Legal
Privacy Policy
A practical notice for students, teachers, and visitors using TheStudyStack.
Last updated: 25 April 2026
Who we are
TheStudyStack provides GCSE revision tools for students and teachers. This notice explains how TheStudyStack uses personal data when you browse the public site, create an account, join a class, or use revision features.
Personal data we collect
- -Account data, including your email address, username, first name, last name, role, school, and authentication identifiers.
- -Learning data, including flashcard progress, quiz answers, exam-question responses, past-paper attempts, achievements, XP, streaks, class memberships, assignments, and live quiz participation.
- -Teacher and classroom data, including classes created, join codes, invite links, assignments, live quiz sessions, reports, and student-facing display names.
- -Social data, including friend requests, friendships, clan membership, clan challenges, and any activity you choose to share with friends.
- -Technical data, including session identifiers, device and browser data, security logs, rate-limit records, preferences, and error or recovery state needed to run the service.
Why we use personal data
- -To provide the service, authenticate users, save revision progress, operate classes, and show the correct learning content.
- -To support classroom workflows, including class membership, assignments, live quizzes, reports, and teacher administration.
- -To keep the platform safe, prevent abuse, troubleshoot errors, and protect accounts.
- -To remember user preferences and improve the product based on aggregated or operational usage patterns.
- -To comply with legal obligations and respond to rights requests.
Lawful bases
- -Contract: to create and manage accounts and provide requested revision and classroom features.
- -Legitimate interests: to secure the service, prevent misuse, maintain reliability, and improve the platform in a proportionate way.
- -Legal obligation: to handle compliance, safeguarding, accounting, or regulatory requests where applicable.
- -Consent: where optional cookies, marketing, or non-essential tracking are introduced. The current app should not rely on non-essential tracking without consent.
Students and children
TheStudyStack is designed for GCSE learners, so privacy defaults are deliberately conservative. Social discovery and friend progress sharing are off by default and can be enabled from account settings. Teachers should only invite students where they have the authority to use the service for their class.
Who we share data with
- -Clerk, for authentication and account management.
- -Convex, for application data storage and backend functions.
- -Vercel and related hosting infrastructure, for delivering the web app.
- -Teachers or schools, where a student joins a class and the data is needed for classroom features.
- -Authorities or professional advisers, where required by law or needed to protect rights, safety, and security.
International transfers
Some providers may process data outside the UK or EEA. Where that happens, TheStudyStack should rely on appropriate safeguards such as adequacy regulations, standard contractual clauses, or equivalent processor commitments.
How long we keep data
We keep account and learning data while the account is active. Users can delete their account from settings, which triggers removal of account-linked study, social, classroom, and progress records. Some records may be retained for a limited period where required for security, legal compliance, backups, or dispute handling.
Your rights
Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or receive a copy of your personal data. You may also have the right to complain to your local data protection authority, such as the UK Information Commissioner's Office.
Contact
Privacy requests can currently be made through the account owner, teacher, or school contact that invited you to TheStudyStack. A dedicated public privacy contact should be added before a wider public launch.