Privacy notice
The short version, in plain English
This part is written for students. The full detail is further down for whoever pays for the app. There is also a separate short version written just for students, which covers the same ground in less space.
- We know very little about the learner. The learner profile uses the generic label “Student”; we do not ask for a real name.
- We do not ask the learner for their age, school, surname or email. The adult account holder supplies an email for sign-in and billing.
- There are no adverts. None. Not on any screen.
- We do not track you for advertising. We do not follow you around other websites or build a commercial profile to sell. The readiness feature is limited educational profiling, explained below.
- We never sell your information or share it for advertising. Named service providers receive only what they need to run the app.
- We save whether you got a question right, not what you wrote. Your written exam answers stay on your own device.
- Readiness scores and saving to your account are both optional, and both start off. The app works without them. You are asked once, after signing in, and you can change your mind at any time in Your account.
- Saving to your account is agreed device by device. Signing in on a new phone or laptop does not switch it on there; somebody using that device has to agree first.
- Your readiness score is educational guidance. It is not a grade or prediction and does not go to a school. If you switch these features on, the adult who set up the account can see them.
- You can take your information with you and ask us to stop or delete it. The download is available in Your account. Deletion can be requested there or by email and may leave legally required payment, complaint, security-log or backup records for limited periods.
1. Who is responsible for your information
IGCSE Science Revision is a trading name operated by Christopher Scargill, who is the data controller for this app. That means we are the ones who decide what information is collected and why, and we are responsible for looking after it.
Contact us by email at hello@igcsesciencerevision.com. This is the address to use for any question about your information, including access, correction, deletion and complaints. A real person reads it.
Information Commissioner's Office registration: ZC202280. Our registered details, including a postal address, are held against that number on the ICO's public register.
2. There are two roles in an account
This matters, because they hold different amounts of information.
- The account holder. The adult who buys the app and creates the account. They must be 18 or over. We hold their email address, because that is how they log in and how we can reach them about the purchase.
- The learner. The student who actually revises. A learner does not have their own login at launch, and we hold no contact details for them at all.
The contract for the app is with the adult who buys it. That is deliberate. It keeps the amount of information held about a child as small as we could make it.
The adult account holder controls the login. Where the learner has switched on saving progress to the account, the account holder can view that progress and any readiness information it produces. The learner does not have a private area hidden from the account holder, and is told so before they agree to anything. The information is not sent separately to a school, teacher or parent, but anyone using the account can see it.
Where the learner has not switched those features on, there is nothing on the account to view. Progress stays on the device being used, as described in the next section.
3. Two optional features, and what they change
The app works fully without either of these. Both are off until somebody turns them on, and the learner is asked about them once, on each device, after signing in.
| Feature | What switching it on does |
|---|---|
| Readiness scores | Works out how ready the learner is for each subject and which topics to revise next. It is calculated on the device from evidence held on the device. Nothing extra is sent to us. Switching it off stops the calculation. |
| Saving progress to the account | Copies progress to our database in London so it appears on the learner's other devices and survives a lost phone. This is the only one of the two that sends anything anywhere. Switching it off stops it and deletes what is stored on our server; the work stays on the device. |
Consent to save progress is recorded per device, not per account. Signing in on a new device does not start it; someone using that device has to agree first. This matters because the account belongs to the adult: without it, an adult signing in on their own laptop would pull the learner's progress onto it with nobody having chosen that.
The learner is told this before agreeing: anything switched on is visible to the adult who set up and pays for the account. It is their account, and the app does not offer the learner a private area hidden from them.
3a. What the app actually stores about a learner
| What | Why |
|---|---|
| A generic learner label | The current app uses “Student”. It does not ask for or store the learner's real name. |
| Which study pages have been finished | To pick up where you left off. Held on the device, and on our server only if saving to the account is switched on. |
| Practice score percentages by topic | To show how a session went, and to work out which topics need more practice if readiness is switched on. We store the session score, not the answer you typed. |
| Mock exam marks | Your score out of the total, and whether it was timed. Not your written answers. |
| A random device identifier, and the record of consent | Created only if saving to the account is switched on. It is a random value with a short label such as “Chrome on Windows”, so the learner can recognise a device and withdraw it. It is not built from anything about the device or the person, so it cannot be used to recognise anyone anywhere else. We also keep when consent was given and when it was withdrawn, as evidence that it was. |
What we deliberately do not collect
We do not ask for, and the app has nowhere to put, a learner's surname, date of birth, age, school, home address, phone number, email address or photograph. We do not collect location information of any kind. We do not access your camera, microphone, contacts or files.
