Privacy Policy

Information You Provide to Us

When you create an account or use the platform, you may give us:

• Account details — your name, email address, phone number, and password (if you set one). You can sign in with an email and password, a phone number (verified by a one-time code we send you by SMS), or your Google account. Passwords are handled securely by Firebase Authentication and are never visible to us.
• Payment confirmation — the bank or mobile-money reference and any payment screenshot you upload when you request access to a paid course, AI credits, or other paid features.
• Content you create — the code, projects, and websites you build in the playground, along with any text, images, or files you add to them.
• Communications — messages you send us for support, along with comments, ratings, course replies, and challenge submissions you post.

Information We Collect Automatically

As you use the platform we collect:

• Usage and progress data — lessons viewed, video watch progress, exercises and quizzes completed, and features used.
• Device and technical data — device type, operating system, browser, app version, and approximate region.
• Diagnostics — crash reports and error logs used to keep the app stable.
• Notification tokens — a push-notification identifier so we can send you updates about your account and courses.
• We keep in-app analytics deliberately lightweight and sampled, and we never record your keystrokes or capture screen recordings. Our marketing websites do, however, use third-party advertising and analytics tools that involve cross-site tracking — see “Cookies, Analytics, and Advertising” below.

Guest Sessions

You can explore parts of Qwiklo as an anonymous guest before signing up. Guest activity is stored under a temporary anonymous account. If you later create a full account, we merge your guest progress into it. Guest data that is never linked to an account is periodically cleared.

How We Use Your Information

We use your information to:

• Provide, maintain, and improve the platform and your experience.
• Verify manual payments and grant access to paid courses, AI credits, and other entitlements.
• Personalize content, track your progress, and issue certificates of completion.
• Run features such as XP, leaderboards, challenges, and prizes.
• Send you account, course, and support notifications.
• Detect, prevent, and address fraud, abuse, and technical problems.

Service Providers We Share Data With

We run the platform on trusted infrastructure providers that process data on our behalf. We share only what each provider needs to deliver its part of the service:

• Google Firebase (Authentication, Cloud Firestore, Cloud Storage, Cloud Functions) — your account, app data, and uploaded files.
• Google Analytics (GA4) and BigQuery — usage analytics for the app and our websites.
• Google Ads, Meta (Facebook and Instagram), TikTok, and LinkedIn — advertising and ad-measurement partners. Our marketing websites include these partners’ pixels and tags, which collect device and cookie identifiers and page-visit events to measure how our ads perform and to show you relevant ads. Our Android app additionally includes the Meta SDK, which reports app installs, app opens, and in-app activity events together with your device’s advertising identifier to Meta, so we can measure which ads lead to app installs. See “Cookies, Analytics, and Advertising” below.
• Google Crashlytics — crash and error diagnostics.
• Firebase Cloud Messaging — push notifications.
• Resend — delivery of transactional and notification emails (for example account verification, password reset, and service updates), and delivery-status reports for those emails. Your email address and the content of the message are shared with Resend so it can send the email on our behalf.
• Cloudflare (R2 storage and CDN) — hosting and delivery of images, assets, the websites you publish, and files attached to messages you exchange with us.
• Cloudflare Email Routing — receiving email you send to our support and contact addresses so our team can read and reply to it.
• Google Gemini — AI-powered features, including the coding playground and the AI site-building assistant. In the playground, the prompts and code you submit are sent to Google to generate a response. When you use the AI site assistant to build or edit a site, the text in your site’s fields (headings, body text, item names and prices, and any name, phone number, or address you type into a field — including details about other people), your section labels, the filenames of images you upload (but not the image files themselves), the theme colors and fonts you choose, and structural details about the site are sent to Google each time the assistant works on your site; if you describe the site you want in your own words, that description is sent too. Orders, RSVPs, and visitor contact details submitted through a site you publish are never sent to Google.
• Unsplash — when you search for stock photos, your search terms are sent to Unsplash.
• Google (Sign in with Google) — when you choose to sign in with Google, Google confirms your identity and shares basic profile information such as your name and email address with us to create or access your account.
• GeezSMS (and a backup SMS provider) — delivery of one-time verification codes and account-related text messages. Your phone number and the message content are shared with the provider so it can send the SMS on our behalf.
• These providers may store data on servers outside Ethiopia (primarily on Google Cloud, Cloudflare, and Resend infrastructure).

