Legal
Privacy policy
1. Scope
This privacy policy applies to:
- the quillo.ch website,
- the Quillo writing platform (web app and server): today the demo environment demo.quillo.ch, and in future a separate production environment for teaching, which is still being set up.
It is for everyone who visits the website or uses Quillo: teachers, students and anyone interested. It explains which personal data we process, why, who receives it and what rights you have. It describes what Quillo actually does, as implemented in its code.
Demo environment: demo.quillo.ch is meant for trying Quillo out. Several schools share it, and it can be reset completely at any time, which deletes all accounts and texts. Teaching with real students is planned on a separate production environment, which does not exist yet.
2. Who is responsible
Quillo is responsible for the website, for accounts outside a school's mandate (for example teachers trying Quillo out) and for running the platform securely. The Swiss Federal Act on Data Protection (FADP) applies.
When a school uses Quillo in class, the school is responsible for its students' and teachers' data. Quillo then processes this data on the school's behalf (as a processor) and only to provide the service to the school. The details are set out in a data processing agreement, which the school receives before Quillo is used with real students. Public schools are also subject to their canton's data protection law. Please therefore direct questions about data from lessons to your school first.
Operator of Quillo
- Graziano Laveder, sole proprietorship (brand «Tech Simplified»)
- c/o Impact Hub Zürich (Colab), Sihlquai 131, 8005 Zürich, Switzerland
- E-mail: hallo@quillo.ch
3. The quillo.ch website
The website uses no analytics or advertising tools and loads no content from third parties. It serves its own fonts, images and videos.
- Visiting the website: your browser sends technical data such as your IP address, the time and your browser type to Vercel, which runs the website from Frankfurt (EU) and keeps these logs for its standard periods. The quillo.ch domain is registered with Hostpoint in Switzerland.
- Language: the website opens in German. The language switch takes you to English. The chosen language is part of the address (/de or /en). The website sets no cookie for this.
- Waiting list: if you sign up, you send us your role (teacher or student), your name and e-mail address, and optionally your school and country. The website does not store this in a database. It is sent to us as a message via the e-mail service Resend, and you receive a confirmation e-mail. We use the information only to tell you about Quillo, and keep it until we have told you about the launch, for at most 12 months. You can ask to be removed at any time (section 13).
4. Data the Quillo app processes
Quillo processes the data needed for writing in class. You enter most of it yourself. Some is created as you use the app. Quillo does not ask for a date of birth or age.
| Category | Data | Source |
|---|---|---|
| Account | E-mail address, first and last name, role (student or teacher), language, chosen design. The password only as a hash (BCrypt), never in plain text | Registration |
| School and class | Membership of school and class, role in the school, an automatically generated pseudonym, date joined | Joining with a class or invitation code. Without a code, students work in a personal space |
| Texts | Title, content, word count, language, status (draft, handed in), visibility | Writing in the editor |
| Writing process | The current text (saved continuously). Full versions of the text about every 2 minutes, at the end of each session and at every hand-in. Start, end and length of sessions. Pastes of 40 or more and deletions of 50 or more characters (only their approximate length, not their content). Time of AI requests and hand-ins | Automatically while writing |
| Teacher feedback | Comments on the text and on passages, decision (returned, accepted, rejected) | Teacher |
| AI feedback | Structured feedback with short quotes from the text. Questions to the AI coach and its answers. Error statistics by category (e.g. commas) with counts, without quotes | AI service (section 6) |
| Exercises | Answers, right/wrong, time taken, daily streak. Personal exercises created from the error statistics. Reports of faulty exercises with a comment | Use |
| Images | AI-generated comics and mood images for stories, with the character descriptions created for them | AI service |
| «My figure» | Chosen features of a drawn figure: hairstyle or head covering, hair, skin and eye colour, clothing, glasses and an age for the figure. No photo, no image upload | Students, voluntary |
| Login and security | Login attempts (e-mail, success, reason, IP address, browser type, time). Active sessions (IP address, browser type, expiry date) | Automatic |
| Teachers' content | Tasks and exercises they create, deadlines, uploaded videos, tasks sent to colleagues including the recipient's e-mail and a note | Teacher |
Quillo does not process photos of people, location data or payment data. Two notes:
- Students may write about health, religion or family in their texts. Such content is stored like any other text and used for AI feedback.
- «My figure» lets students choose a skin colour and head coverings such as a headscarf or turban, which could allow conclusions about origin or religion. The figure is voluntary and is used only for comics.
5. Purposes and legal basis
- Website: serving the pages and answering waiting-list sign-ups.
- Writing and handing in: saving texts, showing tasks and deadlines, handing texts to the teacher for feedback or as a final version.
