Privacy Policy

GCSEwiz is operated by Syllabus Wiz. For any privacy question, or to make a request about your data, contact [email protected]. If we can't resolve a concern, you can complain to the UK's Information Commissioner's Office (ICO) at ico.org.uk.

• Account details. Your account stores an email address (your login), a display name and a password (stored only as a secure hash). We use these to sign you in and run your account.
• Profile photo (optional). You can add a photo to your account if you like. We shrink it to a small square and drop everything else the file carried, such as where it was taken. It is shown to you and to our team. It appears on the public activity feed only if you are old enough to choose that for yourself (see “Activity feed” below) and choose “Show my name and photo”, and it is deleted when you remove it or when your account is deleted.
• Month and year of birth - for the age check only. When you sign up we ask the month and year you were born - never the full date - solely to confirm you meet the UK digital-consent age (13) and to suggest your school year group. We store the confirmed year group and expected exam year; the month and year of birth are checked and not kept, and are never sent to the AI, shown in reports, or used for analytics. We keep one fact from this step: whether the account was set up by an adult for a learner under 13. It decides which choices the account holder can make for themselves, such as showing a photo on the activity feed.
• Onboarding preferences (optional). Things a student chooses to tell us - goals, interests, confidence, coaching style, and any accessibility needs - so we can tailor practice and feedback. All optional; you can change or clear them any time.
• Practice and progress. The questions attempted, answers given, and the mastery we derive from them, so students can track progress and parents can see reports.
• Billing. Payment is by card, Apple Pay or Google Pay through Stripe. Your card details go directly to Stripe - they never reach our servers. We store only the customer and subscription references, the payer’s email address (for receipts and payment notices) and the payment status Stripe reports back.
• Activity feed. Our home page shows a short live feed of what learners are working on, so visitors can see the site is in use: practice questions, Learn topics, mock exams, topics reached, badges earned, and new people joining. By default you appear without your name - “A Year 11 student practised a Trigonometry question” - and your name is shown only if you turn that on yourself, exactly as you gave it to us. If you signed up yourself (so you were 13 or over, the UK digital-consent age), or from Year 9 if an adult set your account up, you can also choose to show your profile photo beside your name; nothing shows a photo unless you chose that, and turning it off takes the photo down at once. We never publish email addresses, schools, scores, or whether an answer was right, and times are shown roughly (“10 min ago”). You can change how you appear, or leave the feed entirely, at any time under Account.
• Technical data. Standard server logs (e.g. request metadata) needed to run and secure the service.

Under UK GDPR we rely on:

• Contract - to create and run your account, deliver practice and reports, and take payment for a subscription.
• Legitimate interests - to keep the service secure, prevent abuse, and improve how it works, balanced against your rights.
• Consent - for the optional onboarding preferences, which you give freely and can withdraw at any time.

The service is used by students, so protecting children's data matters to us. Under-13s cannot sign themselves up - the age check routes them to ask a parent or carer, who can create the account and use it with them. Every account belongs to the learner; the one step that requires an adult is authorising the payment. Parents and carers can see progress through the reports a learner shares with them, and can ask us to delete an account at any time via the support email below.

Anything that makes a learner visible to other people is off by default. The home-page activity feed shows learners anonymously unless they choose to add their name (and, where they are old enough to choose it, a photo), and it never carries a school, contact detail or score - see “Activity feed” above.

We don't sell your data or share it for advertising. We use a small number of trusted processors to run the service, each handling only what they need to:

• Railway - hosting and our Postgres database (servers in the United States).
• OpenAI - generates feedback on answers and marks written responses. It receives the question, your answer, and light onboarding context (e.g. a first name and exam year) - never a date of birth or any identifier beyond that.
• Stripe - collects the subscription payments and holds your card details on our behalf.
• Resend - sends transactional email such as verification and password-reset messages.

Some of these processors are based in, or host data in, the United States, so your data may be transferred there under appropriate safeguards. We may also disclose data where the law requires it.

We keep your data while your account is active, and we delete it on a fixed schedule rather than “eventually”:

• Your account and progress stay for as long as you use the service. If you ask us to delete your account, everything goes within 30 days.
• Accounts nobody uses any more are deleted after 24 months without a sign-in or any activity. We email a warning a month beforehand, and one sign-in keeps the account (accounts with an active subscription are never deleted this way).
• Signups that never verify their email are deleted after 7 days.
• Technical fault logs are deleted after 90 days, and encrypted backups after 30 days.
• Records of admin actions are kept for 24 months, and billing records for 6 years after the tax year, as UK law requires.

You can ask us to delete your account and its data at any time - see your rights below.

Under UK GDPR you can ask us to:

• access the personal data we hold about you;
• correct anything that's inaccurate;
• delete your data (“the right to be forgotten”);
• provide your data in a portable format;
• restrict or object to certain processing; and
• withdraw any consent you gave, without affecting earlier processing.

To exercise any of these, email [email protected]. We aim to respond within one month.

We use a session cookie to keep you signed in - it's essential to the service, not for tracking or advertising. Some practice data (your in-progress session, mastery and preferences) is stored in your browser's local storage on your own device. Clearing your browser data removes it.

You won't see a cookie pop-up on this site, because we don't use the things pop-ups exist to ask about: no third-party analytics, no advertising trackers, and no tracking identifiers saved to your device. We do count visits ourselves. A random identifier, held only in your browser's memory while you're on the site and never saved to your device, lets us count how many visits our pages get each day. The lasting record holds just the date, that random identifier, a count of pages viewed and whether the visit reached our sign-up or payment step - no name, email, account link or browsing history - and the counts are never shared with anyone else. We also keep a short-lived technical log of faults and errors so we can find and fix problems; it never records passwords, and it is regularly overwritten rather than kept.

We may update this policy as the service evolves. We'll post the current version here and update the review date below; significant changes will be highlighted.