Privacy policy

This policy explains what information Piquill collects when you use the question bank, buy a plan, save assessments or connect Google Classroom, why we use it, who else receives it, how long we keep it and what rights you have. Piquill is an independent educational service. Piquill is currently offered to users in the United States, Türkiye and Azerbaijan. Please also read our Terms of use.

Who is responsible for your information

Piquill is operated by Bogaç Karçıka, an individual based in Azerbaijan. He is the controller of the personal information described here (the “data controller” under the GDPR, the “veri sorumlusu” under Türkiye's Personal Data Protection Law No. 6698, “KVKK”, and the “business” under US state privacy laws). Contact for all privacy questions and requests: support@piquill.com.

Information we collect

• Account details. Firebase Authentication (a Google service) handles sign-in with Google or with email and password. We receive your account identifier, email address and, when available, your name. When you register, we also collect your country (selected at registration) and your year of birth (to check the minimum age requirement; we do not collect your full date of birth). We never receive or store your Google password.
• Plan and billing status. When you buy a plan, our payment provider Polar tells us your customer email, the product you bought (package, plan, student or teacher account, monthly or annual), the subscription status and the renewal date. We do not receive or store your card number. When you subscribe to a paid plan, we also store a consent record in your account (`users/{uid}/consents`) confirming that you are 18 or over and paying for the subscription yourself, along with automatic-renewal confirmation (timestamp, version and age-check status class; no email address or IP address).
• Saved assessments and settings. The title, selected question identifiers, ordering and related settings of assessments you save are stored in your browser and, when you are signed in, in your Piquill account records.
• Study progress. If you mark questions or record scores, we store that status and the scores you enter in your account.
• Security and usage records. To enforce account limits and protect the original materials, we record your active sign-in sessions (at most two devices), daily question-reading counters, teacher material-allowance usage, document exports (what was exported and when) and the identifiers used in watermarks. See "Watermarks" below.
• Technical data. Like any website, our hosting and security services handle your IP address and browser details when you load the site. Google reCAPTCHA is used through Firebase App Check to keep automated programs away from our servers. With your permission only, we use Google Analytics (Google Ireland Ltd / Google LLC) to count visits and see which pages and features are used. It sets the cookies _ga and _ga_<ID> (for up to 13 months; in Google Analytics 4, IP addresses are not logged or stored and event-level data retention is configured to 2 months). We switch off advertising features and Google signals, do not send your name, email or account identifier, and do not use it while you are signed in as a student or if you are under 18. You can change your choice at any time with “Cookie settings”.

Why we use it, and on what basis

• To create and run your account, give you the content your plan includes and handle subscriptions, refunds and support. This is needed to provide the service you asked for.
• To protect the original materials, prevent scraping and account sharing, and investigate leaked content. This is our legitimate interest in protecting our work and customers.
• To meet legal duties, such as tax and consumer-law obligations, and to respond to lawful requests.
• For optional features you switch on yourself (such as Google Classroom or optional anonymous analytics), based on your choice to use them. You can stop using them or withdraw permission at any time.

Where the law requires a legal basis, we rely on the following. Under the GDPR and UK GDPR: Article 6(1)(b) (contract) for running your account and plan, Article 6(1)(f) (legitimate interests) for protecting our materials and the service, Article 6(1)(c) (legal obligation) for tax and consumer-law duties, and Article 6(1)(a) (consent) for optional features and optional analytics you switch on. Under KVKK Article 5(2): (c) the processing is necessary to perform the contract with you, (f) it is necessary for our legitimate interests, without harming your fundamental rights and freedoms, and (ç) it is necessary to meet a legal obligation; for optional features and optional analytics we rely on your explicit choice (explicit consent) to use them. Azerbaijan's personal-data law and other national laws are applied in the same way.

We do not sell your personal information, we do not “share” it for cross-context behavioural advertising, and we do not use it for advertising. We do not use advertising trackers. We use analytics only with your permission. We do not make decisions about you by solely automated means that have legal or similarly significant effects, and we do not profile you. A watermark match is always reviewed by a person (see “Watermarks”). Giving us your account details is necessary to create an account; without them we cannot provide the service.

How we collect it: you give us your information when you sign up, buy a plan or use a feature; the rest is created automatically through the site, our servers and our service providers (electronic means).

