Privacy Policy

Last updated: 24 October 2026

Who we are

StudyVault is a GCSE revision website run by StudyVault Education Ltd, a company registered in England and Wales (company number 17490559), registered office 71–75 Shelton Street, London WC2H 9JQ. Its director is Tom Shaun. StudyVault Education Ltd is the data controller for the information described here, except where a school is the controller (see below). This privacy policy explains what information we handle when you use the site, why, and what you can do about it.

Our approach to privacy

StudyVault is designed for GCSE students aged 14–16 and is built with the ICO's Age Appropriate Design Code (Children's Code) in mind. You can use the whole free site without an account, and when you do choose to sign in we ask for the least we can and use it only to run the service. There are no adverts and no tracking across other sites, and we never sell or share personal data.

Using StudyVault without an account

• Nothing personal. We do not collect names, email addresses or any other personal information. Your chosen subjects, exam boards and progress are stored in your browser's local storage on your own device; we cannot see them, and they are lost if you clear your browser data.
• Anonymous analytics. We use Vercel Web Analytics for aggregated visit counts (page views, country). It sets no cookies and uses no identifiers. We also count how the site’s features are used — for example how many flashcard sessions were started each day — in totals that identify no one, so we can improve them. Only the day and the feature are recorded, with no cookie or identifier, whether or not you are signed in.
• Optional forms. The bug button and the subject-request panel let you add an email address if you want a reply. It is kept with that one report so we can answer you, and used for nothing else. Bug reports may include a screenshot of the page you were on, which you can turn off before sending. The subject picker also invites you to name your school; if you do, we record only the school name and a timestamp.

Free accounts

You can create a free account so that your subjects and progress follow you between devices. If you do, we hold:

• Your email address and a password (the password is stored only as a secure hash).
• Your first name, if you chose to give it.
• Your chosen subjects, exam boards, topics, tier and how you rated each topic.
• Your progress: lessons visited and finished, knowledge-check and quiz scores, flashcard progress, practice answers you submitted for AI marking together with the feedback you received, revisit results, and your accessibility settings.

This is used to save and restore your revision and for nothing else. It is not used for marketing, not shared with anyone, and not used to train AI models. Accounts are provided through Supabase, and the database is hosted in London (Amazon Web Services, eu-west-2). A session token in your browser keeps you signed in.

School accounts

Some schools subscribe to StudyVault for their own tailored content. Students at those schools sign in with the Google or Microsoft account their school already gave them; there is no separate StudyVault password. From that sign-in we receive your name, your school email address and the fact that you belong to the school, and we hold the same progress data described above under your school's account.

Teachers at your school can see attainment: which lessons you have completed, your quiz and practice results, and the questions and flashcards you keep getting wrong. They cannot see when or for how long you revise, and StudyVault does not set homework or deadlines. Teachers have their own accounts (name, email, the subjects they teach). The school is the data controller for its students' information; StudyVault processes it on the school's behalf under a written agreement with the school, which covers retention and deletion.

Cookies

StudyVault sets no advertising or tracking cookies. Signing in stores a session token in your browser so you stay signed in; signing out removes it. Analytics are cookieless.

Advertising

StudyVault carries no advertising, on the free tier or anywhere else, and uses no advertising cookies or tracking.

AI tools

When you use an optional AI study tool — “Simplify language”, “Explain it differently”, the lesson tutor, or AI feedback on a practice answer — the relevant lesson text (or your typed answer) is sent to be processed by a Claude model running on Amazon Web Services in the UK and the EU: requests go to AWS in London (eu-west-2), which may serve them from its EU data centres. The text stays inside the UK and EU, under UK GDPR and the EU GDPR. No name, account or identifying information is attached to these requests, and the text is not used to train models. The model is made by Anthropic, but it runs on AWS infrastructure and Anthropic has no access to it. If the UK and EU service is unavailable the tool stops working rather than sending your text anywhere else. If you are signed in, your answer and the feedback are saved to your account as described above.

Counting answers to improve questions

We count the answers pupils give to practice questions, without any name or account attached, to find and fix faulty questions and improve feedback. For each question we keep only the answer as given (short answers and chosen options), whether it was marked right, and how many times it has been given; for longer written answers we keep only the mark, never the writing. Nothing links a count to a person, school, device or time, anything that looks like personal information is discarded, and nothing is counted for an answer our safeguarding check has flagged.

Third-party services

• Vercel hosts the website and provides anonymous, cookieless analytics. Vercel's Privacy Policy
• Supabase provides accounts, sign-in and the database, hosted in London (AWS eu-west-2). Supabase's Privacy Policy
• Google and Microsoft provide sign-in for school accounts; we receive only the name, email and school membership described above.
• Amazon Web Services (Bedrock) runs the AI study tools in the UK and EU, as described above. It also checks the answers typed into flashcards, and finds the closest lesson when the words typed into the search bar match no lesson title. Only the card or the list of your subjects’ lessons, and the typed words, are sent, with no name or account attached. AWS Privacy Notice
• Cloudflare R2 stores and delivers media files (images, audio, video), and holds a screenshot attached to a bug report until the report is closed.
• Backblaze B2 keeps our encrypted weekly backup of the database and a backup copy of the media files, in the EU (Amsterdam). Bug-report screenshots are not backed up. Backblaze's Privacy Policy
• Resend (based in the United States) delivers bug reports and subject requests to us by email, and sends teachers a short notice with a link when a new class summary is ready. The notice carries no pupil names or results; teachers read the summary signed in.
• Google Fonts provides typefaces used on the site. Google's Privacy Policy

How long we keep data

Account data is kept while your account exists. You can delete your account, and everything held under it, by emailing us from the address on the account; we complete deletions within 30 days. School students' data is kept for as long as the school's agreement says and deleted at the school's request or when the subscription ends. A screenshot attached to a bug report is deleted as soon as the report is closed, and the report itself 30 days later. Subject requests are deleted once dealt with. The anonymous answer counts identify no one, so they are kept for as long as the questions they describe; the daily feature totals identify no one either and are kept for as long as the features exist. Web server logs are deleted automatically. Deleted data can stay in our encrypted database backups for up to 8 weeks, after which the backups are deleted automatically.

Data we do not collect

• Precise location, device identifiers or fingerprinting data
• Browsing habits or behaviour profiles, on StudyVault or elsewhere
• Payment details (schools are invoiced; students never pay)
• Anything beyond what is listed above

Children's privacy

StudyVault is for students aged 14–16. No account is needed to use it, an account asks only for an email address and a password, and school accounts are set up by the school. Parents and carers can ask us to show or delete anything held about their child by contacting the address below; for school accounts, contact the school.

Your rights

Under UK GDPR you have the right to see the personal data we hold about you, to have it corrected or deleted, and to complain to the Information Commissioner's Office (ico.org.uk). Email us and we will respond within one month.

Changes to this policy

We may update this policy from time to time. The "last updated" date at the top of this page will reflect any changes.

Contact

If you have questions about this privacy policy, contact:
studyvault.info@gmail.com