How we handle your data

On supported W. W. Norton pages, the extension reads the Norton account identifier and InQuizitive email shown to the page so it can connect the correct UnInquizitive account. It also reads page controls, questions, course access state, course and assignment details, and results needed to run the features you request.

Assignment question text and answer choices are processed in the browser to operate the runner; they are not uploaded as assignment answers or stored in our run analytics. We do not request or upload your Norton password or Norton session cookies. Norton retains its own records of actions on its services, including actions the extension performs. Information you deliberately include in a support message is handled as support content.

After you connect an eligible Norton identity, the extension keeps UnInquizitive credentials so it can validate your plan and connect your website account. These are our credentials, separate from your Norton password or Norton session. On supported UnInquizitive website pages, an installed extension with valid saved authentication can sign you in automatically without an open Norton activity. This shares your connected account identity, extension version, and current plan information with our website.

In 4.2.0, saved website authentication is encrypted and expires after 30 days unless renewed. It does not authorize coursework. Website sign-out ends the website session but does not remove saved extension authentication, so the extension can reconnect on a later visit. On a shared device, remove the extension or its saved data when finished. Website storage durations are listed on our Cookies and browser storage page.

Course syncing is part of UnInquizitive's core service. It begins only after you complete the first-run disclosure and press Continue. The extension then scans courses available to the active Norton identity so it can show upcoming assignments, due-date reminders, progress summaries, one-click assignment access, and plan recommendations.

Course syncing cannot be disabled separately while using the extension. Uninstalling the extension stops future scans, but it does not automatically erase information already stored. You can request deletion using the contact information below.

• Identity and account: the InQuizitive email shown by Norton, a protected identifier derived from your Norton account, and account status and history. We do not retain the raw Norton account identifier.
• Device security and authentication: device registration, authentication credentials and sessions, account changes, and security events. Older accounts may also have separate UnInquizitive login and recovery records.
• License and billing: plan, usage, authorized assignments, referral activity, entitlement history, Stripe customer and transaction identifiers, prices, payment status, refunds, and disputes. Stripe handles full card details.
• Courses and assignments: protected course and assignment identifiers, titles, activity types, completion status, due dates, grades, and scan times. We also collect trial-access status and digital access offers shown by Norton, including price, currency, access length, and description. When Norton exposes them, we collect LMS connection and grading status, grade-transfer results, platform, institution name, and LMS host. We do not store Norton payment details, addresses, or raw LMS launch identifiers. This supports reminders, one-click assignment access, progress and workload summaries, plan recommendations, aggregate analytics, and support.
• Run statistics: account-linked activity and run details, question counts, clicks and time saved, duration, extension version, completion time, and matched course or assignment identifiers. Compatibility results also include run success or failure without account, device, or assignment identifiers. A reported successful run does not necessarily confirm a Norton grade. We do not store assignment answers in these records.
• Reliability and security: technical information about supported pages and their scripts, feature availability, run results, errors, identity mismatches, and known conflicts with other extensions. This includes extension version, timestamps, IP address, and browser information. We do not collect a general list of installed extensions.
• Feedback and support: messages you submit, whether you chose anonymous feedback, and information you provide through support. An optional uninstall survey can include an install identifier, extension version, selected reason, and your comment.
• Website analytics: page URL, referrer, device and browser type, approximate location, and pseudonymous visitor or session information collected by Vercel Analytics and, when enabled, Google Analytics.

Identity, license and usage-allowance checks, payments, course syncing after its first-run disclosure, account dashboard run statistics, compatibility results, and essential error reports continue while you use the service. Turning off optional usage sharing does not turn off these functions. We filter error messages and limited stack traces to reduce sensitive information, but filtering cannot identify every private detail.

Optional product usage sharing is on by default. It records interactions such as opening the popup, using Course Hub, starting a run, changing settings, or viewing and choosing a plan, together with an install identifier, extension version, and times. These events can be linked to your account; they are not anonymous simply because the identifier is random. They do not include question or answer text, course titles, or general browsing history.

Turn this off using Share usage data to improve UnInquizitive in the extension's toolbar popup. This stops new optional usage and extension offer-journey events and discards pending events; it does not delete records already received. Additional course discovery and assignment activity diagnostics require both usage sharing and course analytics consent. They can include account-linked scan and run outcomes with course and assignment identifiers, but no question text or answers.

On pricing and checkout pages we may record offers shown or selected, prices and allowances, checkout progress, purchases, visit duration, device and screen information, and exit reasons. These measurements use visit identifiers and can be linked to your account when signed in. Hosting and security systems also process IP addresses and request information.

Referral measurement uses referral codes, visit times, referring websites, and a pseudonymous identifier derived from IP address and browser information. Referral visit records do not retain the raw IP address. A first-visit cookie records referral or campaign source, referring website, landing path, and visit time for up to 90 days. That source can be saved with your account.

Website analytics and checkout measurements are separate from the extension's usage-sharing switch. Vercel Analytics loads on public pages; Google Analytics loads when its integration is enabled and can use analytics cookies. These tools may receive page URLs and request metadata. Avoid putting passwords, payment details, or other private information into URLs or analytics labels. See our Cookies and browser storage page for storage, durations, and browser controls.

• Connect the correct Norton identity without requiring a separate login.
• Create and manage trials, licenses, referrals, purchases, and usage.
• Show upcoming work, due-date reminders, one-click assignment access, progress summaries, plan recommendations, and account-eligible products. Course or assignment data does not set a price or experiment cohort. Randomized groups may see different offers or prices; we evaluate these tests using aggregate purchase and service-use results.
• Detect license sharing, repeat trials, referral abuse, fraud, and compromised accounts.
• Find Norton site changes, fix product failures, provide support, and understand product performance.
• Process payments, refunds, disputes, accounting, and legal obligations.

