Privacy Policy

Data controller and contact details

For privacy requests, exercise of your rights and account deletion: support@novuralearning.com.

Scope

This Privacy Policy covers the Swim Quiz microsite and the Swim Quiz mobile app (Android and iOS). The microsite is static and uses no trackers. The app uses Firebase services for authentication, profile, backend, notifications enabled by the user and technical diagnostics. Quizzes with server-side verification record the session and the result in your profile; a copy of your progress is also kept on the device. Premium subscriptions are sold and invoiced by Apple or Google; ads in the Free plan are provided by Google AdMob.

Data processed by the app

Account data

Email, Firebase UID, authentication provider, verification status, username, any first name, last name, display name and avatar, as well as the technical creation and last-sign-in metadata available in Firebase Authentication. Sign-in can be done with email and password, Google and, on iOS, Apple.

Usage and profile data

The remote profile may include username, first name, last name, avatar, gem balance and quiz-related counters. When you take a quiz with server-side verification, the following are recorded in your profile: the session (questions presented, answers submitted, score and outcome), the history of completed tests and exams, module progress and badges earned; sessions that are not completed expire after 30 minutes of inactivity. The device’s SQLite database also keeps a local copy of sessions, answers, outcomes, statistics and questions to review. This data is not sent to an analytics service.

Technical and diagnostic data

Infrastructure providers may process IP address, date and time, app version, request information, technical identifiers and security or operational logs needed to provide Firebase Authentication, database, Functions and Hosting. Candidate builds use Firebase Crashlytics and Performance Monitoring for crashes, startup and performance with minimized application diagnostics; Firebase Analytics remains disabled. Notification tokens are requested and recorded only when the user enables notifications.

Reports submitted from the app

If you choose to submit a report, we process the description you write, app version, platform, language, originating screen and, only if present and confirmed, a screenshot of the interface. If you report a quiz question, we also attach the content identifier and version, language and jurisdiction, category, selected answer, answer indicated as correct and the technical information on whether the explanation was visible. This data is used to identify and verify the question without having to transcribe it in the free text. The “Shake to report” feature is disabled by default; the motion is processed on the device and is neither stored nor transmitted. Before sending you can review and remove the screenshot. Do not enter passwords, payment details or other sensitive information.

Advertising, purchases and measurement

In the Free plan the app may show a banner on the home screen, a full-screen ad after a number of completed quizzes and, if you choose to watch them, rewarded videos that award gems. Ads are provided by Google AdMob and are requested in non-personalized form. Before the first request, User Messaging Platform (and, on iOS, Apple’s tracking request) shows you the applicable choices; if the choice is not valid or has not yet been made, ads are not requested. The Premium plan shows no ads and sends no advertising requests. Even for non-personalized ads, Google and the partners in the advertising chain may process IP address and approximate location, interactions with apps and ads, diagnostic and performance data, ads displayed and technical identifiers of the app or device for advertising, measurement, security and fraud prevention. For rewarded videos, Google sends our server a view confirmation containing an opaque operation identifier.

Purchases and Premium subscription

Payment is handled exclusively by Apple or Google: we do not receive or store card numbers or other payment details. To activate and maintain Premium, our server verifies the purchase with the store and stores user identifier, platform, product, subscription status and expiry and a hash of the purchase token, needed to recognize the subscription, restore it on a new device and prevent the same purchase from being reused on multiple accounts.

Data not observed in the published client

There are no active features that collect address book, camera, microphone, precise location, messages between users, health data or payment data. The app may open the system share sheet only at the user’s initiative. The only personal upload provided by the reporter is the optional, confirmed screenshot described above.

Purposes and legal bases

Swim Quiz does not enable its own analytics adapters. No legal basis for advertising or non-essential measurement is inferred from the mere presence of code or dependencies.

Providers and recipients

Data is made accessible only to authorized persons and to the necessary providers. The exact privacy role may vary depending on the service and the contractual settings; not all providers are automatically classified in the same way.

Providers that process data on our behalf are subject to the contractual terms and protection measures applicable to the service. When advertising is active, information on partners and the available choices is presented through User Messaging Platform before any processing that requires consent.

Documentation: Firebase privacy and security, Firebase data processing terms, Google Privacy Policy, Apple Privacy.

International transfers

Google/Firebase services and sign-in providers operate on global infrastructure and may process data in the countries where the provider or its sub-providers have facilities. It is therefore not guaranteed that all data remains exclusively in Italy or in the European Economic Area.

Where transfers apply to countries not covered by an adequacy decision, the contractual safeguards made available by the provider are used, including, where applicable, Standard Contractual Clauses and other recognized mechanisms. The validity and concrete applicability of such safeguards must be verified with respect to the services and terms actually accepted.

Retention

Auth data and the remote profile, including sessions, quiz history, badges and gems, are kept while the account is active and are removed from the live application systems when deletion is successfully completed, except for data that must be retained due to a documented obligation. Progress stored on the device remains until the account is deleted from the app, the app data is removed or the app is uninstalled.

