Privacy Policy

• We use your email, your name and your school year to run your account, and your answers to choose what you practise next and to build your reports.
• Nothing about you goes public unless you choose it. On the home page’s live feed you appear as “A Year 11 student” unless you decide to show your name.
• We never sell your data or use it for adverts.
• A few companies help us run the site, such as our hosting, the AI that writes Wiz’s coaching, and our payment and email services. Each gets only what it needs.
• You can see, change, download or delete your data whenever you like. Just email us.

GCSEwiz is run by Syllabuswiz Ltd, a company registered in England and Wales (company number 17279234), whose registered office is at 180 Regal Way, Harrow, England, HA3 0SQ. Syllabuswiz Ltd is the controller of your personal data: we decide how it is used, and we are responsible for looking after it.

For any privacy question, or to make a request about your data, email [email protected]. If we can’t sort out a concern, you can complain to the UK’s Information Commissioner’s Office (ICO) at ico.org.uk.

Syllabuswiz Ltd is registered with the Information Commissioner’s Office, the UK’s data protection regulator. Registration number ZC260405.

• Account details. Your account stores an email address (your login), a display name and a password (stored only as a secure hash, never the password itself). If you use “Continue with Google”, Google gives us your name and email address instead of a password. We use these to sign you in and run your account. If you use “Sign in with Apple”, Apple gives us an id for your Apple account, an email address and, the first time only, the name you choose to share. If you choose Apple’s “Hide My Email”, the address is a private one that Apple forwards to your real inbox, which we never see. We keep a secure, encrypted token from Apple only so that deleting your account can also end our access at Apple.
• Avatar (optional). You can make a cartoon avatar for your account from parts we drew: hair, eyes, clothes and so on. It is not a photo and shows nothing of what you look like. We don’t take or keep photos of you; until October 2026 you could upload one, and we deleted every uploaded photo when we replaced them with avatars.
• Month and year of birth - for the age check only. When you sign up we ask the month and year you were born - never the full date - solely to confirm you meet the UK digital-consent age (13) and to suggest your school year group. We store the confirmed year group and expected exam year; the month and year of birth are checked and not kept, and are never sent to the AI, shown in reports, or used for analytics. We keep one fact from this step: whether the account was set up by an adult for a learner under 13. It decides which choices the account holder can make for themselves, such as showing their name on the activity feed.
• Preferences (optional). Things you choose to tell us, like your goals, your interests, the subjects you take and your exam boards, so we can tailor practice and Wiz’s coaching. All optional, and you can change or clear them any time.
• Practice and progress. The questions you answer, the answers you give, what you write for marking and what you ask Wiz, and the progress we work out from them, so you can see how you’re doing and share reports if you want to. When you review flashcards or words, we keep whether each one landed, when it comes back and whether it was on the website or in an app, never what you typed.
• Billing. Payment is by card, Apple Pay or Google Pay through Stripe. Your card details go directly to Stripe - they never reach our servers. We store only the customer and subscription references, the payer’s email address (for receipts and payment notices) and the payment status Stripe reports back. If you subscribe in one of our iPhone or Android apps through the App Store or Google Play, the store takes the payment and holds the payment details, and we learn only whether the subscription is active, when it renews or ends, and what it cost, through RevenueCat (below).
• Activity feed. Our home page shows a short live feed of what learners are working on, so visitors can see the site is in use: practice questions, Learn topics, mock exams, topics reached, badges earned, and new people joining. Anyone who visits the home page can see it. By default you appear without your name - “A Year 11 student practised a Trigonometry question” - and your name is shown only if you turn that on yourself, exactly as you gave it to us, with your avatar beside it if you made one. Showing your name is a choice you make for yourself, so it is offered only if you signed up yourself (which means you were 13 or over, the UK age for agreeing to this online), or if an adult set your account up and you are now in Year 9 or above. Anyone who sees a name on the feed can report it to us, and we take it off the feed if it shouldn’t be there: we keep the report, who sent it if they were signed in, and what we did about it, and if we take your name down we tell you why on your account page, where you can ask us to look again. We never publish email addresses, schools, scores, or whether an answer was right, and times are shown roughly (“10 min ago”). You can change how you appear, or leave the feed entirely, at any time under Account.
• Emails. Besides the emails your account needs (checking your email address, password resets, and notices about your plan and payments), we send a weekly round-up of your progress (to you, and to whoever pays for the subscription), a reminder if you stop practising for a while, and now and then news about new features. You can say no to these when you sign up, turn each one off on your account page, and every one of them has a link to stop it.
• Messages you send us. When you write to us through Help & feedback, we keep your message, the page you sent it from and your account, or, if you weren’t logged in, the email address you left for a reply. If we write back, we email you at that address (your account’s own email if you were logged in) and keep our reply with your message. Only our team sees them.
• How you use the site. We note which screens you reach and when, and which settings you change (including your theme and sounds), so we can see where the site confuses people and fix it - for example, whether new students find their first question. We also note which Learn pages you open: the subject and topic, the day, when you first and last opened the page that day, how many times, and whether it was on the website or in one of our apps. That shows us which explanations get used, so we can improve the ones that don’t. We also count how often you use each of Wiz’s AI features, such as Ask Wiz or the marking of a written answer: the feature, the day, how many times, and whether it was on the website or in one of our apps, never what you asked or what Wiz wrote. That shows us which features help and what they cost to run. This is tied to your account, and only our team sees it.
• Technical data. Standard server logs needed to run and secure the service, and a log of recent activity on the site, which can include what you ask Wiz and the answers you send for marking, so we can find and fix problems. Only our team can see it, and it is deleted after 90 days.