Watermarks

Pages and exported files carry your account email, the date and time and a reference code, and may carry invisible identifiers. They exist only to deter sharing and to help trace leaked material back to an account. A match is reviewed by a person before any action is taken against an account, as explained in the Terms of use.

Google Classroom and Drive

Google Classroom connection is optional. If you choose to connect, Google asks you to grant the requested permissions. Piquill uses them to list your active classes and, after you choose a class and PDF, upload that PDF to your Google Drive and create a published assignment in that class.

• Piquill reads the active class names, sections and identifiers needed to show your class list.
• Piquill uploads only the PDF file you select. The assignment title, optional instructions, due date and the Drive file reference are sent to Google Classroom for the class you choose.
• The Classroom access token is held in the page's memory while the connection is active. The Classroom feature does not save that token or your class list in Piquill's database.
• The PDF and assignment are stored in your Google account and are subject to Google's terms and privacy practices. The assignment is published to the selected class, so its students may be able to access the attached PDF.

Piquill does not sell Google user data, use it for advertising, or use it to train AI models. Google data is used only to provide the Classroom sharing action you request. Piquill's use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

AI tutor

The AI tutor is not available at the moment. If we offer it, we will update this policy first and describe which provider receives which information.

Payments

Paid plans are sold by Polar (polar.sh), which acts as the merchant of record. Polar collects your payment details, billing information and country, calculates and collects taxes, issues receipts and handles refunds and chargebacks, under its own privacy policy. We receive only the subscription information described above.

Who else handles your information

• Google (Firebase, Google Cloud and, only if you give permission, Google Analytics; United States): hosting, sign-in, database storage, server functions, App Check with reCAPTCHA, optional anonymous site analytics (with Google signals and ad personalisation turned off), and, if you connect them, Classroom and Drive. The Firebase software libraries are also loaded from Google's servers.
• Polar (United States): payments and billing, as described above.
• Authorities or advisers, only when the law requires it or to protect our legal rights.

These providers act on our behalf or under their own terms to deliver the service. They may process information in countries other than yours, including the United States and other countries where Google operates. International transfers: where the GDPR, UK GDPR or KVKK Article 9 requires safeguards for such transfers, we rely on an adequacy decision where one exists (for example the EU–US Data Privacy Framework, where the provider is certified) or on the standard contractual clauses and other transfer mechanisms that those providers offer in their terms. You can contact us to ask how a transfer is protected. The categories of recipients are: hosting, authentication, database and payment providers (Google and Polar), and public authorities where the law requires it.

How long we keep information

• Account, saved assessments, study progress, plan records, subscription confirmation records (`consents`), session, usage and export records: kept while your account is open. When you ask us to delete your account, we permanently delete your personal information within 30 days (including your `consents` records). Automatic backups made by our database provider are kept for up to 7 days and then deleted, and are not used to restore deleted accounts.
• Payment and tax records: held by Polar under its own retention rules and legal obligations, and not deleted by us.
• Records we must keep by law: kept for as long as the law requires, then deleted.
• Files in your Google account (such as PDFs and assignments from the Classroom feature): not controlled by Piquill; manage or delete them in Google Drive or Classroom.
• You can delete saved assessments yourself at any time.

Children

Piquill is not for anyone under 16, and we do not knowingly collect information from them (this includes children under 13, who are covered by the US Children's Online Privacy Protection Act, COPPA). If you are under 18, a parent or guardian must agree to our terms for you to use the free Starter plan. Paid plans can be bought only by people aged 18 or over. If you are 16 or 17, a parent or guardian can pay for your plan using a payment link from your account; we record that it was a parent-pay purchase, and the plan applies to your account. We rely on the contract with you, and on your parent or guardian's permission, rather than on a child's consent; where your country sets a higher minimum age for using online services, you must meet it. If we learn that we hold information from someone under 16, we will delete it. If you believe this has happened, please contact us. Schools and teachers who ask students to use Piquill are responsible for having the permissions their own rules and local law require (for example parental consent, or in the US the school's FERPA responsibilities). We use student information only to provide Piquill. We do not use student information to train or fine-tune AI models, for targeted advertising, or sell it, and we do not build profiles of students for any other purpose.

