frontfolks_ / MediQuiz

Privacy Policy

Last updated: 16 September 2026 · version 2.1

01/ General information

This Privacy Policy explains which data we process when you use the MediQuiz mobile application available on the App Store (iOS) and Google Play (Android), why we do so, and what rights you have.

The data controller is Frontfolks Agnieszka Pajkert, ul. Jana Długosza 21/53, 41-219 Sosnowiec, Poland, tax ID (NIP) 6442010524 ("we" or "Frontfolks"). Privacy contact: support@frontfolks.com.

We process personal data in accordance with Regulation (EU) 2016/679 (GDPR) and applicable Polish data protection law.

02/ What data we process

The data we process depends on which features you use. Many features work entirely on your device without sending anything to our servers.

User account (only if you sign in)

• e-mail address and password (the password is stored in encrypted form exclusively by Firebase Authentication; we have no access to it),
• username,
• a user identifier assigned by Firebase.

Learning data

• quiz answers, scores, points, per-question statistics, your "streak" (consecutive active days), completed daily quests,
• which categories and modes you have unlocked.

Without signing in, this data is stored only on your device. Once you sign in, we sync it to your account in Cloud Firestore so it is available on your other devices.

In-app purchases

• the identifier of the purchased product (category, mode, "Remove Ads", Premium) and the transaction status confirmed by the App Store or Google Play.

We do not receive or store card numbers, bank account details or any other payment data. Payments are processed entirely by Apple or Google.

Usage statistics and crash reports — only with your consent

If you agree on the "Help improve MediQuiz" screen, the app sends anonymous usage events to Google Analytics for Firebase, in particular:

• quiz start and completion, mode and category, number of correct and incorrect answers,
• screens viewed, purchase screens shown, completed purchases (without amounts or payment data), purchase restores,
• ads shown and ad loading errors,
• sign-up, sign-in, sign-out, account deletion, onboarding completion,
• daily quest completion, streak changes, notification permission decisions,
• technical data: device model, OS version, app version, language, approximate country-level location (derived from the IP address) and a random app-instance identifier.

Under the same consent the app also sends crash reports to Firebase Crashlytics: the state of the app at the moment of a crash (stack trace, app version, device model and OS version, free memory and storage, whether the app was in the foreground), the build type and the same random app-instance identifier. Crash reports contain no e-mail address, username, answers or other content you enter.

Usage statistics and crash reports are never linked to your account, contain no e-mail address or username, and are not used to track you across other apps or websites. On iOS we do not request tracking permission (App Tracking Transparency) and do not read the IDFA advertising identifier.

Advertising

• Google AdMob may process the device's advertising identifier (on Android: the Android Advertising ID), IP address, technical device data and information about the ads shown,
• in the European Union and other regions where required, your choices about personalised ads recorded in the consent form (Google User Messaging Platform).

Notifications

• study reminders are scheduled locally on your device based on your settings (time, enabled categories); they never leave the device,
• if you enable news or marketing notifications, the app registers a device token with Firebase Cloud Messaging and subscribes it to the corresponding topic.

Feedback and issue reports

• the message and rating you submit in the feedback form, and the description of a reported question issue together with that question's identifier,
• your user identifier, if you are signed in when sending feedback.

Technical data required for operation

• an app-instance identifier used by Firebase Remote Config to fetch configuration (for example whether ads are enabled),
• app settings (sounds, vibrations, your usage-statistics decision, terms acceptance) stored locally on your device.

03/ Purposes and legal bases

Providing data is voluntary. Without an account you can use the app in full on a single device; without consent to usage statistics and crash reports, or to personalised ads, the app works exactly the same.

04/ Usage statistics, crash reports and your consent

Collection of usage statistics and crash reports is off by default. We enable it only after you choose "Allow" on the consent screen, which we show once after you accept the terms of service.

You can withdraw consent at any time: Settings → Privacy → Share usage statistics. When you withdraw consent, the app immediately stops sending events and crash reports and deletes the analytics data stored on the device. Withdrawal does not affect the lawfulness of processing carried out before it.

Statistics are processed on our behalf by Google Ireland Limited / Google LLC as part of Google Analytics for Firebase. Event data is retained for the retention period configured in Google Analytics (at most 14 months) and then aggregated into reports that do not identify individual users. Crash reports are processed by the same provider as part of Firebase Crashlytics and retained for 90 days. Learn more: firebase.google.com/support/privacy.

05/ Advertising

The free version of the app shows full-screen ads served by Google AdMob (Google LLC). Ads stop after you buy "Remove Ads" or the Premium bundle.

