Who this covers
This policy covers the GCSE Study Desk website and mobile app. The release owner is responsible for the service. For privacy questions, use the route on our support page; a monitored address must be published there by the release owner before public release.
Information we handle
- Account: email address, chosen username, internal user ID, and authentication/session records. Password handling is provided through the configured authentication service; we do not need to read your password after authentication.
- Learning: answers and written responses, completion and accuracy records, topic progress, XP, streaks, completed lessons, paper/practice results, and active study-session data needed to resume or mark work.
- Optional AI features: tutor messages and English responses submitted for AI-assisted feedback, plus the recent conversation or marking context needed to answer. Do not include names, contact details, school details, or other sensitive personal information.
- On your device: practice drafts and answers, recent result views, subject and appearance preferences, reading-size preference, and tutor transcript/draft. Secure authentication session material is stored using the device's secure storage where supported.
- Operations: necessary service and security diagnostics such as request timing, error details, IP address and user-agent information that hosting, database or authentication services may process. We do not use these diagnostics to build advertising profiles.
Why we use it
We use account and learning information to authenticate users, keep each learner's work separate, deliver revision activities, save progress, calculate XP and streaks, resume active sessions, mark responses, prevent abuse, troubleshoot faults, and secure the service. Optional AI text is used only when a learner chooses an AI tutor or AI-assisted English marking feature.
The appropriate lawful basis depends on the release owner's circumstances and must be confirmed before launch. Typical bases may include providing the requested service, legitimate interests in operating and securing it, and consent where required. This policy is product information, not legal advice.
Services that process data
Supabase is the configured account/authentication and data processor for the mobile release. The configured backend, hosting and database services process requests and learning records. If an optional AI feature is used, the submitted text and necessary context pass through our backend to the configured AI provider (currently configurable through OpenRouter); that provider may use subprocessors under its own terms. The release owner must complete processor, region, and transfer checks for the production configuration.
We do not sell personal information. The mobile app contains no advertising SDKs, cross-app tracking, or third-party marketing analytics. Public website hosting may create essential operational logs; that is not mobile-app advertising or tracking.
Retention, deletion and security
Account and server learning data are kept while the account is active and only as long afterward as needed for security, backup cycling, legal obligations, or resolving disputes. The release owner must set and document production log and backup schedules. Device-local drafts, preferences and transcripts remain until cleared in the app, removed by account deletion where the app can do so, or removed by uninstalling/clearing app data.
Use Delete account to request deletion of the account, associated progress and active server sessions. Authentication records and live application data should be removed promptly; narrowly retained security records or encrypted backups may remain until their normal expiry where immediate selective removal is technically impracticable or legally required, and must not be restored as an active account.
We use access controls, encrypted transport, scoped user records, secure token storage, and service-provider safeguards. No online service can promise absolute security. Report a suspected issue through support.
School-age users
The service is intended for GCSE learners aged 13 and over. It is not directed to children under 13. UK rules for children's data and online services can depend on age, consent, risk and the way a service is offered; the release owner must obtain appropriate UK legal and safeguarding review before release. A parent, carer or school contact may use the support route if they have concerns. Learners should never put unnecessary personal or sensitive details into tutor messages or written practice.
Your rights and choices
Depending on where you live, you may have rights to access, correct, erase, restrict, object to, or obtain a copy of personal information, and to complain to a data-protection authority. You can delete your account through the deletion page. For another request, use support. We may need to verify the account before acting. UK users can also learn about rights from the Information Commissioner's Office.
Changes
Material changes will be dated on this page. The release owner should provide an in-product notice when a change significantly affects how learner data is used.