Privacy Policy

1. Scope and roles

Trivia World, developed by MMS Studio, operates the platform and its shared account, security, billing, and service systems. Coaching centers and other institutions manage their own courses, batches, exams, and enrolled students within the platform. This policy explains our platform processing; an institution may also have its own privacy practices for educational decisions and content it controls.

2. Information we handle

• Account and identity: name, email, optional phone and avatar, password hash or Google sign-in account link, account roles, sessions, verification and two-factor settings.
• Coaching and learning: institution memberships and applications, enrollments, roll numbers, batches, question banks, images, practice activity, exam answers, attempt times, scores, result visibility, and staff actions.
• Security and device: sign-in and audit events, a registered device identifier and name, app version, exam visibility or tab-switch warnings, and request information needed to investigate misuse and enforce one active exam device. This is not continuous location or camera monitoring.
• Payments and support: selected package, payment attempt and transaction details, and the information you submit when contacting us. The homepage contact form asks for name, email, WhatsApp number, and message.
• Usage and diagnostics: website page views when Firebase Analytics is configured; Android app analytics events and crash or network-error diagnostics through Firebase services.

2a. Profile photo processing

If you upload an avatar, the server checks the file, crops it to a square, and converts it to a 256 × 256 WebP image before storing it with the active object storage provider. The database stores its reference. After a replacement is saved, the service attempts to remove the previous stored avatar; a storage failure can delay that cleanup.

3. Why we use it

We use this information to create accounts, verify access, deliver coaching content and exams, calculate and release results, manage subscriptions, send requested or relevant notices, answer inquiries, investigate incidents, improve reliability, and protect the service. Exam answers and scores are used for assessment and institution reporting, not sent by our custom analytics events as ad-targeting data.

5. Google sign-in and Firebase

If you choose Google sign-in, we request basic identity scopes (openid, email, profile) to identify you, link or create your account, and show your name or avatar. We do not request Gmail, Drive, Contacts, or Calendar access. Our use of Google API data follows the Google API Services User Data Policy, including Limited Use requirements. We do not use Google sign-in profile data to train generalized AI models.

When configured, Firebase Analytics on the website records public or student route page views with pathname, page title, and referrer; our integration excludes admin, institution portal, authentication, recovery, and active exam routes and does not add user identity, scores, answers, or form contents to those events. In the Android app, Firebase Analytics records login method, exam start, and exam submission; the app associates its internal student ID with analytics and Crashlytics while signed in. Firebase Crashlytics can receive crash reports, app/device diagnostics, and recorded server or network failures. Provider SDKs may process their own technical identifiers under Google's policies.

6. Advertising and ad-free coaching content

If advertising is enabled, public website pages and public app content can show Google AdSense or AdMob ads. An active ad-free package applies to one coaching center's individual content screens only. A student enrolled in several centers can still see ads on public content, another center's ad-supported content, or mixed app screens where at least one center allows ads. The student web dashboard uses a more conservative rule: its dashboard ad appears only when every active enrolled institution allows ads. Active timed exams do not show ads. Ad and consent services may use cookies, app or device identifiers, approximate network location, and ad interactions according to their settings and applicable choices. We do not pass exam answers or scores as custom ad-targeting fields.

7. Notifications

Platform administrators may send general notices; authorized institution owners or admins may send institution or batch notices. Exam publication and result release can trigger notices. Delivery uses Firebase Cloud Messaging (FCM) for Android and, when configured, browser push. The app or browser may hold a messaging token and topic subscriptions for authorized groups. Topics route delivery; they are not permission to open a protected result or exam. The server checks access again when a protected page is opened. Group notification payloads avoid individual scores. Browser or device permission and settings can limit delivery, and you can change notification permission in your browser or device settings.

8. Other providers and browser storage

We use hosting, database, object storage, email, payment, Google authentication, Firebase, and advertising providers as needed for the configured service. Question images live in the configured object storage provider; database records reference them. If the homepage contact form is enabled, your submitted fields are sent directly from your browser to Web3Forms so the message can be delivered. That form stores a five-minute sent-status timestamp in your browser's local storage to limit repeat submissions. Session cookies keep you signed in; browser storage may also hold interface preferences and notification state. Third-party services may process data in other countries under their own terms.

9. Retention, requests, and choices

We keep data while needed for accounts, active subscriptions, educational records, security, support, and applicable obligations. Exam history and audit or payment records may need to remain after an enrollment ends; backups and provider retention may run on different schedules. We do not promise immediate deletion of every record. To request access, correction, or deletion, use an available contact option on the homepage and identify the account and institution involved. We may verify your identity and coordinate institution-held academic records before acting. You can revoke Google account access in your Google settings, and manage notification or advertising consent through the controls offered by your device, browser, and configured consent service.

10. Children, protection, and changes

Students and institutions should obtain any parent, guardian, school, or regional permissions required before a minor uses the service. We use role-based access, server-side validation, password hashing, and other safeguards described on our Security page; no online service can guarantee absolute security. We may update this policy as the product or applicable requirements change and will post the revised date here. For questions or privacy requests, use an available contact channel on the homepage.