• In the European Union, the United Kingdom and Switzerland we show Google's consent form (User Messaging Platform) on first launch. You can consent to personalised ads, decline, or manage options — in which case we show non-personalised ads.
• On Android, AdMob may use the Android Advertising ID; you can reset it or opt out of personalisation in the system settings.
• On iOS we do not request tracking permission and do not share the IDFA, so ads are not personalised based on your activity in other apps.

How Google uses data from apps that use its services is described here: policies.google.com/technologies/partner-sites.

06/ In-app purchases

All transactions are handled by Apple (App Store, StoreKit) or Google (Google Play Billing) under their own privacy policies. We only receive a transaction confirmation with the product identifier, which is used to unlock content and restore purchases. If you are signed in, the unlocked content is recorded on your account so purchases also work on your other devices.

07/ Notifications

The app can send two kinds of notifications, both only after you grant the system permission:

• Study reminders — scheduled and displayed locally on your device. They do not require sending any data to a server.
• News and marketing — sent through Firebase Cloud Messaging using a device token. We do not link the token to your account or learning data.

You can turn each kind off separately under Settings → Notifications in the app, or entirely in the system settings. Turning off news or marketing removes the token subscription from our lists.

08/ Recipients and transfers outside the EEA

We do not sell your data and do not share it with anyone other than the service providers listed below, which process data on our behalf or as independent controllers for their own services:

• Google LLC / Google Ireland Limited — Firebase Authentication, Cloud Firestore, Google Analytics for Firebase, Firebase Crashlytics, Firebase Cloud Messaging, Firebase Remote Config, Google AdMob and User Messaging Platform, Google Play. Privacy policy: policies.google.com/privacy.
• Apple Inc. / Apple Distribution International Ltd. — App Store, payment processing and push notifications (APNs). Privacy policy: apple.com/legal/privacy.

Google and Apple servers may be located outside the European Economic Area, including in the United States. Transfers rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework, to which Google LLC and Apple Inc. are certified, and otherwise on Standard Contractual Clauses approved by the European Commission.

Data may be disclosed to public authorities only where required by law.

09/ How long we keep data

• Account data, learning data and purchases on the account — until you delete the account. After deletion the data is permanently erased from Firebase servers.
• Local data on your device — until you delete it in the app ("Delete score") or uninstall the app.
• Usage statistics — for the Google Analytics retention period (at most 14 months), and on the device until you withdraw consent.
• Crash reports — 90 days from the moment Firebase Crashlytics receives them.
• Notification token — until you turn notifications off in the app or uninstall it.
• Feedback and issue reports — until handled, and no longer than 24 months after submission.
• Data needed to defend legal claims — for the limitation period set by law.

10/ Security

All communication between the app and our servers is encrypted (HTTPS/TLS). Account data is protected by Firebase security rules that grant access only to the signed-in owner of the account. On the Frontfolks side, only authorised persons have access to data, to the extent needed to operate the app. We never know your password — Firebase Authentication stores it in encrypted form.

11/ Your rights

Under the GDPR you have the right to:

• access your data and obtain a copy of it,
• rectify your data (you can change your username in the app's Settings),
• erasure ("right to be forgotten"),
• restriction of processing,
• data portability,
• object to processing based on legitimate interest,
• withdraw consent at any time, without affecting the lawfulness of earlier processing,
• lodge a complaint with a supervisory authority — in Poland the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl), or the authority in your country of residence.

You can exercise most of these rights yourself in the app: Settings → Delete account permanently deletes the account and all associated data from our servers; Settings → Delete score erases learning data; Settings → Privacy withdraws consent to usage statistics and crash reports; Settings → Notifications turns notifications off.

For anything else, write to support@frontfolks.com. We reply without undue delay and within one month at the latest. You can change your personalised-ads consent in the app settings (where available in your region), by resetting the advertising identifier in your system settings, or by contacting us.

12/ Children

MediQuiz is aimed at students and anyone interested in medical knowledge. The app is not intended for children under 13 and we do not knowingly collect their data. If we learn that we process data of a child under that age without the required consent, we will delete it.

13/ Changes to this Privacy Policy

This policy may be updated to reflect changes in the app or in the law. We will inform you of significant changes in the app or by notification. The current version is always available at this address, with the date of the last update shown at the top.

14/ Contact

Frontfolks Agnieszka Pajkert
ul. Jana Długosza 21/53, 41-219 Sosnowiec, Poland
NIP 6442010524
support@frontfolks.com

This document is also available in Polish. In case of any discrepancy between language versions, the Polish version prevails.
© 2026 Frontfolks. All rights reserved.