Privacy policy

Gist is a UK-based GCSE revision app. This page explains what personal data we collect, why, and what your rights are. Plain English first; legal precision second.

Who we are

Gist is currently a non-commercial personal project run by a UK-based individual. There is no registered company, no paid staff, and no commercial activity. If this changes — for example if paid subscriptions are introduced — this page will be updated and existing users notified at next sign-in. For now, the project's owner is the data controller for the personal data described below. To exercise any of the rights set out on this page, contact: hello@gist.example.

What we collect

• Account data: username and password (hashed, never stored as plain text).
• Revision activity: questions you've attempted, your answers, mastery scores per topic, exam-paper submissions and working you've written.
• Preferences: exam board, subjects, target exam dates, dark mode, notes you save in the Notes panel (stored only in your browser's local storage; we never see these).
• Technical data: IP address (for rate-limiting and abuse prevention), browser type, and timestamps. Used for security only.

What we don't collect

• We do not require your real name, school name, date of birth, or postal address.
• We do not use third-party analytics or advertising trackers.
• We do not sell your data — ever.

Why we hold it (lawful basis)

We process your account data and revision activity under contract (UK GDPR Article 6(1)(b)) — it's how the product works. Technical data for rate-limiting is processed under legitimate interests (Article 6(1)(f)) to keep the service secure.

How long we keep it

Your data is kept as long as your account is active. You can delete your account from your profile page at any time — deletion is immediate and permanent across our systems within 30 days (backups are purged on their normal rotation).

Your rights

Under UK GDPR, you have the right to:

• Access — download a copy of everything we hold on you. Use the data export link in your profile.
• Erasure — delete your account and all associated data. Use the delete account link in your profile.
• Rectification — correct anything inaccurate. Email us.
• Portability, restriction, objection — exercise these by emailing hello@gist.example.
• Complain to the ICO — if you're not satisfied with our response, the UK Information Commissioner's Office is at ico.org.uk.

Where your data lives

Our servers are hosted in the United Kingdom and the European Union. We do not transfer personal data outside the UK/EEA.

Under-13s

Gist is intended for GCSE students (typically aged 14–16). If you are under 13, please ask a parent or guardian to set up the account on your behalf and supervise its use. See our safeguarding statement.

Changes to this policy

We'll update the date at the top of this page whenever the policy changes, and flag material changes to existing users by email or a banner when you next sign in.