Under UK GDPR we rely on:

• Contract - to create and run your account, deliver practice, Wiz’s coaching and reports, and take payment for a subscription.
• Legitimate interests - to keep the service secure, prevent abuse, understand how the site is used so we can improve it, and send the optional emails above. We weigh these against your rights, with extra care because most of the people who use GCSEwiz are under 18.
• Consent - for the optional preferences you tell us, and for showing your name on the activity feed. You can take it back at any time by changing or clearing them.
• Legal obligation - to keep billing records for as long as UK tax law requires.

The optional emails also follow the UK’s rules on electronic marketing: we only email people who have an account with us, only about our own service, and we give you a way to say no when you sign up and in every email.

The service is used by students, so protecting children’s data matters to us. Under-13s cannot sign themselves up - the age check routes them to ask a parent or carer, who can create the account and use it with them. Every account belongs to the learner; the one step that requires an adult is authorising the payment. Parents and carers can see progress through the reports a learner shares with them, and can ask us to delete an account at any time via the support email above.

Anything that makes a learner visible to other people is off by default. The home-page activity feed shows learners anonymously unless they choose to add their name, and an account an adult set up for a learner under 13 stays anonymous until Year 9. The feed never carries a school, contact detail or score - see “Activity feed” above.

On a shared computer, signing out clears your study data from the browser, and another account signing in on the same browser never sees what the last one left behind.

We use your answers to choose how hard your next question is and to spot patterns, like a topic where the same slip keeps coming up. Written answers are marked by AI against a mark scheme, and Wiz writes a short read of how your revision is going on your dashboard. None of this decides anything about you other than what to practise next: you can practise any topic you like, and it never changes what you can use.

We don’t sell your data or share it for advertising. We use a small number of companies to run the service, each handling only what it needs, under contracts that require them to protect it:

• Railway - hosts the site and our database. Railway is a US company, so your data can be processed in the United States.
• Cloudflare - sits in front of the site to deliver it quickly and securely, so it handles every request, including your IP address. It also stores our encrypted backups, which it cannot read, and the language recordings, which your device loads straight from Cloudflare when you play one.
• OpenAI - writes Wiz’s coaching: the follow-up chat after a question, the Learn chat, the marking of written answers, a check of your working when you ask for one, and the short read on your dashboard. It receives the question and what you wrote or asked (including a photo of your working, if you send one), and some context about you: the name you use, your school year and exam year, the goals and interests you told us, and for the dashboard read a summary of your progress. Never your email address or your date of birth. In Live, OpenAI also hears you: while a Live session you started is running, your voice goes straight from your device to OpenAI so Wiz can hear you and answer out loud, with the words written down as they are said. We never record your voice, and each session is set up so OpenAI does not save a recording of it. Nothing is sent once you end the session, mute it or leave the page. Sometimes OpenAI also writes what goes on the board, as Anthropic does (below).
• Anthropic - writes what goes on the board in Live (its AI is called Claude). It receives the words of the conversation so far, as written down from speech, the subject being talked about and your exam year, and, so the explanation suits you, the interests and goals you told us and how your practice in that subject is going (which topics are going well and which need more work). If you add a photo or a PDF on the Live page (your notes, a question you are stuck on), it goes too, with each question you ask while it is on the page, so the board can read it. We never store what you add: it stays on the page until you remove it or leave. Never your voice, your email address or your date of birth.
• Stripe - collects the subscription payments and holds your card details on our behalf.
• RevenueCat - manages subscriptions bought in our apps. It receives your account’s ID (a random code, never your name or email address) and the store’s record of the purchase: what was bought, when, the price and whether it renews. Its software in our apps also sends technical details: the device model, system version and language, and on an iPhone or iPad an identifier Apple gives our app for that device. That identifier is not an advertising ID, and it can’t be used to follow you across other companies’ apps.
• Apple and Google - if you subscribe in one of our apps, the App Store or Google Play takes the payment, under its own terms and privacy policy.
• Resend - sends our emails.
• Google - if you choose “Continue with Google”, Google tells us your name and email address. What Google does with your sign-in is covered by Google’s own privacy policy.
• Apple - if you choose “Sign in with Apple”, Apple tells us an id for your Apple account and an email address (a private relay address if you chose to hide yours), and your name the first time. What Apple does with your sign-in is covered by Apple’s own privacy policy.
• GitHub - if we turn a message you sent through Help & feedback into a task for our developers, the message goes to GitHub, where we track our work. Your name and email address never go with it.
• ElevenLabs - makes the voices in our video lessons and the recordings you hear in language practice. It turns words we wrote into speech before anyone listens, so it never receives anything about you.