Cookies and browser storage

Piquill uses essential browser storage (cookies, localStorage, sessionStorage and IndexedDB) to keep you signed in, remember your device session, theme, current test draft, your acceptance of the Terms, and your analytics preference (dpmv_analytics_consent). Google's sign-in, Firebase and reCAPTCHA services may also set cookies or similar storage that they need to work. We do not use advertising cookies. Optional Google Analytics cookies (such as _ga and _ga_<ID>) are disabled by default and are set only if you choose “Allow” in the analytics banner (and never for student accounts or users under 18). You can change your choice at any time from the “Cookie settings” link in the footer; if you choose “No thanks”, we disable Google Analytics and clear any _ga cookies.

Your rights

To use any right below, email support@piquill.com from the address on your account. We may need to confirm that it is you. We reply free of charge and without undue delay, within 30 days at the latest (up to 45 days for US residents, and we will tell you if the law lets us extend a deadline). You can also disconnect Piquill from your Google Account in your Google Account’s third-party connections settings.

Piquill is currently offered in the United States, Türkiye and Azerbaijan.

EU, EEA and UK (GDPR and UK GDPR). You have the right to access your information and get a copy; to have it corrected; to have it erased; to restrict its use; to receive it in a portable format; to object to processing based on our legitimate interests; and to withdraw consent at any time (this does not affect earlier use). You can complain to your data-protection authority, for example in the country where you live or work.

Türkiye (KVKK Article 11). By applying to the controller, you can: learn whether your personal data is processed; request information if it has been processed; learn the purpose of processing and whether it is used accordingly; learn the third parties to whom your data is transferred in Türkiye or abroad; request correction if it is incomplete or inaccurate; request erasure or destruction under Article 7; request that these actions are notified to third parties who received your data; object to a result against you that arises from analysing your data exclusively by automated systems; and claim compensation if you suffer damage from unlawful processing. If you are not satisfied with our reply, or we do not reply within 30 days, you can complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu, kvkk.gov.tr) within the periods set by Law No. 6698.

US residents. See “Notice for US residents” below. Everywhere else, you have the rights your national law gives you, and you can complain to your national data-protection authority.

Notice for US residents

Piquill may be below the size at which laws such as the California Consumer Privacy Act (CCPA, as amended by the CPRA) apply to us, but we give all US residents, including those in California, Virginia, Colorado, Connecticut and other states with privacy laws, the following. In the past 12 months we collected these categories of personal information, from you and from our service providers: identifiers and registration details (name, email, account ID, country, year of birth, IP address); commercial information (plan and subscription status); internet and service activity (sessions, reading counters, export records); and education-related information you create (saved assessments, study progress and scores you enter). We collect no precise location, no government IDs, no health data and no other sensitive personal information. We use it for the purposes in “Why we use it” and disclose it only to the service providers listed above for those purposes. We do not sell personal information and do not share it for cross-context behavioural advertising, so there is nothing to opt out of, and we do not knowingly sell or share the information of anyone under 16.

You can ask us to tell you what we hold (right to know and access), to delete it, to correct it, and to give it to you in a portable format, and we will not treat you worse for using these rights. An authorised agent can make a request for you, and we may ask to verify the agent’s authority and your identity. If we refuse a request you can appeal by replying to our message with the word “Appeal”; we will answer within 60 days and, where your state allows, you may also contact your state attorney general. Schools: if a school asks us to sign a data-protection agreement, contact support@piquill.com. Do Not Track and Global Privacy Control: Piquill does not track you across other websites. If your browser sends a Global Privacy Control signal (navigator.globalPrivacyControl), we treat optional analytics as declined automatically.

Security

Piquill uses access controls, per-user data isolation, encrypted connections and the security features of its service providers to protect account data. No online service can guarantee absolute security. If a security incident affects your information, we will tell you and the authorities as the law requires (for example, the GDPR 72-hour notice to the supervisory authority and the KVKK notice to the Board and to affected people without delay).

Changes to this policy

We may update this policy. If we make an important change, we will tell you on the site or by email before it applies to you. The date at the top shows when it was last changed.

Contact

For privacy questions or requests, email support@piquill.com.

← Back to Piquill · Terms of use