Get Started

Legal

Privacy Policy

How we use personal data about students, teachers and visitors.

Last updated: 28 September 2026

The short version

  • -We only collect what we need to run your revision and your classes.
  • -If your school gave you your account, or you are in a class, your school is in charge of your class data. Your teachers can see your work, marks and progress in their classes.
  • -Other students only ever see your username and avatar, never your real name or email.
  • -Friends are off unless you turn them on, and are not available in Years 7 to 9 or on accounts your school made. Class clans only happen if your teacher sets them up.
  • -No adverts, no selling data, no tracking you around the web.
  • -AI can suggest marks for some written answers and checks that usernames and clan names are suitable. It never gets your real name, and nobody trains AI on your work.
  • -You can ask to see, fix or delete your data. Ask your teacher or email privacy@thestudystack.co.uk.

1.Who we are

TheStudyStack is run by Liam McClean, a sole trader in the United Kingdom. It gives students revision tools and gives teachers classes, homework, live lessons and live quizzes for GCSE and Key Stage 3 computing courses.

For anything in this policy, email privacy@thestudystack.co.uk. We are small enough that we have not appointed a formal Data Protection Officer, so the person who answers is the person responsible for how your data is handled.

2.When your school is in charge

When a school uses TheStudyStack, the school is the controller of the data about its classes and pupils and we are its processor. We only use that data to provide the service to the school, following our data processing terms for schools. This covers:

  • student accounts that a teacher created for the school
  • teacher accounts linked to the school
  • everything that happens in a class: membership, homework and assignments, submitted answers, marks, feedback and comments, live lessons, live quizzes, typing classes, teacher notes and class reports

The school's own privacy notice explains its lawful basis, which for state schools is usually public task. Questions or requests about school data are best sent to the school. If you send them to us, we will pass them on and help the school answer.

3.When we are in charge

We are the controller for:

  • accounts that people create for themselves
  • revision you do on your own outside a class: flashcards, quizzes, practice questions, past papers, coding challenges, CS Labs games and study plans
  • friends, XP, gems, streaks and achievements
  • security records and the public website

The rest of this policy explains how we handle this data.

4.What we collect

  • -Account details: first and last name, username, email address (school accounts made by a teacher do not need one), whether you are a student or teacher, year group, school name, the avatar you pick from our set, and sign-in identifiers. We do not let you upload photos.
  • -Your learning: answers you type or draw, marks and self-marks, AI mark suggestions, flashcard, quiz and practice progress, coding and CS Labs progress, study plans, and typing practice (what you typed, speed, accuracy and key timings).
  • -Class data: class membership, assignments and submissions, feedback and comments between you and your teacher, live lesson answers and teacher notes, live quiz answers, scores and response times, typing adjustments a teacher sets for a student, and class reports.
  • -Social and rewards: friends and friend requests, activity you choose to share with friends, class clans and their names, XP, gems, streaks, achievements and unlocked cosmetics.
  • -Security records: sign-in sessions, counters that stop the same account doing too many actions too quickly, a record of changes teachers make to school accounts, and a record of each deletion. Our sign-in provider, Clerk, processes IP address and device information to keep sign-in secure.
  • -What we do not collect: date of birth, home address, phone number, location, or health, religion and other special category data. Please do not put this kind of information in answers, notes or comments.

5.Where the data comes from

  • -From you, when you sign up, answer questions and use the site.
  • -From your teacher or school, when they create your account, add you to a class, mark your work, leave feedback or record notes during a lesson.
  • -From Clerk, our sign-in provider, when you sign in. If you sign in with Google or Microsoft, Clerk receives your name, email address and profile picture from that account.

6.Why we use it

For data we control, here is each use and the lawful basis under UK GDPR that allows it. Where a school is in charge, the school decides the purposes and we act on its instructions.

Create your account, save your progress and run the revision tools you use
Lawful basisContract for adults. For students under 18, legitimate interests: providing the service you chose to use
Friends and sharing activity with friends
Lawful basisConsent. Off until you turn it on, only from Year 10 and never on accounts a school created, and you can turn it off at any time
Suggest marks with AI when you ask for a check on your own answer
Lawful basisLegitimate interests: giving the feedback you asked for
Keep accounts secure, prevent misuse, check usernames and clan names are suitable, and fix errors
Lawful basisLegitimate interests
Improve questions and features using overall totals, such as how many people get a question wrong
Lawful basisLegitimate interests. We never build marketing profiles or train AI on your work
Protect a child at risk of harm, or respond to the police or a court
Lawful basisLegal obligation, or the recognised legitimate interest of safeguarding

Clerk sends sign-in codes and security emails. We do not send marketing emails, show adverts or sell data.

7.Who can see your data

  • -Your teachers: for students in their classes, your name, username, year group, avatar, progress, answers and marks. Teachers can download class results.
  • -Other teachers at your school: if your account was made by your school, any teacher there can see your first and last name, username, whether you have signed in and the names of your classes, and can reset its password, suspend it or delete it.
  • -Other students: only your username and avatar, on live quiz boards (your teacher can switch these to made-up names), class leaderboards (off unless your teacher turns them on), class clans, and friends lists if you turn friends on.
  • -Friends: if you turn on sharing, things like your streak and XP milestones.
  • -Us: access for support, security, reviewing flagged names and deleting accounts. Admin access needs a separate sign-in from an approved email address.
  • -Service providers who run parts of the service for us, listed below.
  • -Authorities: only where the law requires it or a child is at risk. If it involves a pupil, we will also tell the school's Designated Safeguarding Lead.

