1. Who We Are

Cazuz is an independent service, built and run by its founder as an individual rather than a company. We run cazuz.net, a platform for teachers and their students, with a free plan and paid plans. References to “we”, “our”, and “Cazuz” refer to the operator.

Contact: feedback form on cazuz.net, or support@cazuz.net.

2. What Data We Collect

A. Teacher accounts

When a teacher registers, we collect:

Full name (real first + last name — required)
Display name (nickname shown in the dashboard — required)
Email address (required, used for login + service communications)
School name (optional)
Phone number (optional)
Hashed password — managed by Supabase Auth; we never see your plaintext password
Account creation and last-active timestamps

B. Students

Students do not create accounts. When a student joins a game, an assignment or a lesson we record:

The teacher-shown nickname (e.g. “Ali 12”)
Their answers and time taken on each question
The attempt’s start and end timestamps
For lessons, the answers given across every sitting of that lesson, so a lesson that continues tomorrow keeps yesterday’s progress
A random anonymous client ID stored in the browser’s localStorage so a refresh mid-game resumes the same attempt

We do not collect students’ real names, emails, dates of birth, exact locations, or any other personal information.

C. Content uploaded by teachers

Quiz questions, options, images, and hints
Activity titles, instructions, and settings
Lesson files you upload (PDF), the slide images rendered from them, and read-aloud audio generated for your questions

D. Game data

Per-game results: scores, who answered correctly, response times, lifelines used
Game timestamps and the share-code of the assignment played

E. Usage analytics

The pages you visit on cazuz.net
An anonymous random ID stored in your browser’s localStorage (not linked to your identity)
Your country and city, derived from your IP address at the moment of the request. We never store the IP address itself.
Your browser’s user-agent string and the referring URL
Your authenticated user ID, if you are logged in
How you found Cazuz: the website that sent you (for example a search engine) or the name of the link or ad you followed. It stays in your browser, and is saved with your account only if you sign up, together with your answer to “How did you hear about Cazuz?” if you chose to give one.

F. Communications

Messages you submit through the feedback form
Email correspondence with the operator

G. Billing (paid plans)

If you buy a paid plan, your name, email, country and payment details are collected by our reseller Paddle at checkout — Cazuz never sees your card number.
We store only which plan you have, its status and renewal date, and Paddle’s customer and subscription identifiers.

3. How We Use Your Data

We use the data above to:

Provide the Service (let you log in, save your activities, run games)
Show classroom reports and leaderboards
Improve the Service (which features are used, which routes are popular)
Send service emails (password reset, important updates)
Respond to feedback messages
Comply with applicable law

We do not sell your data. We do not run ads. We do not use Cazuz data to train AI models on your behalf.

4. Legal Bases for Processing

We process data on the following bases (aligned with applicable data-protection law):

Performance of a contract — providing the Service you registered for
Legitimate interest — operating, maintaining, and improving Cazuz securely
Consent — for optional features (analytics, feedback) you use voluntarily
Legal obligation — if required by applicable law

5. Third-Party Services We Use

To run smoothly, Cazuz uses a few trusted service providers. Each one only ever receives the small piece of data it needs to do its job — and no student personal information is ever sold or shared for advertising.

Supabase (hosted on AWS) — database, authentication, and Storage. Stores teacher accounts, activities, assignments, attempts, and the files you upload: images, lesson decks, and read-aloud audio.
Vercel — hosting, content delivery, and the serverless API. Logs request metadata (browser, country, city) for security and analytics. The IP address itself is never stored.
Railway — runs the real-time server (Colyseus) for Live Quiz, Tug of War, and Lessons.
Google Gemini API — drafts quiz questions when a teacher uses the AI question builder. It receives the topic you type, and, if you import a worksheet, the text extracted from the file you uploaded. Google processes it according to their privacy terms.
Google Fonts — the site’s fonts are loaded from Google’s servers, which receive the visitor’s IP address when a page loads.
Microsoft — read-aloud audio is produced by an open-source library that calls the same public speech endpoint the Edge browser’s Read Aloud uses, so Microsoft’s servers receive the words to be spoken. They receive nothing else: no student data, no account, no identifier.
Resend — sends account emails such as sign-up confirmation and password reset. Receives the teacher’s name and email address. Its servers are in Ireland.
Umami (umami.is) — visitor statistics for the teacher-facing pages: which pages are opened, the website that sent the visitor, the device type and country. It sets no cookies, is never loaded on the pages students use, and its data is kept in the European Union.
Cloudflare — DNS for cazuz.net, and forwarding of the support@cazuz.net mailbox.
A private notification bot (Telegram Bot API) — sends the project owner a simple “a teacher signed up” or “a new activity was created” heads-up, so we know the tool is being used. It never includes any student data.
Paddle (Paddle.com Market Ltd, United Kingdom) — our merchant of record for paid plans. Handles checkout, payment, tax and receipts. Receives your name, email, country and payment details; Cazuz never sees your card number. The pricing page also asks Paddle for your local price, so Paddle sees your approximate location before you buy anything.

