Privacy Policy

The Grade Booster service provider is the controller for personal data used to operate direct student accounts. Privacy questions and rights requests can be sent to support@gradebooster.app.

We store account details provided by Clerk, such as user ID, email address, and profile name where available.

We store revision settings including selected subjects, exam boards, tiers, Quick Fire subject, and theme preference.

We store revision activity including quiz attempts, answers, scores, active quiz state, progress, streak data, and weak-topic records.

For signed-in users, we store basic product usage such as pages and features visited so we can find confusing or unused parts of the service. This tracking does not store question answer text.

If you send feedback, we store its rating, message, page and prompt context. We do not ask for date of birth, precise location, school name, special-category data, or advertising profiles.

We use account, course and revision data to provide the account and the revision service the user asks for. The lawful basis is performance of a contract or taking steps at the user's request before entering one.

We use limited security, rate-limit and signed-in feature-use data to prevent misuse, keep the service reliable and improve the beta. The lawful basis is our legitimate interests, balanced against users' rights and the best interests of children.

We use feedback to investigate a report and improve or support the service. The lawful basis is legitimate interests. We may process information where needed to meet a legal obligation.

Core account and progress processing does not rely on consent. Grade Booster currently has no optional advertising or analytics-cookie processing. If optional consent-based processing is introduced, it must remain off until valid consent is obtained and the under-13 Article 8 position has been addressed.

Vercel hosts and delivers the web application. Neon/Postgres stores application data. Clerk provides authentication and session management.

Discord receives private feedback notifications containing the feedback ID, rating, page, prompt context, message, and time. The notification does not include the account name or email address.

Cloudflare Web Analytics measures aggregate visits to public pages without analytics cookies. It is not used to track signed-in revision activity.

Resend processes business-contact details only when an administrator sends an individual school outreach email. It is not used for student revision accounts unless a separate service email is sent.

Some providers may process data outside the UK. Where required, Grade Booster must use an adequacy regulation or an appropriate transfer mechanism such as the UK International Data Transfer Agreement or UK Addendum, with a transfer risk assessment where required.

Essential cookies and similar technologies are used for authentication, security, saved preferences, and core app features.

Grade Booster does not use analytics cookies. Cloudflare Web Analytics provides cookie-free aggregate traffic measurement on public pages.

Signed-in product usage is recorded against the account in our database without using analytics or advertising cookies.

Because current browser storage is strictly necessary for the requested service, Grade Booster explains it but does not show a consent banner with a choice that cannot meaningfully be refused.

Quiz results are used to calculate progress, identify weak topics and recommend what to revise next. This is limited educational personalisation, not advertising profiling.

Grade Booster does not make solely automated decisions that produce legal or similarly significant effects, and it does not sell or share profiles for advertising.

Users can ask to access, correct, export, erase or restrict personal data, object to legitimate-interest processing, and withdraw consent where consent applies. Some rights depend on the lawful basis and legal requirements.

Signed-in users can export or delete account data from Settings. Privacy requests can also be sent to support@gradebooster.app.

Children have the same data-protection rights as adults and can exercise them themselves where they understand the request. A parent or guardian may help.

Users may complain to the Information Commissioner's Office if they are unhappy with how a privacy request is handled. The ICO complaint route is linked below.

We keep account and progress data while the account is active. Account deletion removes the live application records linked to that account.

Product usage records, XP records and feedback are retained with the account while needed to provide, secure and improve the beta, and are included in export or removed on account deletion. Feedback may be removed earlier when it is no longer needed.

Where Discord returned a message ID, account deletion also requests deletion of the matching private Discord notification.

Service providers may retain secure backups for a limited period under their own retention and security processes.

We use authentication, protected routes, user ownership checks, and database relations to keep user data separate. We do not sell personal data.