Privacy Policy

DoRevision is a free revision platform for students and teachers, run from the United Kingdom. This policy explains what personal data we collect, why we collect it, who we share it with and what choices you have. We have tried to write it in plain English. If anything is unclear, email us at [email protected].

1. Who we are

DoRevision ("we", "us", "our") is the controller of the personal data described in this policy, which means we decide how and why it is used. We are based in the United Kingdom and follow the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

You can contact us about anything in this policy at [email protected].

2. What we collect

You can use most of DoRevision without an account. When you do create one, or use certain features, we collect:

• Account details: your name, email address and a hashed password (we never store the password itself), and your role: student or teacher.
• Optional profile details: a username, an emblem, your school or college, and your public-profile settings. You choose whether to add these.
• Revision activity: which modules and steps you have worked through, your answers and how many attempts each took, points, streaks, trophies, time spent revising, and any ratings you give a module.
• Friends and invites: friend links you accept and invite links you share. If you sign up through a friend's invite link, a short-lived cookie tells us who invited you so we can connect you.
• Parent or carer contacts: if a student adds a parent or carer's email address for progress updates, we store that address. We only send updates once the parent or carer has confirmed the address themselves, and every message includes an unsubscribe link.
• Newsletter sign-ups: your email address, an optional name, and delivery records such as confirmation, unsubscribe and bounce events.
• Reports and feedback: anything you tell us when you report a step, a module or another user, and any emails you send us.
• Security records: the IP address and browser details of login attempts, and whether each attempt succeeded. We keep these to spot attacks on accounts.
• Usage records: which pages are viewed and which searches are run. These are stored against a one-way hashed session fingerprint, not your name or IP address, so they cannot be traced back to you.
• Security features you turn on: if you enable two-factor authentication or a passkey, we store the secret or public key needed to check it. Recovery codes are stored encrypted.

3. How we use your data and why we are allowed to

UK GDPR requires a lawful basis for each use. Ours are:

We do not sell your personal data, and we do not use it to make automated decisions that have a legal or similarly significant effect on you.

4. What other people can see

By default your profile is private. Only you (and, if you have one, a parent or carer you have added) can see your progress. If you choose to make your profile public, your username, emblem, chosen name, school (if you have opted to show it), completed modules, streaks, trophies and revision statistics become visible to anyone with the link, appear on the leaderboard and may be listed by search engines. Teachers who share a collection make that collection's name and contents public. You can reverse any of these choices in your settings.

5. Cookies and advertising

We use a small number of essential cookies to keep you logged in and protect forms from forgery, and we use Plausible, a cookieless analytics tool, to count page views without identifying you. Full details, including cookie names and lifetimes, are in our Cookie Policy.

Google advertising cookies and third-party advertising

DoRevision is free, and advertising helps cover its running costs. We use Google AdSense to show adverts on some pages. When adverts are shown:

• Google and its partner advertising networks act as third-party vendors and may use cookies, web beacons or similar technologies to serve ads based on your prior visits to DoRevision and to other websites.
• Google's use of advertising cookies (including the DoubleClick cookie) enables it and its partners to serve ads to you based on your visit to our site and other sites on the internet.
• Advertising cookies may collect your IP address, information about your browser and device, the pages you view and the ads you interact with. Google processes this data under its own privacy policy for partner sites.
• You can opt out of personalised advertising from Google at Google Ads Settings, and from many other vendors at youronlinechoices.com or aboutads.info.
• Google does not show personalised ads to users it knows to be under 18, and we ask Google to keep ads on DoRevision suitable for a school-age audience. Where ads are non-personalised, they are chosen using only the page you are looking at and coarse location, not your browsing history.
• We do not pass your name, email address, account details or revision history to any advertiser.

Advertisers and advertising networks are separate businesses. Their websites and their use of your data are governed by their own policies, so please read those before giving them any information.

6. Who we share data with

We share personal data only with the services we need to run DoRevision, and only what each one needs:

• Hosting: our servers are provided by Hetzner and located in the European Union (Finland).
• Email delivery: a transactional email provider sends account emails, parent updates and newsletters on our behalf.
• Bot protection: Cloudflare Turnstile checks that sign-up and login forms are being used by a person. It receives technical information about your browser and connection.
• Advertising: Google AdSense, as described in section 5.
• Analytics: Plausible Analytics, which is cookieless and does not collect personal data.
• Authorities: we may disclose data where the law requires it, or where it is necessary to protect someone from harm.

Some of these providers, notably Google, process data outside the UK. Where that happens we rely on the UK Government's adequacy regulations, the UK Extension to the EU-US Data Privacy Framework, or the UK International Data Transfer Agreement, so your data keeps the same protection it has here.

7. How long we keep data

• Accounts you never verify are deleted automatically 30 days after sign-up.
• Active accounts are kept for as long as you use DoRevision.
• Deleted accounts: when you delete your account it is flagged for deletion straight away, then permanently removed after a three-month grace period. During that period you can email us to reverse the deletion. Anonymised, aggregated statistics (for example how many students completed a module) may be kept because they no longer identify you.
• Parent and carer contacts are removed when you remove them, when the parent unsubscribes, or when your account is deleted.
• Newsletter records are kept while you are subscribed. Once you unsubscribe we keep your address on a suppression list so we do not email you again.
• Security and usage records are kept only for as long as we need them to protect the service and are then removed.

8. Children and young people

DoRevision is designed for students aged 13 and over. You must be at least 13 to create an account. If you are under 13, please ask a parent or carer to contact us before using the site with an account. If we learn that we hold an account for a child under 13 without a parent or carer's involvement, we will delete it.

We keep the data we collect from young people to the minimum the service needs, we never show personalised adverts to users Google identifies as under 18, and we do not allow anyone to message another user through the site. Parents and carers can email [email protected] with any question about their child's account.

9. Your rights

Under UK data protection law you have the right to:

• Access the personal data we hold about you and receive a copy of it.
• Correct anything that is inaccurate. You can change your name, email, username and school in your settings.
• Delete your data. You can delete your account from your settings, or ask us to.
• Restrict or object to certain processing, including anything we do on the basis of legitimate interests.
• Take your data with you in a portable format.
• Withdraw consent at any time, for example by making your profile private, removing a parent contact or unsubscribing from emails.

To use any of these rights, email [email protected] from the address on your account. We will reply within one month. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk, although we would appreciate the chance to put things right first.

10. Keeping your data safe

All traffic to DoRevision is encrypted with HTTPS. Passwords are stored as one-way hashes. You can add two-factor authentication or a passkey to your account, and we will email you about important security changes such as a new email address or a password reset. No online service can promise perfect security, so please use a strong, unique password and keep it to yourself.

11. Changes to this policy

We will update this page when our practices change and update the date at the top. If a change is significant, for example a new way of using your data, we will let account holders know by email or by a notice on the site before it takes effect.