Payments

Qwiklo uses manual payment confirmation. When you pay by bank transfer or mobile money, you submit a reference or screenshot, and we grant access after verifying it. We retain payment records — with personal details minimized — for accounting, tax, and dispute-resolution purposes, even after an account is deleted. We never store full card numbers or bank login credentials.

Public and Shared Content

Some of your activity is visible to others by design:

• Certificates you earn may be verifiable through a public link.
• Comments, ratings, and challenge entries you post may be shown to other users alongside your display name.
• Websites you publish are served publicly on the internet and can be viewed by anyone who has the link.

Orders and Enquiries From Published Sites

Some sites published with Qwiklo — a shop catalog or a restaurant menu, for example — let a visitor send the site owner an order or an enquiry. An order is a contact request, not a payment: no money changes hands on the platform and the visitor does not create an account. When a visitor places one, we collect and store on the site owner's behalf:

• The name and phone number the visitor enters, a delivery address if they choose delivery, the products or items and quantities they selected, and any note they add.
• These details are shown to the site owner inside the app, and to anyone the owner chooses to give access to. Where the owner switches on a staff dashboard for their site, that means anyone holding the dashboard passcode link can see the orders, including each buyer’s name, phone number and delivery address. The owner controls that passcode and can change it at any time.
• We delete these order records automatically: after 90 days for a shop catalog, and after 30 days for a restaurant menu. A site owner who needs an order for longer must copy the details out before then.
• Once we pass the details to the site owner, the owner decides how they are used and is responsible for handling them lawfully. If a visitor wants their order details removed sooner, the site owner can delete the record, or the visitor can contact us.
• If a site owner switches on order alerts, we send an SMS to the contact phone number they entered, naming the site and how many new orders are waiting. That message never contains a buyer’s name, phone number, or address, and it is delivered by the SMS provider listed above.

Contact and Payment Details on a Published Site

If you publish a shop or a menu with Qwiklo, you can add your own contact details (phone, WhatsApp, Telegram) and payment-account details — for example a bank or mobile-money account name and number — so buyers can reach you and pay you directly. These are part of the site you publish, so they are served publicly on the internet to anyone who opens the site or places an order. Publish only account details you are willing to make public: we do not process, hold, or verify any payment made to them. You can change or remove them at any time from the app. If you delete your account, we remove them from your shop’s live catalog data — but any contact details you typed into the site’s own pages (a contact section, or a Contact page) stay part of the published page, which remains online unless you unpublish the site first.

Personal Data in the Sites You Publish

The websites you build with Qwiklo may contain other people’s personal information — for example guest names on a wedding invitation, customer details on a business page, or photos of individuals. When you include such information, you are responsible for it: you must have the right and any necessary consent to publish it, and you act as the controller of that data. We host and serve this content on your behalf. If someone asks to have their information removed from a site you published, it is your responsibility to remove it (or ask us for help). A published site is public on the internet: anyone with the link can open it, and search engines and AI crawlers can reach it too. To limit that where it matters most, we ask search engines not to index sites in the personal categories — wedding and event invitations, memorials, birthdays, baby showers, graduation announcements and digital business cards — while sites in the business categories (restaurant menus, shops, business pages, property listings and portfolios) are left open to search, because being found is usually the point. These are requests, not technical barriers: a link that has been shared can always be opened by whoever holds it, and not every crawler honours the request. If you need a site to be private, unpublish it. If you use the AI site-building assistant to create or edit the site, the personal details you type about other people into the site’s fields are also sent to Google Gemini to generate your site, as described under “Service Providers We Share Data With” above.