- Feedback: showing teachers' comments. AI feedback and coach conversations when students request them.
- Practice: exercises and personal exercises created from the error statistics.
- Showing the writing process: for handed-in texts, teachers see how a text came about.
- Overview for teachers: who has started a task, how far they are, where someone is stuck.
- Account and security: login, password reset, a 15-minute lock after 10 failed attempts, detecting misuse.
- Limiting AI costs: daily image limits (by default 15 per person, 400 in total) and a central switch that stops new AI jobs from students.
We do not use the data for advertising, sell it to third parties or use it to train our own AI models. Quillo does not grade and makes no automated decisions about people. Decisions about handed-in work are always made by the teacher.
Legal basis: in class, processing is based on the school's mandate under the law that applies to it. For the website and for accounts outside a school's mandate, we process data to provide the service you use, within the FADP.
6. AI features: what is sent and what isn't
Quillo sends the AI services the text concerned, but no name, e-mail address, school, class or account identifier. Requests go from the Quillo server to the AI service. Your IP address does not reach it. AI features run only when a person triggers them.
| Feature | Triggered by | Service | Sent |
|---|---|---|---|
| Text feedback | Student | Anthropic (Claude) | Title, text, word count, language, round number, whether it is a draft or a finished text, the last two AI feedback rounds on the same text. For tasks their title, description and target word count |
| Coach conversation | Student | Anthropic (Claude) | Text, key message of the feedback being discussed, conversation so far |
| Comic, planning | Student. Allowed by default for cliffhanger tasks, teachers can switch comics off per class | Anthropic (Claude) | Story text. With the student's own figure also its features and the age chosen for it |
| Comic, image | as above | Google (Gemini) | Story text, character descriptions from the planning. With the student's own figure an image of the figure drawn by the server and its age |
| Mood image per stage | Student | Google (Gemini) | Story text and the task's opening image |
| Opening image for a task | Teacher | Google (Gemini) | Task description (no student data) |
| Second opinion on feedback | Teacher | Anthropic (Claude) | Title and version of the handed-in text, the teacher's draft comments |
What students write themselves is sent along. If a story contains a real name, it is sent with the text. We recommend using invented names in texts.
Limits of the AI: the AI does not grade and does not write texts for students. The coach is instructed not to provide finished sentences. AI feedback can be wrong. Whatever a teacher sends to students is written and owned by the teacher.
Use by the AI providers: Anthropic does not use content sent via its API for training and deletes inputs and outputs within 30 days. Only where it suspects a breach of its usage policy does it keep them for up to 2 years (retention, commercial terms). For use from Switzerland, Google does not use Gemini API inputs and outputs to improve its products and keeps them for 55 days to detect misuse (terms, abuse monitoring).
7. Who receives data
Within Quillo
- The class's own teacher sees students' names, class membership, progress on tasks and their figure. They see the text and the writing process only once a student hands the text in for feedback or as a final version, and from then on also the current text and later versions. They never see the content of AI feedback or coach conversations. Teachers never see texts without a class (personal space). Other teachers and admins of the same school don't see this data. The admin role only manages members, the invite code and the school library.
- The public: only if students share a text via «Share». Anyone with the link sees the title and text, images, comic, the task and the student's pseudonym, not the name, school, class or any feedback. Sharing can be withdrawn. Image addresses already known remain accessible afterwards.
- Operator: has technical access to server and database for operations, troubleshooting and support. Reports of faulty exercises from texts without a class (first name, comment, answer) go to the Quillo team.
Processors
| Provider | Task | Data | Location |
|---|---|---|---|
| Railway | Server and database of the Quillo app | All data in section 4 | Netherlands (EU West, Amsterdam). Provider based in the USA |
| Vercel | Delivering the website and the Quillo app. The website's waiting list | Connection data (e.g. IP address), waiting-list details | Frankfurt (EU). Provider based in the USA |
| Cloudflare (R2) | Storing images, comics and videos | Generated images, teachers' videos | Western Europe (location targeted by Cloudflare, not guaranteed). Provider based in the USA |
| Anthropic | AI text feedback, coach, comic planning, second opinion | See section 6 | USA |
| Google (Gemini API) | AI images | See section 6 | USA |
| Google (Fonts) | Fonts for the Quillo app | The app loads fonts directly from Google, which sees the IP address | USA |
| Resend | E-mails: password-reset links (app), waiting list (website) | E-mail address, first name or the waiting-list form details | USA |
| Hostpoint | quillo.ch domain and DNS | No personal data from the website or app | Switzerland |
Quillo does not pass data to advertising networks or data brokers and uses no analytics or tracking tools on the website or in the app.