When you delete the account, the subscription and rewards no longer remain linked to you: your identifier is deleted or replaced with a random one. Only the hash of the purchase token and the identifiers of reward operations remain, without any link to you as a person, needed to prevent the same purchase or the same reward from being reused on another account. For the same reason, it is not possible to restore the same subscription on an account created after deletion.

Configurable application logs are subject to a maximum retention of 30 days. Mandatory Cloud Audit Logs may be retained by the provider for 400 days. Any future application backups will have a maximum rotation of 30 days and, after a restore, a deletion that has already been accepted must be reapplied. Logs, audit records and backups are not used to reconstruct the deleted operational profile. For in-app reports, the screenshot is automatically deleted within 30 days and the metadata and description within 90 days; they are also removed upon account deletion. Other requests sent to support are retained for the time necessary to handle them and document the outcome.

Firebase Analytics remains disabled. Firebase states a retention of 90 days for Crashlytics stack traces and associated identifiers; Performance Monitoring retains events associated with the IP address for 30 days and data associated with the installation or de-identified data for 60 days before removal begins. Installation identifiers used, among other things, by Cloud Messaging are kept until a request to delete the installation and may take up to 180 days to be removed from the provider’s live and backup systems. AdMob follows the cycles and controls described by the provider and by the applicable privacy choices.

These provider timeframes may change or include technical deletion times; they are therefore verified periodically and are not used to promise instant removal from every external system.

Provision of data, choices and consequences

Email, credentials or federated identity and the necessary technical identifiers are required to create and protect the account. If they are not provided, it is not possible to create the account or use the features that require authentication. First name, last name, avatar, notifications, reports and the related screenshot are optional; not providing them does not prevent the use of the other available features.

Advertising choices can be reviewed from the Privacy options item in the app when required by law or made available by the provider. Notification permissions can be revoked from the app or device settings. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal; in the absence of a valid choice, ads subject to consent are not requested.

Swim Quiz does not make decisions based solely on automated processing that produce legal effects or similarly significantly affect the user. Scores, review and learning suggestions organize the study experience and do not confer professional qualifications.

Account deletion

You can delete the account from the app, via Profile → Delete account, or, without signing in to the app, from the public account deletion page or by writing to support@novuralearning.com. The app declares the deletion complete only after the server procedure has been verified as concluded; requests by email are handled manually and are not declared complete until the outcome is verified.

After explicit confirmation and a sufficiently recent authentication check, the procedure removes any files in the user path, username reservations, the Firestore profile and its subcollections (including quiz sessions, history, badges and gems), submitted reports, the Firebase Authentication account and progress stored on the device. If the account uses Sign in with Apple, the link with Apple is also revoked. Deletion does not cancel the Premium subscription, which must be managed in the store.

If the procedure does not complete, the app does not declare the deletion concluded: the manual route remains available. To remove data that remains solely on the device, it is always possible to delete the app data or uninstall the app.

Deletion is complete when the directly controlled data has been removed from the live application systems. It does not entail instant removal from security logs, audit records, technical backups or separate provider systems. Any residual data is subject to the technical cycles and applicable obligations described in the Retention section and is not used to recreate the operational account.

We handle the request without undue delay and provide a response within the applicable deadline, normally one month. This deadline concerns the handling of the request and is not a promise of universal deletion from provider systems.

Cookies and similar technologies

The microsite consists of static HTML and CSS: it contains no JavaScript, forms, Analytics, advertising, external fonts or trackers and does not set any non-essential first-party cookies. Firebase Hosting may nevertheless process IP address and technical data for delivery and security. Links to Google Play, Google, Apple or the Garante generate requests to those services only when selected.

In the app, authentication, the Firebase database and the local SQLite storage are technologies distinct from the microsite’s cookies. Firebase Analytics remains disabled. Ads in the Free plan use the identifiers and technologies of Google AdMob according to the privacy choices made in the app (User Messaging Platform and, on iOS, the Apple request).

Security

We adopt proportionate technical and organizational measures and use encrypted connections to the services. Sensitive operations and the submission of reports require authentication; the content of reports is not copied into Crashlytics logs or operational emails. No system is free of risk. Any App Check enforcement is activated only after compatibility checks.

Minors

Swim Quiz is intended exclusively for persons aged at least 18 interested in swimming education and is not designed for children or minors. By creating an account you declare that you are at least 18 years old. If you are under 18, do not create an account: if we become aware that an account belongs to a minor, we delete it.

Data subject rights

In the cases provided for, you may request access, rectification, erasure, restriction, portability and objection, and may withdraw consent without affecting the lawfulness of the earlier processing. You can write to support@novuralearning.com.

You may also lodge a complaint with the Garante per la protezione dei dati personali (the Italian data protection authority) or contact the competent supervisory authority.

Changes to this notice

We will update this page before activating new or materially different processing, for example personalized advertising, new providers or new forms of purchase. The date at the top identifies the current version; in the event of substantial changes the app will ask you to confirm the Terms and Privacy again.