One clarification, because it could otherwise look like a contradiction. Stripe's checkout page asks the adult who pays for a billing address, for the tax reasons set out in section 7. That is a billing detail belonging to the account holder. It is not a learner's address, it is not stored against the learner profile, and the app itself still has nowhere to put an address of any kind.
4. What stays on your device and never reaches us
- Your reading settings, such as text size, spacing and dark mode.
- The answers you write out in full during a mock exam.
- An exam in progress, saved so that closing the app by accident does not lose your work.
Written exam answers are your own words, and marking happens on your device at the moment you answer. Sending them to us would be more information about a child than the app needs, so we do not. Signing out removes account-linked progress, exam attempts and written answers from that device so the next person using a shared browser cannot inherit them. Reading settings remain on the device.
5. Cookies and browser storage
This app sets no cookies at all. Not advertising cookies, not analytics cookies, not any cookies. Checked in a browser on 25 August 2026 with nothing stored under any name, including by the hosting provider. There is also no third-party code in the app: the one external library it uses is served from our own site rather than from somebody else's network, so opening the app contacts nobody but us.
What it does use is browser storage — a different mechanism, and one the same law covers — for sign-in, preferences, saved work and offline use. The optional YouTube player is not contacted until the learner selects Load video; at that point Google/YouTube receives the request and may use cookies or similar storage under its own privacy information. What the app itself uses is listed here:
| Name | Type | Purpose |
|---|---|---|
| igcse-auth login session | Browser storage, strictly necessary | Keeps you logged in. Without it you would have to sign in on every screen. |
| igcse-app-preferences | Browser storage | Your reading settings. |
| igcse-unit, igcse-checkpoint, igcse-practice, igcse-exam and igcse-mock entries | Browser storage | Your own progress and any exam in progress. |
| igcse-schema-version | Browser storage, strictly necessary | Records which version of the local storage format this device uses, so saved progress can be migrated rather than lost when the app is updated. |
| igcse-progress-owner | Browser storage, strictly necessary | Prevents progress saved for one signed-in account from being used or uploaded by another account on the same device. |
| igcse-device | Browser storage, strictly necessary | A random label for this browser, so that the choice about saving progress can be made separately on each device. It identifies the device, never the person, and is not sent anywhere unless saving to the account is switched on here. |
| igcse-feature-settings | Browser storage, strictly necessary | Remembers whether readiness scoring and saving to the account are switched on or off on this device, and which accounts have already been asked. Without it, a considered “no” would turn back into a question at every sign-in. |
| Offline content cache | Browser storage | Saves the revision content so the app works without a signal. |
The app also reads, once, a small number of older keys left by pre-release versions, so that work saved under the old naming is recovered rather than lost. It never writes them, and they cannot exist on a device that first used the app after launch.
Under UK law, consent is not needed for storage that is strictly necessary to provide a service you have asked for. Everything in that table is either strictly necessary or is simply your own settings and work, kept on your own device. You can clear all of it at any time by clearing the site data in your browser settings, or by uninstalling the app. Signing out clears learner work linked to the account from that device while keeping non-personal reading settings.
6. No advertising; limited educational profiling
There are no adverts in this app. We do not use behavioural advertising, we do not use analytics that track individuals, and we do not share anything with advertising networks. Nothing in the app is designed to keep you using it for longer than you meant to: there are no streaks, no daily pressure and no notifications nagging you to come back.
The app can calculate a readiness percentage from completed study checks, practice, exam-style work and mocks. It uses scores, coverage and recency to evaluate educational performance and recommend what to revise next. This is educational profiling, which is why it is an optional feature that starts switched off and is only carried out for a learner who has switched it on. The calculation runs on the device and the derived percentage is not stored in our database. It is not a predicted grade and does not make a legal or similarly significant decision about the learner. It is never used for advertising or sent to a school, although it is visible to anyone who can access the adult account.
7. Paying for the app
Payment is handled by Stripe. Your card details are entered directly into Stripe's payment form. We never see them and we never store them. What we receive from Stripe is confirmation that a payment succeeded, and an identifier that lets us match the payment to the account.
Stripe's checkout page asks for a billing address. This changed on 31 August 2026, and it is worth explaining properly.