UnInquizitive's use of information received through Chrome extension APIs follows the Chrome Web Store User Data Policy, including its Limited Use requirements. We use extension data only to provide, secure, maintain, and improve the disclosed extension service. We do not sell it, use it for targeted advertising, or use it to determine creditworthiness. This commitment also covers aggregated and derived extension data.

Where applicable data-protection law requires a legal basis, account, license, and payment processing supports providing the service you request; required recordkeeping supports legal obligations. Necessary security, fraud prevention, reliability, and service improvement may rely on legitimate interests where permitted, balanced against your rights. Processing that legally requires consent must rely on that consent; you may withdraw it for future processing. Contact us to ask about the basis for a particular use or to object where that right applies.

We disclose only what is needed to providers that operate the service:

• Supabase for database and infrastructure services.
• Stripe for checkout, billing, tax, fraud, refunds, and disputes.
• Vercel for website hosting and analytics.
• Google Analytics when the website analytics integration is enabled.
• Resend, when configured, for verification and password-recovery emails, including the recipient and message needed for delivery.
• Upstash, when configured, for short-lived rate limits and deduplication records used for reliability and abuse prevention.
• Discord for support, privacy, legal, and billing tickets. Discord processes your account information, messages, and attachments under its own policy. Share private account information only in a private ticket, never in a public channel.
• Support and professional service providers when needed to answer a request, secure the service, or meet legal obligations.

Service hosting providers process the data needed to operate the service; this is different from selling it or sharing it with advertising platforms. For extension-derived user data, human access is limited to your explicit consent to read specific information for support, necessary security investigations, legal requirements, or aggregated and anonymized internal operations.

We may disclose information when legally required or necessary to address fraud or abuse. Transfers of extension-derived user data in a merger, acquisition, or sale of assets require your explicit prior consent under the Limited Use requirements. Providers may process data in the United States or other countries where they operate. Applicable transfer protections and privacy rights remain relevant.

The extension saves settings, authentication, cached courses, reminders, and pending events in your browser. Version 4.2.0 encrypts persistent local records, and the website encrypts sensitive saved account data. Temporary memory, public metadata, and some browser-managed markers are not all encrypted. Older versions may store data differently. See our Cookies and browser storage page for controls and durations.

We encrypt production communications and use access controls and security monitoring. Our service can read information needed to provide its features, and Norton can see actions on its own pages. Encryption reduces exposure but cannot protect against every compromised browser, device, or person with access to your signed-in session.

• Saved website authentication expires after 30 days unless renewed. Cookie durations are listed on our Cookies and browser storage page. Associated server records can remain until cleanup or an applicable deletion process.
• Need-profile analytics, inactive course inventory, LMS connection profiles, and LMS activity observations are removed after 180 days of inactivity.
• Compatibility snapshots and abuse reports are normally kept for up to 180 days. Account-linked extension-conflict information is kept while needed for reliability and reviewed as part of applicable privacy requests.
• Identity, license, entitlement, billing, trial, and referral records are kept while needed to operate the account and afterwards for fraud prevention, disputes, accounting, and legal obligations. A minimal trial marker may be retained indefinitely to prevent repeated free trials.
• Optional usage and discovery diagnostic events: 180 days. Per-install error records: 180 days after last seen; grouped error summaries: 365 days after last seen.
• Compatibility run logs: 90 days. Account dashboard run statistics, commercial journey events, usage-exhaustion events, checkout steps, and referral visit records: 365 days. Assignment tool-activity records: 180 days.
• Install lifecycle records, survey answers, saved acquisition source, and support messages do not all have an automatic fixed expiry. They are kept while needed for the disclosed service, support, security, or applicable recordkeeping and are included in relevant privacy-request reviews. Offer terms retained with a billing record follow its recordkeeping requirements.

These periods are cleanup rules, not promises that every copy disappears at the exact deadline. Scheduled cleanup, provider backups, incident investigations, disputes, and legal holds can affect removal time. Expired data restored from a backup must be subject to the applicable deletion rules again. Clearing browser storage does not delete server records, and server deletion does not clear every browser copy.

Use the extension's usage-sharing switch for optional extension analytics, skip the uninstall survey, and clear or block browser cookies and storage using the controls described on our Cookies and browser storage page. Clearing a cookie does not stop it being created on a later eligible visit unless you also block it. These choices can affect sign-in and saved settings.

Depending on where you live, you may ask to access, correct, delete, or receive a portable copy of your personal information, object to or restrict some processing, and appeal a denied request. We do not sell personal information or share it for cross-context behavioral advertising.

Uninstalling the extension stops future course syncing but does not automatically delete server records. To request access, correction, deletion, or a portable copy, Join our Discord server and open a private support ticket and describe your request. We will acknowledge it, verify your connected UnInquizitive account without requesting a Norton password, and respond within the period required where you live, normally no later than 45 days. A Discord account alone does not prove ownership of an UnInquizitive account. We may retain records required for security, fraud prevention, billing, disputes, or law and will explain an applicable denial and appeal method. We will not discriminate against you for exercising an applicable privacy right.

The service is not directed to children under 13, and we do not knowingly collect personal information from them. Anyone under 13 must not use the service. If we learn that we collected such information, we will delete it as required by law. If local law requires parental consent for an older minor, that consent is required before use.

We may update this policy when the product or law changes. Material changes will be posted here and, when appropriate, shown in the product before they take effect. A policy notice is not a substitute for consent where applicable law requires it. Report suspected account misuse to support promptly; no system is perfectly secure.

The person or business identified as the merchant in Stripe Checkout and on a purchase receipt operates UnInquizitive and controls the information described here. All support, privacy, billing, and legal inquiries are handled through private Discord tickets.