Privacy Policy

1. The short version

The rest of this page is the detail behind those two sentences.

2. What we collect

When you create an account

• your email address — this is how you sign in;
• your name;
• whether you are a parent or a student.

When a parent adds a student

• the student’s name and grade;
• the level the placement test put them at.

That is all. We do not ask for a date of birth, a home address, a school name, a photograph or a phone number for a student.

As the course is used

• which worksheets, questions and practice tests were done, and when;
• the answers given and whether they were right;
• scores, progress through topics, and which sections have been unlocked.

When you pay

• which product was bought, the amount, the currency and the date;
• the PayPal order or subscription reference;
• for card payments, the card brand and the last four digits only — enough to recognise a payment on a statement, and nothing more.

Card numbers, expiry dates and security codes go to PayPal and never reach us.

When you book a session

• your name and email, the date and time, and any note you add to the booking.

3. What we deliberately do not collect

• No analytics. No Google Analytics, no Meta pixel, no heatmaps, no session recording, nothing of that kind.
• No advertising. We do not run ads and do not share data with any advertising network.
• No tracking across other sites. We cannot see where you have been and do not try to.
• No stored IP addresses. Your IP address is used for a few seconds in memory to stop the same address hammering a form, and is not written to our database.
• No full card details. See above.
• No selling of data. Not to anyone, for any amount, at any time.

4. Why we hold it

• To let you sign in — the email address is the account.
• To run the course — a course that unlocks as a student progresses has to remember what they have done.
• To show a parent their child’s progress, which is a core feature of the self-guided course.
• To take payment and give the right access — which course was bought decides what opens.
• To email you about your account: sign-in links, payment confirmations, and booking confirmations. We do not send marketing email.

5. Students under 18

A parent or legal guardian creates the account and agrees to the terms. The account is theirs; the student works under it.

We hold the minimum about a child that a course can run on: a name, a grade, and the work they have done. We do not knowingly collect personal information from a child under 13 without a parent setting up the account, and we do not use any child’s data for advertising or profiling of any kind.

A parent or guardian can at any time ask to see everything we hold about their child, have it corrected, or have it deleted. Ask at the address below and we will do it.

6. Who else sees it

Three kinds of people or companies, and no others:

• PayPal, to take payment. They receive what a payment needs and are covered by their own privacy policy.
• Our email provider, to deliver sign-in links and confirmations. They see the address the email goes to.
• Us — the tutor, who reads student progress in order to teach.

We will disclose information if the law requires it — a court order, for example. We will tell you if that happens unless we are forbidden from doing so.

If the business is ever sold or transferred, account data may move with it. You would be told first, and this policy would continue to apply until you were given notice of a new one.

7. Cookies

One cookie. It is called ha_session, it holds a random session reference and nothing else, and it exists so that you stay signed in between pages. It is marked HttpOnly and SameSite=Strict, which means scripts cannot read it and it is not sent to other sites.

There are no advertising cookies, no analytics cookies and no third-party cookies set by us. Clearing it signs you out. PayPal may set its own cookies on the pages where you pay; that is governed by their policy.

8. How long we keep it

• Account and progress data — while the account exists, so a student can pick up where they left off after a break. Ask and we will delete it sooner.
• Sign-in links — they expire shortly after being sent and are stored only as a hash, never as the link itself.
• Payment records — kept as long as tax and accounting rules require, which is longer than the account may last.
• Bookings — kept as a record of sessions given.

9. Seeing, correcting or deleting your data

Email us and we will, without charge:

• tell you what we hold about you or your student;
• send you a copy of it;
• correct anything wrong;
• delete the account and the data on it.

Deleting an account removes the progress with it and cannot be undone. Payment records are kept where the law requires, with the rest removed.

Depending on where you live you may have further rights — for example under the California Consumer Privacy Act or, in Europe, the GDPR. Ask and we will honour them.

10. How it is protected

• Sign-in tokens and session tokens are stored hashed, so the database does not contain anything that could be used to sign in as you.
• Passwords are stored hashed with scrypt, each with its own random salt. We never see your password and cannot recover it — if you forget it, we send you a link to set a new one rather than telling you the old one.
• You can also sign in by emailed link without a password at all, which is how the site worked before passwords existed and how you get back in if you forget yours.
• Traffic to the site is encrypted in transit.
• Access to the database is limited to the tutor.

No system is perfectly secure. If a breach ever affects your data, we will tell you promptly and say plainly what happened.

11. Changes

If we change this policy we will update the date at the top. If a change materially affects how your data is used, we will email you before it takes effect.

12. Contact

See also the Terms of Service and the Refund & Cancellation Policy.