8. Transfers abroad
The Quillo app's server and database are in the EU (Netherlands). Most providers are based in the USA, and some services (AI, e-mail, delivery) also process data there.
Under the FADP, disclosure abroad is permitted if the recipient country provides adequate data protection (as the EU does) or appropriate safeguards are in place. For the USA these are certification under the Swiss-U.S. Data Privacy Framework (DPF) or standard contractual clauses.
| Provider | Basis for the transfer | Source |
|---|---|---|
| Railway | Swiss-U.S. DPF, active | DPF list |
| Vercel | Swiss-U.S. DPF, active | DPF list |
| Cloudflare | Swiss-U.S. DPF, active (annual renewal under review) | DPF list |
| Swiss-U.S. DPF, active | DPF list | |
| Anthropic | Standard contractual clauses with Swiss adjustments, part of its terms | Data Processing Addendum |
| Resend | Standard contractual clauses with Swiss adjustments (DPF for the EU and UK only) | Data Processing Addendum |
Information as of 20 October 2026.
For public schools, cantonal law may set additional requirements for cloud services abroad. The school clarifies these before using Quillo.
9. Retention and deletion
We delete accounts and texts no later than 12 months after the last login, and login and session data after 90 days. Quillo applies the 90-day period automatically. Accounts are currently still deleted by hand.
| Data | What applies |
|---|---|
| Account and texts | No later than 12 months after the last login, earlier at the request of the school or the person (within 30 days). The app has no deletion function yet. We delete by hand |
| Drafts | Students can delete a draft themselves as long as it has never been handed in. Versions, writing process and AI feedback are deleted with it |
| Handed-in texts | Kept as part of the teaching record until the account is deleted. Students cannot delete them themselves |
| Classes | Archived, not deleted |
| Images and comics | Not yet removed from image storage when a text is deleted |
| Login records, ended sessions | Deleted automatically after 90 days, used password-reset links the next day |
| App server logs | Kept by Railway for its standard periods. They currently also contain AI responses with short quotes from texts. We will change this before Quillo is used with real students |
| Backups | According to Railway's default settings |
| Waiting list (website) | Until we have told you about the launch, for at most 12 months. Immediately on request |
A login expires in the browser after 15 minutes (it is renewed automatically), a session 30 days after its last use, and a password-reset link after 15 minutes.
The demo environment can be reset completely at any time, which deletes all accounts and texts.
10. Security, cookies and browser storage
We protect data with technical and organisational measures. The most important:
- Passwords, session keys and password-reset links are stored only as hashes.
- After 10 wrong passwords the account is locked for 15 minutes.
- Students see only their own texts, and teachers see only data from the classes they run. Automated tests check these boundaries with every code change.
- New AI jobs from students can be stopped centrally. Daily limits cap the number of generated images.
- The connection between your browser and Quillo is encrypted (HTTPS).
Cookies: the Quillo app sets a single cookie, refresh_token, which keeps you logged in for up to 30 days. Scripts cannot read it, it is sent only over encrypted connections and it is deleted when you log out. The website sets no cookies. There are no advertising or analytics cookies.
Browser storage: the app remembers a few settings in your browser (localStorage): design, sidebar, the most recently chosen school and class as internal identifiers, when feedback was last opened and which tips have been seen. No texts or passwords are stored there. On shared devices you can delete these entries in your browser settings.
App fonts: the Quillo app loads its fonts from Google Fonts, which tells Google the IP address. The quillo.ch website does not.
11. Children and young people
Quillo asks for neither age nor date of birth and does not obtain parental consent. Swiss law sets no fixed age for consenting to the processing of personal data. What counts is the person's capacity of judgement. In class, use is based on the school's mandate, and the school decides how it informs parents.
12. Your rights
You have the right to information about your data, to correction, to deletion, to object, and to receive your data in a common format. For data from lessons, please contact your school first. We support the school in answering. In all other cases, contact us directly (section 13). We reply within 30 days.
In the app you can already: view your own texts, your own writing history and AI feedback, delete drafts that have never been handed in, withdraw a public share, remove your figure and change language and design. Name and e-mail address cannot be changed in the app, and there is not yet an export or account deletion in the app. Please send us such requests by e-mail.
Complaints: for processing that Quillo is responsible for, the Federal Data Protection and Information Commissioner (FDPIC) is competent. For data from lessons at public schools, it is the data protection authority of the canton concerned.
13. Contact and changes
Please send questions about data protection, requests for information and requests to be removed from the waiting list to hallo@quillo.ch.
We update this policy when Quillo or the legal requirements change. The version published on quillo.ch applies.
Last updated: 20 October 2026
The German version of this policy prevails in case of differences.