Privacy policy
Last updated: 2026-08-30 Data controller: Abhijith Pradeep, United Kingdom Contact: dsattraineradmin@gmail.com
What we collect
If you use the app without an account: nothing leaves your device. Your progress is stored in your browser only.
If you create an account:
| Data | Why | Where it goes |
|---|---|---|
| Email address | To sign you in and contact you about your account | Supabase (our database provider) |
| Display name | To greet you in the app | Supabase |
| Year of birth | To determine whether parental consent is required | Supabase |
| Guardian's email (under-13s only) | To request permission, once | Supabase |
| Your study progress: questions answered, right/wrong, time taken, skill mastery | So the app can track progress and adapt | Supabase |
| Your typed notes in the training modes | Shown back to you; never analysed | Supabase |
If you subscribe: payment is handled entirely by Stripe. We never see or store your card details. We store a Stripe customer reference so we know which account a subscription belongs to. When you open "Manage or cancel your subscription" from the account page, we send that reference to Stripe to open their billing portal; nothing else is transmitted.
What we do NOT do
- We do not sell your data
- We do not show advertising
- We do not share your data with third parties for their own purposes
- We do not track you across other websites
- We do not use advertising or analytics trackers
Anonymous question statistics
To improve question quality, we record how often each question is answered correctly, which answer choices are chosen, and how long questions take.
These records contain no user identifier. They cannot be linked back to you. They are used to correct difficulty ratings and find flawed questions.
Children and parental consent
Most of our users are school students. We take this seriously.
- Accounts are for ages 13 and over. We refuse to create one below that, in
the app and on the server. Someone younger can still use the app on their own device, where nothing is sent to us at all
- At signup we ask for year of birth
- If you are under 13, we ask for a parent or guardian's email address and
send them one message asking for permission
- Until they approve, none of your study data is stored on our servers. This
is enforced by our database, not just by the app
- The email explains exactly what will be collected before they decide
- If we cannot deliver that email, we do not record the request and the account is
not placed in a pending state — the student is told to check the address instead
- If they decline, we delete the account's study data
- A guardian may withdraw consent at any time by emailing dsattraineradmin@gmail.com, and we
will delete the data
We do not send marketing email to anyone under 18, and we do not add guardian addresses to any mailing list — their address is used only for the consent request.
Legal basis (where GDPR or similar applies)
- Contract: to provide the Service you have signed up for
- Consent: for processing a child's data, obtained from their guardian
- Legitimate interests: keeping the Service secure and improving question quality
How long we keep it
- Account data: until you delete your account
- Study progress: until you delete it or your account
- Anonymous question statistics: indefinitely (they cannot identify anyone)
- Consent records: the guardian's email address, the time they decided, and the IP
address the decision came from, kept while the account exists plus 12 months after the account is closed, as evidence that consent was given. The emailed link itself is never stored — only a SHA-256 hash of it — so a copy of our database cannot be used to forge consent
- Payment records: as long as tax law requires, typically 6 years
Your rights
You can ask us to:
- Give you a copy of your data (the app also has a one-click export)
- Correct anything inaccurate
- Delete your account and its data
- Stop processing your data
Email dsattraineradmin@gmail.com. We respond within 30 days. If you are unhappy with our response you may complain to your data protection authority.
Where data is stored
Our database is hosted by Supabase in eu-central-1 (Frankfurt, Germany). Payments are processed by Stripe. Consent emails are sent via Resend.
Security
- All traffic uses HTTPS
- Passwords are hashed by our authentication provider; we never see them
- Database access is restricted per user, so one account cannot read another's data
- Payment card details never reach our systems
No system is perfectly secure. If a breach affects your data we will notify you and the relevant authority as required by law.
Cookies and local storage
We use browser local storage to keep you signed in and to hold your progress. We do not use advertising or analytics cookies.
Changes
We will post any change here and, if it is significant, email you.
Contact
dsattraineradmin@gmail.com