If you reached us by clicking one of our adverts, the labels on that advert's link (which platform, which advert) are kept for the tab you are browsing in and written onto the subscription record so we can see which advert paid for itself. They describe the click, not you. Nothing is sent back to the advertising platform, no profile is built, and closing the tab discards them.
The address is needed because the country you are in decides which tax rules apply to the sale, and because tax and accounting law requires a record of it. It also helps Stripe check that a payment is genuine. It is not used for marketing. We do not send postal mail, we do not build a profile from it, and we never sell it or pass it to anyone else for their marketing.
The two halves of it are held in different places, deliberately:
- The full address — street, town, postcode and country — is held by Stripe, as part of the payment record. We can see it in our Stripe account when we need to check a payment or answer a tax query, and we do not copy it anywhere else.
- The country alone, as a two-letter code, is the only part copied into our own database. We hold it because our business insurance requires us to tell the insurer which countries our subscribers are in, and that duty continues for as long as the policy runs. It appears in your account data download.
We kept it split that way on purpose. Our database has no need of your street or postcode, so it does not have them, and a breach of our database could not expose them. Neither the address nor the country tells us anything about the student.
The full course is sold as an automatically renewing subscription: £49 per year or £4.99 per month. It renews until the adult account holder cancels it through Stripe's customer portal. Cancelling normally leaves access available until the end of the paid period. Deleting the account cancels the subscription immediately because there would no longer be an account through which to provide access.
Stripe processes information under its own privacy notice.
8. Service providers, recipients and international transfers
The following organisations help provide the app. Most act as processors under contract when handling data for us. Stripe and Google/YouTube also determine some purposes for themselves and act as independent controllers for those activities.
| Company | What it does |
|---|---|
| Supabase, Inc. | Authentication, the London-region database, progress sync and server functions. It receives the adult email, account identifiers, learner progress summaries and operational/security data. Supabase is our processor for these services. |
| Cloudflare, Inc. | Hosts and delivers the app through its global network and protects it from abuse. It processes IP addresses, request details and security/operational logs as our processor. |
| Brevo (Sendinblue SAS) | Sends sign-in, purchase and complaint emails. It receives the adult or complainant email address and the content needed for that message. Its core databases are hosted in the European Union. |
| Stripe | Provides checkout, subscription management, fraud prevention and regulated payment services. It receives purchaser, payment, device and transaction information. Stripe acts as our processor for some platform services and as an independent controller for payment, fraud and legal-compliance activities. |
| Anthropic, PBC | Provides Claude, the AI assistant described in section 8a, used for development, support and fault investigation. It may receive account or contact details and operational records when a problem cannot be understood without them. Anthropic acts as our processor under its commercial terms and data processing agreement, and does not use commercial customers’ data to train its models. |
| Google LLC / YouTube | Provides the optional video player only after Load video is selected. The request can disclose the page URL, IP address, device/browser details and video interaction to Google. The player uses privacy-enhanced mode, but Google remains responsible for its own processing. |
Core Supabase database storage is selected in London. Brevo states that its databases are hosted in France, Germany and Belgium; transfers from the UK to the EEA use UK adequacy regulations. Cloudflare, Stripe, Supabase and Google operate internationally and data or support access may involve the United States and other countries. Where a transfer is not covered by UK adequacy regulations, the relevant provider terms use safeguards such as the UK Extension to the EU-US Data Privacy Framework, the UK Addendum to the EU Standard Contractual Clauses or another approved UK transfer mechanism. We record and review these arrangements in our processor and international-transfer register. Anthropic is in the United States and relies on the standard contractual clauses and the UK Addendum set out in its data processing agreement.
We do not sell information or disclose learner progress to data brokers, advertisers, schools or examination boards. We may disclose the minimum required by law, for example in response to a valid court order.
8a. AI assistance, and what it may see
Some of the work of building and maintaining the app is done with the help of an AI assistant, Claude, provided by Anthropic, PBC. It is used for writing and reviewing code, checking database queries and security rules, drafting written material, investigating faults, and looking at figures such as how many accounts exist or how a page is performing.
This changed on 1 September 2026. Until then we used an ordinary individual subscription and kept all personal data out of it. We now use a business plan, Claude Team, under Anthropic’s commercial terms, which include a data processing agreement. Anthropic is therefore one of our processors and is listed in the table in section 8. It acts on our instructions and may not use your information for its own purposes.
