acceptance.
10. Contact Us
For privacy-related questions or requests:
- Email: [email protected]
- Data Controller: mlcorrea (Manuel L trading as CramSnap.app)