DoRevision is a free revision platform for students and teachers, run from the United Kingdom. This policy explains what personal data we collect, why we collect it, who we share it with and what choices you have. We have tried to write it in plain English. If anything is unclear, email us at [email protected].
1. Who we are
DoRevision ("we", "us", "our") is the controller of the personal data described in this policy, which means we decide how and why it is used. We are based in the United Kingdom and follow the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
You can contact us about anything in this policy at [email protected].
2. What we collect
You can use most of DoRevision without an account. When you do create one, or use certain features, we collect:
- Account details: your name, email address and a hashed password (we never store the password itself), and your role: student or teacher.
- Optional profile details: a username, an emblem, your school or college, and your public-profile settings. You choose whether to add these.
- Revision activity: which modules and steps you have worked through, your answers and how many attempts each took, points, streaks, trophies, time spent revising, and any ratings you give a module.
- Friends and invites: friend links you accept and invite links you share. If you sign up through a friend's invite link, a short-lived cookie tells us who invited you so we can connect you.
- Parent or carer contacts: if a student adds a parent or carer's email address for progress updates, we store that address. We only send updates once the parent or carer has confirmed the address themselves, and every message includes an unsubscribe link. The student is also sent their own copy of each weekly update, so they can see what was shared.
- Mobile number: if you choose to add one for text reminders, we store your mobile number, whether it has been confirmed, and whether you have turned text reminders on. It is never shown on your profile and is never used to sign in or reset your password.
- Newsletter sign-ups: your email address, an optional name, and delivery records such as confirmation, unsubscribe and bounce events.
- Reports and feedback: anything you tell us when you report a step, a module or another user, and any emails you send us.
- Security records: the IP address and browser details of login attempts, and whether each attempt succeeded. We keep these to spot attacks on accounts.
- Usage records: which pages are viewed and which searches are run. These are stored against a one-way hashed session fingerprint, not your name or IP address, so they cannot be traced back to you.
- Security features you turn on: if you enable two-factor authentication or a passkey, we store the secret or public key needed to check it. Recovery codes are stored encrypted.
3. How we use your data and why we are allowed to
UK GDPR requires a lawful basis for each use. Ours are:
| What we do | Lawful basis |
|---|---|
| Run your account, save your progress, show your points, streaks and completed modules | Performing our agreement with you (the Terms of Use) |
| Show a public profile, leaderboard position or shared collection | Your consent. Profiles are private until you switch them on, and you can switch them off at any time |
| Send progress updates to a parent or carer | Your request and the parent or carer's consent, given by confirming their email address |
| Send our newsletter and revision reminders | Your consent. Every email has an unsubscribe link |
| Send revision reminders by text message | Your consent, given by adding your mobile number and turning text reminders on. You can turn them off or remove your number in your settings at any time |
| Send service emails such as verification, password resets, security alerts and important changes | Performing our agreement with you |
| Keep accounts secure, prevent abuse, detect bots and fix bugs | Our legitimate interest in running a safe, working service |
| Understand which pages and modules are used, so we can improve the content | Our legitimate interest, using anonymised usage records and cookieless analytics |
| Respond to reports, safeguarding concerns and legal requests | Legal obligation and our legitimate interest in keeping users safe |
We do not sell your personal data, and we do not use it to make automated decisions that have a legal or similarly significant effect on you.
4. What other people can see
By default your profile is private. Only you (and, if you have one, a parent or carer you have added) can see your progress. If you choose to make your profile public, your username, emblem, chosen name, school (if you have opted to show it), completed modules, streaks, trophies and revision statistics become visible to anyone with the link, appear on the leaderboard and may be listed by search engines. Teachers who share a collection make that collection's name and contents public. You can reverse any of these choices in your settings.
5. Cookies and advertising
We use a small number of essential cookies to keep you logged in and protect forms from forgery, and we use Cloudflare Web Analytics, a cookieless analytics tool, to count page views without identifying you. Full details, including cookie names and lifetimes, are in our Cookie Policy.
DoRevision does not show adverts and does not use advertising or tracking cookies. We do not sell personal data, and we do not pass your name, email address, account details or revision history to any advertiser.
6. Who we share data with
We share personal data only with the services we need to run DoRevision, and only what each one needs:
- Hosting: our servers are provided by Hetzner and located in the European Union (Finland).
- Email delivery: a transactional email provider sends account emails, parent updates and newsletters on our behalf.
- Text messages: Amazon Web Services (AWS End User Messaging) sends text reminders on our behalf from its London region. It receives only your mobile number and the message text.
- Bot protection: Cloudflare Turnstile checks that sign-up and login forms are being used by a person. It receives technical information about your browser and connection.
- Analytics: Cloudflare Web Analytics counts page views. It receives the page address, the site that linked you there and basic information about your browser, device and how fast the page loaded. It sets no cookies, stores nothing in your browser and is not used to identify you.
- Authorities: we may disclose data where the law requires it, or where it is necessary to protect someone from harm.
Some of these providers may process data outside the UK. Where that happens we rely on the UK Government's adequacy regulations, the UK Extension to the EU-US Data Privacy Framework, or the UK International Data Transfer Agreement, so your data keeps the same protection it has here.
7. How long we keep data
- Accounts you never verify are deleted automatically 30 days after sign-up.
- Active accounts are kept for as long as you use DoRevision.
- Deleted accounts: when you delete your account it is flagged for deletion straight away, then permanently removed after a three-month grace period. During that period you can email us to reverse the deletion. Anonymised, aggregated statistics (for example how many students completed a module) may be kept because they no longer identify you.
- Parent and carer contacts are removed when you remove them, when the parent unsubscribes, or when your account is deleted.
- Your mobile number is kept until you remove it in your settings or delete your account. Removing it also turns text reminders off.
- Newsletter records are kept while you are subscribed. Once you unsubscribe we keep your address on a suppression list so we do not email you again.
- Security and usage records are kept only for as long as we need them to protect the service and are then removed.
8. Children and young people
DoRevision is designed for students aged 13 and over. You must be at least 13 to create an account. If you are under 13, please ask a parent or carer to contact us before using the site with an account. If we learn that we hold an account for a child under 13 without a parent or carer's involvement, we will delete it.
We keep the data we collect from young people to the minimum the service needs, we do not show adverts, and we do not allow anyone to message another user through the site. Parents and carers can email [email protected] with any question about their child's account.
9. Your rights
Under UK data protection law you have the right to:
- Access the personal data we hold about you and receive a copy of it.
- Correct anything that is inaccurate. You can change your name, email, username and school in your settings.
- Delete your data. You can delete your account from your settings, or ask us to.
- Restrict or object to certain processing, including anything we do on the basis of legitimate interests.
- Take your data with you in a portable format.
- Withdraw consent at any time, for example by making your profile private, removing a parent contact or unsubscribing from emails.
To use any of these rights, email [email protected] from the address on your account. We will reply within one month. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk, although we would appreciate the chance to put things right first.
10. Keeping your data safe
All traffic to DoRevision is encrypted with HTTPS. Passwords are stored as one-way hashes. You can add two-factor authentication or a passkey to your account, and we will email you about important security changes such as a new email address or a password reset. No online service can promise perfect security, so please use a strong, unique password and keep it to yourself.
11. Changes to this policy
We will update this page when our practices change and update the date at the top. If a change is significant, for example a new way of using your data, we will let account holders know by email or by a notice on the site before it takes effect.