The app itself still does not connect to it. No part of the app sends anything to it automatically, it has no standing access to the database, and no decision about a learner is made by it: readiness and the limited educational profiling described in section 6 are calculated by the app’s own code.
What has changed is what we are permitted to show it when something goes wrong. When we investigate a technical fault, a support question or a suspected personal data breach, we may now share the records needed to understand it, and those records can contain personal data such as an email address, an account identifier or an IP address. We share the least that answers the question, we do not share card details or passwords, and we do not share the content of a complaint or a feedback message where a summary will do.
Two limits matter and we hold ourselves to both. Anthropic does not use commercial customers’ conversations to train its models; the one route by which that could happen is the feedback button inside Claude, and the organisation setting that permits it is switched off for our account. And no provider, Anthropic included, is permitted to use learner information for advertising, profiling, school reporting or model training on our behalf.
Anthropic is based in the United States, so this is a restricted transfer. It is covered by the standard contractual clauses and the UK Addendum in Anthropic’s data processing agreement, described alongside our other transfers in section 8.
Your rights in section 11 are unaffected. If you ask what we hold, or ask us to delete it, that request covers anything shared with the assistant in the course of supporting you.
9. Why we are allowed to hold this (lawful basis)
| What we do | Lawful basis |
|---|---|
| Run the adult purchaser's account, subscription and access | Contract. This is necessary to provide the service bought by the adult account holder. |
| Save progress to the account so it appears on other devices | Consent. This is an optional feature and is off unless it is switched on, separately on each device. It can be switched off at any time in Your account, which stops it immediately and deletes the progress held on our server. Withdrawing does not affect anything done while it was on. We minimise the records and never send written answers. |
| Calculate readiness scores and revision recommendations | Consent. Also optional and also off unless switched on. This one is calculated on the device and the workings never reach us at all, so switching it off stops the calculation rather than a transfer. |
| Keep records of payments | Legal obligation. Tax law requires business records to be kept. |
| Record which advert or link a new subscriber arrived from | Legitimate interests. Knowing which advertising actually works is what stops money being wasted on advertising that does not, and it is the only way a one-person business can advertise responsibly. It is a label about a click, not a profile of a person: the four values are the ones written on our own advert links, they are held only for the browser tab you arrived in, and they are never sent to the advertising platform. It plays no part in what you are charged or what you can see. |
| Collect a billing address at checkout and keep it with the payment record | Legal obligation. The tax treatment of a sale depends on the country the purchaser is in, so we have to establish it and keep a record of how we did. Where an address is also used to check that a payment is genuine, that part rests on legitimate interests in preventing fraud, which is in the interests of the account holder as well as ours. It is not used for marketing and no marketing basis is claimed for it. |
| Tell our insurer which countries subscribers are in | Legitimate interests. Our business insurance is only valid if the insurer is kept accurately informed about the business, and this is a continuing duty rather than a one-off declaration. We use a two-letter country code and nothing more, and it is never used to decide anything about you or your child. |
| Keep the service secure and working | Legitimate interests. Limited to what is needed to prevent fraud and abuse. |
| Handle data-protection complaints and rights requests | Legal obligation. Data protection law requires a complaints process and responses to valid rights requests. |
| Record and act on feedback and suggestions about the app and website | Legitimate interests. To find and fix accessibility problems, content errors and usability problems. Nothing is required to send feedback: no account, no name, and an email address only if the person wants a reply. |
| Offer an optional YouTube video after the learner selects Load video | Legitimate interests. To provide an optional video-learning format with a click-to-load privacy control. Google determines its own lawful bases for the data it receives. |
We do not send marketing email. If we ever offer it, it would be a separate, optional choice you actively tick, and never a condition of using the app.
A learner has the right to object to processing based on legitimate interests, including saved progress and readiness. Email us or use the complaint/contact route and explain the particular situation. We will respond within one month and stop the processing unless we can demonstrate compelling legitimate grounds or need it for legal claims. Objecting is free and does not remove the right to use the free local content.
10. How long we keep things
- Progress and learner profiles: deleted twelve months after access to the app ends. That gap exists so a student who buys again for a resit does not lose everything, and so a lapsed account does not sit there forever.
- Never-paid learner profiles: deleted after 24 months without recorded activity.
