Privacy Policy
Last updated: August 7, 2026
1. Data Controller
The data controller under the General Data Protection Regulation (GDPR) for data processed in connection with the "PilotQuiz" app and this website is:
[Name / Company]
[Street address]
[Postal code, city]
[Country]
Email: privacy@smahoma.com
Full details also in the Legal Notice.
2. Overview of processing activities
The table below summarizes what data PilotQuiz processes, for what purpose, and under which legal basis.
| Purpose | Data | Legal basis |
|---|---|---|
| Registration & login | Email address, chosen username, password (stored only as a hash) | Art. 6(1)(b) GDPR (contract performance) |
| App usage (quizzes, progress) | Quiz history, answered questions, accuracy, favorites | Art. 6(1)(b) GDPR |
| Submitting / editing a question | Question text, selected category, optionally your username (unless submitted anonymously) | Art. 6(1)(b) GDPR |
| Scanning a question (Premium) | Photo of the scanned question, on-device recognized text | Art. 6(1)(b) GDPR; for the photo also Art. 6(1)(a) (consent via actively using the camera feature) |
| Premium subscription (in-app) | Purchase confirmation from Apple/Google (no payment card data — that stays entirely with Apple/Google) | Art. 6(1)(b) GDPR |
| Premium subscription (bought on this website) | Email, purchase/subscription status from Stripe (no payment card data — that stays entirely with Stripe) | Art. 6(1)(b) GDPR |
| Account management (email/password change) | Current & new email address, verification code | Art. 6(1)(b) GDPR |
| Troubleshooting & abuse prevention | Access tokens, login timestamps, technical log data | Art. 6(1)(f) GDPR (legitimate interest in secure operation) |
3. Camera access and text recognition
The optional scan feature (Premium) requires access to your device's camera. Text recognition (OCR) runs entirely on-device — the image itself is not sent to our servers for recognition. Only once you actively submit a new question based on that recognition are the recognized text and, optionally, the source photo transmitted to and stored on our servers, so a moderation team can review the submission. Without an active submission, neither the image nor the text ever leaves your device.
4. Recipients and processors
Data is only shared with third parties in the following cases:
- Apple Inc. / Google LLC — to process and verify in-app purchases (PilotQuiz Premium) via StoreKit or Google Play Billing. We never receive payment details, only a purchase confirmation.
- Stripe, Inc. — to process and verify Premium subscriptions purchased directly on this website. We never receive or store your payment card details; those are handled entirely by Stripe's hosted checkout.
- Hosting provider — our servers run with a hosting provider based in Germany. A data processing agreement under Art. 28 GDPR is in place.
- Email delivery — for registration confirmations, verification codes and security notices (e.g. on an email change) we use [email delivery provider].
Aside from the cases above involving Apple, Google and Stripe (US-based providers, each under their own EU-standard-contractual-clauses / adequacy framework), no data is transferred outside the EU/EEA.
5. Retention period
Account data is retained for as long as your account exists. Deleting your account deactivates it (soft delete) and you can no longer sign in; questions you submitted and that were already approved remain part of the shared knowledge base, since they continue to be useful to other users — on request, we remove your username from them. Access tokens expire automatically after a short time, or are invalidated immediately on logout, a password change, or an email change.
6. Your rights
Under the GDPR, you have the right to:
- Access the data we hold about you (Art. 15 GDPR)
- Rectify inaccurate data (Art. 16 GDPR)
- Erase your data (Art. 17 GDPR) — also available directly in the app under Profile → Delete account
- Restrict processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Object to processing based on legitimate interest (Art. 21 GDPR)
- Lodge a complaint with a data protection supervisory authority
To exercise any of these rights, simply email privacy@smahoma.com.
7. No automatic translation
Question text is never machine-translated automatically — content stays in the language it was submitted in.
8. Changes to this policy
We update this Privacy Policy whenever the app's data processing changes. The current version is always available at this address.