8.AI marking

  • -What it is: Jev, an AI model made by TypeSafe AI, Inc., reached through Vercel AI Gateway. It checks a written answer against the mark scheme and suggests which marking points it meets.
  • -What is sent: the question, its mark scheme and the answer text. No name, username, email, school, class or account ID is sent. Drawings are never sent.
  • -When it runs: when a student asks for a check on their own practice answer or past paper, when a teacher asks for a suggestion, or when a teacher sets an assignment to be marked by AI.
  • -Who decides: on practice questions the suggestion is advice, and your own self-mark is what gets saved. On assignments set to AI marking, marks can reach the student without a teacher checking each one first. Teachers can change any mark, and students can ask their teacher to review one. Marks are for learning and do not affect qualifications.
  • -Training: TypeSafe does not train or fine-tune its models on what we send, and neither do we. An identical answer to the same question reuses the earlier result for 14 days. That stored result does not record who wrote the answer.
  • -Name checks: Jev also checks new usernames and clan names are suitable for school. It gets only the name and where it will be shown, never who chose it. Its answer for a name is reused for up to 180 days. A name that fails a check, or is waiting to be checked, is kept with the account or clan so we can review it. If a student tries a name that suggests they may be at risk, we record the attempt even though the name is not saved. It is shown to the platform admin and to the student's class teacher, so the school can follow its safeguarding procedure.
  • -Class board answers: answers that appear on a class's shared board are checked against a word list on our own servers. They are not sent to AI. A flagged answer is kept off the board, and the teacher sees it and the reason so they can release it or follow their school's safeguarding procedure.

9.Service providers

These companies process personal data for us under written contracts that only let them use it to provide their service.

Clerk, Inc.
What they doSign-in and account security
DataName, username, email, password (hashed), avatar, profile picture if you sign in with Google or Microsoft, IP address and device details
LocationUnited States
Convex, Inc.
What they doDatabase and backend
DataAll account, learning and class data
LocationUnited States
Vercel Inc.
What they doHosting the website, and routing AI requests
DataWeb requests including IP address, and AI requests
LocationUnited States
TypeSafe AI, Inc.
What they doThe Jev AI model, for marking answers and checking usernames and clan names
DataQuestion, mark scheme and answer text, or a username or clan name, with no other identifiers
LocationUnited States

Schools get notice before we add or replace a provider. See data processing for schools.

10.International transfers

Our providers store and process data in the United States. Where a provider is certified under the UK Extension to the EU-US Data Privacy Framework, we rely on the UK's adequacy regulations for the United States. Otherwise we rely on the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses in that provider's data processing agreement, with a transfer risk assessment.

11.How long we keep it

  • -Accounts and revision: while the account is open. When an account is deleted, by you, your school or us, all linked records are removed, usually within minutes. This includes progress, answers, friends and class records.
  • -Class work: kept with the class until the teacher deletes the class, which deletes all its work while students keep their accounts, or until the student's account is deleted. If a student leaves a class, work they already handed in stays in the teacher's records.
  • -When a school stops using TheStudyStack: we delete the school's data, including its classes and the accounts it created, within 30 days of its request, or return a copy first if it asks. Teacher accounts linked to the school are deleted too, unless the school asks us to keep them. Students who made their own accounts keep them.
  • -AI marking results: the shared store of results is kept for about 14 days, with no link to who wrote the answer. A suggestion shown on your own practice answer is saved with that answer while your account is open.
  • -Deletion records: the account and sign-in IDs, who asked for the deletion, when it happened, how many records were removed and any error, so we can show the deletion happened. For a school, we also keep the school's name and the email of the admin who ran it. No student names or emails are kept.
  • -Backups: copies in our providers' backups are overwritten on their normal backup cycle.

12.Keeping data safe

  • -All traffic is encrypted with HTTPS, and our providers encrypt stored data.
  • -Passwords are handled by Clerk and are never stored by us.
  • -Every request is checked against your role and your classes, so people only see what they are allowed to see. Answer keys are hidden from students until marking is released.
  • -Invite links and teacher access codes are stored hashed or encrypted, never as plain text.
  • -Limits stop accounts making too many requests, and changes teachers make to school accounts are logged.
  • -If a data breach affects a school, we tell the school without undue delay. We report breaches to the Information Commissioner's Office within 72 hours where the law requires it, and tell you directly if there is a high risk to you.

13.Children

Most people using TheStudyStack are aged 11 to 16, so we follow the ICO's Age Appropriate Design Code:

  • your own privacy settings start on the most private option
  • friends are off by default, and blocked in Years 7 to 9 and on accounts a school created
  • no location tracking, no adverts and no profiling for marketing
  • we do not push you to share more

Your teachers can see your work in their classes, because that is how classes work. If you are under 13 and want your own account rather than a school one, ask a parent or carer first.

14.Your rights

You have the right to:

  • get a copy of your data
  • have it corrected
  • have it deleted
  • restrict or object to how we use it
  • take it to another service
  • withdraw consent, for example by turning friends off
  • not be subject to decisions with legal or similarly significant effects made only by a computer

You can change your details and privacy settings, or delete your account, in Settings. School accounts are deleted by the school instead. For anything else, email privacy@thestudystack.co.uk. We reply within one month and may need to check who you are first.

Students aged about 12 or over can usually make requests themselves. Parents and carers can make them for younger children. For data your school is in charge of, ask the school; we will help it respond.

15.Complaints

If you are unhappy with how we have handled your data, email privacy@thestudystack.co.uk with "Complaint" in the subject. We acknowledge complaints within 30 days and reply fully as soon as we can.

You can also complain to the Information Commissioner's Office (0303 123 1113), although the ICO usually asks you to contact us first.

16.Changes to this policy

When we change this policy we update the date at the top. For important changes we tell users in the app and tell schools in advance.

Questions: privacy@thestudystack.co.uk

Related pages: Privacy, Cookies, Terms, Schools.