Auditable by design
The platform generates and meters. Your WordPress plugin stores and renders. This is the complete map of what the hosted platform keeps and what it deliberately does not keep.
QuizOut has no Article, Quiz, Question, Option, Play, Answer, Reader Lead, Result, or analytics records. Article input and generated quiz output are not product data on the platform.
| Category | Purpose and fields | Protection | Retention, export, and erasure |
|---|---|---|---|
| Accounts and login | Account identifiers, memberships and roles, login email, password hash, and short-lived authentication tokens. | Email is encrypted at rest. Passwords and authentication tokens are one-way digests. | Included in account export. Removed by account erasure unless a user still belongs to another account. |
| Sites and API keys | WordPress site URLs and metadata, status, public identifiers, masked key history, and claim records. | API and claim tokens are stored only as SHA-256 digests; claim email is encrypted. Plaintext API keys are shown once. | Included with secrets omitted from export. Removed with the account. |
| Billing | Plan and subscription state, prepaid packs, Stripe object identifiers, and minimal webhook receipts. QuizOut never receives card numbers. | Customer, subscription, schedule, checkout, payment-intent, and event identifiers are encrypted at rest. Shared catalog Price IDs are not customer data. Webhook payloads are never stored. | Included in export. QuizOut asks Stripe to delete the customer before local erasure; Stripe may retain financial records required by law. |
| Usage ledger | Site, WordPress post external ID, SHA-256 lookup digest, timestamps, billing period, funding source, and successful-regeneration count. | No title, article body, quiz, response, or reader information is present. | Included in export and removed with the account. |
| Audit log | Key, billing, export, and erasure actions with public subject IDs, request IDs, and strictly allowlisted non-sensitive details. | Immutable application records never contain emails, IP addresses, secrets, digests, Stripe IDs, or content. | Included in export and removed with the account. |
| Partner-access inquiries | Name, business email, organization, website, and optional message submitted to QuizOut itself. These are business inquiries, not reader leads collected by a quiz. | All identity and message fields are encrypted at rest. | Matching inquiries are included in the requester’s export and removed when erasure deletes their otherwise-unshared user. |
| Operational cache | Rate counters, pseudonymous abuse fingerprints, leases, circuit state, and idempotency data. Idempotency stores a request digest and may store the successful generated response for replay. | Solid Cache values are encrypted at rest. | Maximum age is 24 hours. It is not a system of record and is not exported. |
| Job queue | Job class, schedule, numeric or GlobalID record references, and essential mail-delivery arguments. Generation requests are never queued. | Job arguments are excluded from application logs. Export bodies are sent directly in the export job and never queued or written as files. | Completed jobs are cleared after one day; failed jobs remain only for operational remediation. Queue rows are not exported. |
The article is validated and held in process memory only while QuizOut sends it to OpenAI and returns the generated quiz synchronously. Provider storage is disabled with store: false, and HTTP request and response bodies are excluded from logs.
The only temporary exception is an encrypted successful response cached for idempotent replay for at most 24 hours. The corresponding request is represented only by a SHA-256 digest.
Optional generation sampling from backlog item 20 has not been implemented. There is no GenerationSample model, table, or hidden opt-in: article and quiz sampling is OFF for every account.
OpenAI transiently processes generation input. Stripe processes billing and keeps its own legally required records. The configured SMTP provider receives only the messages and recipients needed to deliver account, authentication, claim, and export email.