Some of these companies are in the United States. When your data goes there, it is protected by the UK-US data bridge where the company is certified to it, or otherwise by the UK’s International Data Transfer Addendum in the data protection terms we have with them. We may also disclose data where the law requires it.

When you share a report with a parent or a teacher, they see what the report shows until the link expires (after 30 days) or you turn it off.

We keep your data while your account is active, and we delete it on a fixed schedule rather than “eventually”:

• Your account and progress stay for as long as you use the service. If you ask us to delete your account, everything goes within 30 days.
• Accounts nobody uses any more are deleted after 24 months without a sign-in or any activity. We email a warning a month beforehand, and one sign-in keeps the account (accounts with an active subscription are never deleted this way).
• Signups that never verify their email, and Google or Apple sign-ups that never finish the age and school-year step, are deleted after 7 days.
• The activity and fault log, which can hold what you ask Wiz and the answers you send for marking, is deleted after 90 days, and encrypted backups after 30 days.
• Records of admin actions are kept for 24 months, and billing records for 6 years after the tax year, as UK law requires.

You can ask us to delete your account and its data at any time - see your rights below.

Under UK GDPR you can ask us to:

• give you a copy of the personal data we hold about you;
• correct anything that’s inaccurate;
• delete your data (“the right to be forgotten”);
• provide your data in a portable format;
• restrict or object to certain processing, including the optional emails; and
• withdraw any consent you gave, without affecting earlier processing.

To do any of these, email [email protected]. We aim to respond within one month. To delete your account, our delete your account page says how to delete it yourself, and what goes and when. You can also download your answers yourself: open Reports, choose “The numbers”, then “Download your answers”.

We use a session cookie to keep you signed in. It’s essential to the service, not for tracking or advertising.

While you’re signed in, the site keeps a working copy of your study in your browser’s local storage, on your own device: your profile, your progress, the round or written answer you’re in the middle of, your last mock paper, and a short log of recent app errors, along with a note of which account that copy belongs to. It makes the site fast and lets it cope with a patchy connection. Signing out clears it, apart from any answers that haven’t reached us yet, which are sent the next time you sign in. Your device also remembers your theme and sound settings. Clearing your browser data removes all of it.

You won’t see a cookie pop-up on this site, because we don’t use the things pop-ups exist to ask about: no third-party analytics, no advertising trackers, and no tracking identifiers saved to your device. We do count visits ourselves. A random identifier, held only in your browser’s memory while you’re on the site and never saved to your device, lets us count how many visits our pages get each day. The lasting record holds just the date, that random identifier, a count of pages viewed, and whether the visit answered the sample question on our home page or reached our sign-up or payment step - no name, email, account link, answer or browsing history - and the counts are never shared with anyone else.

We count how our flashcards are used in the same spirit: for each day and topic, how many times the cards were opened, turned over or printed, on the website or in an app, whether the reader was signed in, and which of our pages they came from. It is a tally, so it holds nothing about who, and nothing is saved to your device to make it.

When a subscription is set up, Stripe’s payment form sets its own cookies, which Stripe uses to prevent fraud. They are part of paying safely and are covered by Stripe’s privacy policy.

Some Learn pages have a video lesson from our YouTube channel. Nothing from YouTube loads until you press play: the picture you see first is our own copy. When you press play, the video plays in YouTube’s player, which sends your device’s IP address to YouTube and can store its own identifiers in your browser. We don’t send YouTube anything about you or your account. What YouTube does with it is covered by Google’s privacy policy.

We may update this policy as the service changes. We’ll post the current version here and update the review date below; significant changes will be highlighted.