Communications and Support Records

To provide support and keep an accurate record, we store the emails and SMS messages we exchange with you — including any files attached — together with which member of our team sent or handled each one. We keep these communication records for about two years. Verification codes we send by SMS are never stored in readable form, and the short-lived internal copy used to send them is deleted within a few days. If you work with us as an agent, a member of our sales team may also record brief notes about their contact with you — for example that a call took place, its outcome, and when to follow up — along with which of our staff you are assigned to, your training acknowledgment and onboarding progress, and what your account owes the platform. These notes are internal, visible only to that staff member and our administrators, and are kept for as long as your agent account is active. We also keep records of commission earned and paid, including bank transfer references, for accounting purposes. After an agent account is closed, we retain a pseudonymous identifier derived from its verified phone number and the original agent eligibility dates. This prevents a new account from restarting lifetime commission eligibility. This record contains no readable phone number, name, contact notes or account ID; it remains personal data and is retained for the duration of the commission program.

Cookies, Analytics, and Advertising

We use cookies and local storage to keep you signed in, remember your preferences, and understand how the platform is used. In addition, our marketing websites use analytics and advertising cookies and pixels:

• Analytics — Google Analytics (GA4) helps us understand, in aggregate, how visitors find and use our websites.
• Advertising cookies and pixels — we and our advertising partners (Google Ads, Meta, TikTok, and LinkedIn) set cookies and similar technologies on our marketing websites to measure the performance of our ads and to show you relevant ads on those partners’ platforms. These partners may link this data with other information they hold about you under their own privacy policies.
• Your choices — you can clear or block cookies in your browser settings (some features, such as staying signed in, may stop working). You can also opt out of personalized advertising directly with the networks: Google Ads Settings (adssettings.google.com, which also covers DoubleClick), Meta’s Ad Preferences, TikTok’s Ads settings, LinkedIn’s advertising preferences, and industry opt-out tools such as youradchoices.com.

Data Retention

We keep your personal information for as long as your account is active or as needed to provide the service. Orders submitted through a site you publish are deleted automatically — after 90 days for a shop catalog and after 30 days for a restaurant menu; other submissions, such as RSVPs and enquiries, are kept until you or the site owner delete them. When you delete your account, we remove or anonymize your personal data as described below, except for records we are legally or operationally required to retain (such as financial records). Account deletion does not erase another client’s published-site images. Images used by a paid website or a published website that we granted a zero-price entitlement are retained while the site is active or paused; payment means our administrators confirmed the self-service payment or approved an agent settlement. Images on an active agent site awaiting settlement stay available while that site remains live. Website images attached only to an inactive draft or an expired unpaid site, and uploads never attached to a project, become eligible for cleanup after three days, provided no paid or zero-price-entitled site, active site, other saved draft or retained version still uses them. Deleting a draft may make its exclusive images eligible sooner after upload safety checks. Scheduled checks, uncertain references or provider failures can delay physical deletion, so no exact deletion time is guaranteed. Unused Playground library images remain available while your account is active, subject to its separate image allowance. Profile images may still be embedded in older published sites; replacing an avatar or cover does not automatically delete its stored file. We retain the minimal upload, usage and reference records needed to enforce allowances, protect saved content and complete cleanup safely.

Your Rights and Choices

You can:

• Access and update your profile information from within the app.
• Delete your account from the app settings (available to learners and customers). This permanently removes your private data, anonymizes content you shared publicly, and unlinks or removes your published sites. Financial records are retained with personal details stripped. Staff and agent accounts are closed by contacting us so any outstanding work can be handed over first.
• Turn notifications off from your device settings.
• Contact us to ask about the personal data we hold about you.

Children

Qwiklo is intended for users aged 13 and older. If you are under the age of majority in your country, you should use Qwiklo only with the involvement of a parent or guardian. We do not knowingly collect personal information from children under 13; if you believe a child has provided us their information, contact us and we will remove it.

Security

We use industry-standard measures — including encrypted connections and access-controlled infrastructure — to protect your information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Changes to This Policy

We may update this Privacy Policy as the platform evolves. We will revise the “Last updated” date above and, for significant changes, provide a more prominent notice. Continued use after an update means you accept the revised policy.

Language

This policy is provided in English, Amharic, and Afaan Oromoo. If there is any conflict between the versions, the English version governs.

Contact Us

If you have questions about this Privacy Policy or your data, contact us by email at [email protected] or on Telegram at t.me/qwiklo.