- Account details: until you delete the account, or until the account has shown no activity for two years, whichever comes first. After two years we close the account and delete the email address and everything remaining with it. We email you 30 days before, and simply signing in during that time keeps the account open. An account with a live subscription is never closed this way.
- Notice before deletion: we email the account holder 30 days before progress is deleted on either of the periods above, so there is a chance to download a copy, keep it, or remove it immediately. The email says which applies and what to do. It is a one-off service message, not marketing. We keep a record that the notice was sent.
- Payment records, including the billing address: kept for at least five years after the 31 January self assessment deadline for the tax year the payment falls in, because HMRC requires business records to be kept for that long. These are records of a transaction, not revision data. This is the one part of your information that deleting your account does not remove: the law requires us to keep it, and data protection law recognises that by allowing us to refuse erasure of records held to meet a legal obligation. Everything else about the account still goes.
- Billing country in our own database: kept while the account exists and while the insurance duty described in section 7 continues, then deleted with the rest of the account record. The full address in Stripe follows the payment-record period above.
- Complaints: kept for two years after they are resolved, so we have a record of what was asked and what we did.
- Feedback and suggestions: kept for twelve months after we record our decision, or twenty-four months if we have not yet decided, then deleted automatically. Feedback is not linked to an account even when the person is signed in, and it cannot be read back through the app by anyone, including the person who sent it.
- Provider security logs and backups: retained under the provider's security, continuity and deletion schedule, then overwritten or deleted. These records may persist for a limited period after active account data is removed and are not used to restore an account except for disaster recovery.
11. Your rights, and the buttons that do them
You have rights under UK data protection law: to get a copy of your information, to have it corrected, to have it deleted, to object to how it is used, and to ask us to restrict what we do with it.
The app provides a download and an account-deletion request in Your account:
- Download my information. Gives you a file containing the account and sign-in information available to the app, subscription status, linked complaints, server-saved progress and revision data held on that device.
- Delete my account. Requests cancellation of any active subscription and removal of the active Supabase account, learner profile and progress. If the automated route is unavailable, email us and we will process the request. Stripe transaction/tax records, resolved complaints, security logs and backup copies may remain for the limited legal, security and recovery periods explained here.
The immediate download contains the account information available to the app, linked database records and data held on that device. It does not automatically contain every provider-controlled record, such as Stripe's regulated-payment records or Cloudflare and Supabase security logs. We will request and supply additional records that are personal data we control and can identify where required. For a complete subject access request, an objection, progress-only deletion or anything else, email hello@igcsesciencerevision.com. We will respond within one month. Exercising any of these rights is free.
If you are a student, you can ask us directly to access, correct, stop syncing or delete your progress. You do not need to go through the person who paid. We may ask for enough information to identify the correct account without collecting more than is necessary.
12. Complaints
If you are unhappy with how we have handled your information, tell us. The quickest way is the complaint form in the app, which logs your complaint against the 30-day clock below. You do not need an account to use it, and you do not need any particular wording.
If you would rather write to us, email hello@igcsesciencerevision.com with "Data protection complaint" in the subject line. Both routes reach the same person.
We will acknowledge your complaint within 30 days and respond as quickly as we reasonably can.
You can also complain to the Information Commissioner's Office, the UK regulator, whether or not you have come to us first: ico.org.uk/make-a-complaint.
13. Children and the Children's Code
This app is built for students taking International GCSE Science, so most of the people using it are 14 to 16 years old. We follow the Information Commissioner's Age Appropriate Design Code.
What that means in practice, and all of it is already true of the app:
- We use high-privacy defaults and explain that progress sync starts when an account is signed in.
- Signing out removes account-linked learner work from that device so another account cannot inherit it.
- We collect the least we could and still teach the course.
- There is no advertising profiling or precise-location collection. Readiness is limited educational profiling, explained above.
- There is nothing designed to push you into using it more, or to make you feel bad for stopping.
- This notice is written to be read by a student, not only by a lawyer.
If you think anything in the app works against a student's interests, please tell us. That is exactly the kind of thing we want to hear about.
14. Keeping information safe
Everything travels over an encrypted connection. Accounts are separated at the database level, so one account cannot read another's information even if there were a mistake in the app's own code. We hold as little as possible, which is itself the strongest protection: information we never collected cannot be lost.
15. Changes to this notice
If how the app uses information changes, we will update this notice and change the date at the top. If a change is significant, we will tell you in the app rather than quietly editing this page.