Privacy Policy
Last updated: 26 February, 2026
Who We Are
Quextro is operated by Quextro LTD, a company registered in England and Wales, based in Godalming, United Kingdom.
For any privacy-related questions, you can reach us at [email protected].
What We Collect
We keep data collection to a minimum:
- Email address — only if you create an account, used for authentication and service-related communications
- Learning progress — question attempts, topic confidence ratings, and revision progress
- Usage data — analytics to understand how the site is used (only with your consent, via cookies)
- Consent preferences — your cookie choice is stored in your browser. For signed-in users, consent is also logged server-side for audit purposes
- Feedback — if you post on the feedback board, we store your post content, votes, and comments linked to your account
Why We Process Your Data
We only process your data when we have a legal reason to do so:
| What we do | Legal basis |
|---|---|
| Create your account and sign you in | Contract — needed to provide the service |
| Send you login codes via email | Contract — needed for authentication |
| Store your learning progress | Contract — core feature of the service |
| Analytics cookies (PostHog) | Consent — only if you click "Accept" |
| Marketing emails | Consent — only if you opt in |
| Security and abuse prevention | Legitimate interest — keeping the service safe |
Cookies
We use a small number of cookies:
- Session cookie (strictly necessary) — keeps you signed in. Expires after 90 days. No consent needed.
- Analytics cookies (optional) — set by PostHog to understand how the site is used. Only activated if you click "Accept" on the cookie banner. You can change your choice at any time by clearing your browser's local storage.
We do not use any advertising or tracking cookies.
Third-Party Services
We share the minimum data needed with these services to run Quextro:
| Service | Purpose | Data shared | Location |
|---|---|---|---|
| Railway | Hosting, database, infrastructure | All application data | EU / US |
| PostHog | Analytics (with consent) | Anonymous usage events, email domain only | EU |
| Resend | Email delivery | Email address, login codes | US |
Where data is transferred outside the UK/EEA, we rely on adequacy decisions or standard contractual clauses to keep your data protected.
No PDF Storage
We do not host, store, or process any PDF files. All links direct you to external sources. We only maintain an index of publicly available exam resources.
How Long We Keep Your Data
- Account data — kept while your account is active. Deleted within 30 days of an account deletion request.
- Learning progress — kept while your account is active, deleted with your account.
- Login codes — automatically deleted after 24 hours.
- Sessions — expire after 90 days and are cleaned up automatically.
- Consent records — kept for 5 years for audit purposes, even after account deletion.
- Feedback posts — kept while your account is active. Deleted with your account unless needed for legal reasons.
Data Security
Your data is stored on Railway's infrastructure with encryption in transit (HTTPS) and at rest. We use secure, HTTP-only session cookies and rate-limited authentication. Only authorised team members can access production data.
Your Rights
Under UK GDPR, you have the right to:
- Access — request a copy of the personal data we hold about you
- Rectification — ask us to correct any inaccurate data
- Erasure — ask us to delete your account and data (within 30 days)
- Restrict processing — ask us to temporarily stop processing your data
- Data portability — receive your data in a machine-readable format (JSON)
- Object — object to processing based on legitimate interest
- Withdraw consent — for analytics or marketing, at any time, without affecting the service
To exercise any of these rights, email us at [email protected]. We will respond within 30 days.
If you are not happy with how we handle your request, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.
Children
Quextro is designed for students aged 13 and over. If you are under 13, please do not create an account. If we learn that we have collected data from a child under 13, we will delete it promptly.
Changes to This Policy
We may update this policy from time to time. For significant changes, we will notify you by email or with a notice on the site. The "last updated" date at the top will always reflect the latest version.
Contact
Questions about your privacy? Email us at [email protected]
Quextro LTD, Godalming, United Kingdom