Each provider has its own privacy policy that you may review.

6. Children’s Privacy

Cazuz is designed for use by teachers in classrooms. Children may use the Service only as students, through a class link or QR code shared by their teacher. We do not knowingly collect personal information from children. We do not show advertising. We do not use student data for any purpose other than running the game and showing the teacher a class report.

If you are a parent or guardian and believe your child’s personal data has been collected by Cazuz, please contact us through the feedback form or at support@cazuz.net so we can review and delete it.

7. Cookies & Local Storage

Cazuz does not use third-party advertising or tracking cookies. We use only:

A random anonymous ID so a refresh mid-game resumes the same attempt
The nickname and progress of an assignment in progress
A cached copy of your plan so the dashboard loads fast
The currency you chose to see prices in, so the pricing page opens that way next time
Small preferences such as muted sounds and notices you have dismissed
How you first reached Cazuz (the referring website or link), kept until you sign up

None of these is shared with third parties.

To open the pricing page in a sensible currency before you have chosen one, we read the time zone your device is already set to. That is a setting your browser makes available to every website; it is read in your browser, nothing is sent to us, and we do not store or infer your location from it. Choosing a different currency yourself always overrides it.

If you buy a paid plan, the Paddle checkout sets its own cookies for that payment session, under Paddle’s privacy policy.

8. Data Retention

Teacher accounts — kept while your account is active. Deleted within 30 days of an account-deletion request.
Quiz content — kept while the owning account is active.
Game-result records — kept indefinitely for historical reporting, unless you ask us to delete them.
Page-view analytics — anonymised, kept for up to 24 months.
Feedback messages — kept for up to 12 months after resolution.
Billing records — held by Paddle for as long as your plan is active and afterwards for as long as tax law requires.

9. Your Rights

You may at any time:

Access the data we hold about you
Correct any inaccurate data
Delete your account and all linked teacher data
Object to specific processing
Receive a copy of your data in a portable format

You can see what we hold and delete your account yourself under Account → Data. Deletion has a 30-day window during which you can undo it.

To exercise any of these rights, or if you would rather we did it for you, use the feedback form on cazuz.net or email support@cazuz.net. We will respond within 30 days.

10. Security

We follow industry-standard security practices including:

All connections to cazuz.net protected by HTTPS (TLS)
Passwords hashed with bcrypt by Supabase Auth — we never see the plaintext
Row-Level Security policies on Supabase that restrict each teacher to their own data
No raw IP addresses stored — only the country / city derived at request time

No system is ever perfect, but we take real care to protect your information. In the unlikely event anything ever affected personal data, we’d let the affected teachers know quickly (within 72 hours), in line with good data-protection practice.

11. International Data Transfers

Some of our service providers keep their servers in the United States or Europe, so your data may be stored there — always with protections equivalent to those required by applicable data-protection law. By using Cazuz, you’re okay with this. Payments are processed by Paddle in the United Kingdom under its own safeguards.

12. Changes to This Policy

We may update this Privacy Policy occasionally. The “Last updated” date at the top reflects any change. If a change is material we will email all teachers with active accounts.

13. Contact

For privacy questions or to exercise your rights, use the feedback form on cazuz.net or email support@cazuz.net.