Privacy Policy

The short version

• We collect what it takes to run your account and your revision: who you are, what you study, and what you do on the site.
• We don’t sell your data and we don’t show third-party ads.
• Card payments are handled by Stripe. We never see your card number.
• Messages to the AI tutor and answers sent for AI marking go to an AI provider to be answered.
• A parent or guardian can ask us for a copy of a student’s data, or for it to be deleted, by emailing [email protected].

What we collect

Your account

Your first and last name, email address and password. We store the password only as a one-way hash, so nobody at PapaMarks can read it. If you sign in with Google, Google tells us your name, email address and Google account ID; we never see your Google password.

During setup you tell us your level (for example IGCSE or AS), your exam board and the subjects and units you take. You can also give us a parent’s email address so they get a weekly progress summary. Anything else on your profile, such as a photo, an avatar or a public profile quote, is there only if you add it.

Your revision

The work you do here is stored so we can show it back to you: quiz and past-paper answers and their marks, flashcard reviews, topic mastery, study plans and to-dos, notes, handwriting notebooks and whiteboards, photos of working you upload, and your conversations with the AI tutor. If you post in a subject chat, your messages are stored too.

How you use the site

For each page you open we record the address, the time, the page you came from, your IP address and your browser’s user agent, then how long the page stayed open and how far down you scrolled. We also record a small set of named actions, such as starting a quiz or pressing a sign-up button. We use this to find what is broken or confusing and to see which parts of the site help.

Payments

For card payments we keep your plan, its dates and the payment status Stripe reports back. For a bank transfer by CliQ we keep the transfer reference, the sender name you give us, the amount and the date, so we can match the transfer to your account.

When you contact us

If you write to us through the contact form, the help desk or by email, we keep the message and our reply.

How we use it

• To run your account, sign you in and keep it secure, including one-time sign-in codes sent by email.
• To show you the right syllabus, mark your answers and track your progress.
• To take payments and give you the plan you paid for.
• To send emails you need, such as sign-in codes and receipts, and emails you can turn off, such as study reminders and the weekly recap. Every optional email carries an unsubscribe link.
• To fix problems and improve the site, using the activity records described above.

We don’t sell personal data, rent it out, or use it for third-party advertising.

Who else handles it

A few companies process data for us so the site can work. Each receives only what its job needs.

• Stripe takes card payments. Your card details go straight to Stripe and never reach our servers.
• Google handles “Continue with Google” sign-in, and Google Analytics 4 gives us aggregate figures on how the site is used, such as which pages are read and where visitors come from.
• Cloudflare sits in front of the site to speed it up and block attacks, so it sees every request, including your IP address.
• OpenAI and Anthropic provide the AI models behind the tutor and written-answer marking. See the next section.
• Brevo delivers our emails.
• Our hosting and cloud storage providers keep the database and your uploaded files.

We may also disclose data when the law requires it.

The AI tutor and marking

When you message the AI tutor, upload a photo of your working, or submit a written answer for marking, that content is sent to an AI provider (OpenAI or Anthropic, depending on the feature) so a model can answer or mark it. The reply is stored in your account so you can come back to it.

Please don’t put personal details that the question doesn’t need, like a phone number or home address, into a tutor message.

AI answers and AI marks can be wrong. They are not official marking by any exam board. Our Terms say more about this.

Cookies and local storage

We use a small number of cookies:

• A session cookie and a security (CSRF) cookie, which keep you signed in and protect forms. The site can’t work without them.
• A “remember me” cookie, only if you tick “Keep me signed in”.
• Google Analytics cookies, which let us count visits without knowing who you are.

Your browser also stores a few preferences on your own device, such as dark mode or a dismissed notice. These stay in your browser and are not sent to us. You can clear cookies and site data in your browser settings at any time; you will be signed out.

How long we keep it

• Page-view records are deleted after 90 days.
• Records of named actions are deleted after 180 days.
• The log of emails we have sent is deleted after one year.
• Your account and your revision stay while your account exists. When an account is deleted, we remove its personal data, except payment records we must keep for tax and accounting.

Students under 18

Most people who use PapaMarks are school students, and many are under 18. If you are under 18, a parent or guardian should agree to you creating an account and to this policy.

A parent or guardian can ask us, at any time, for a copy of what we hold about their child, to correct it, or to delete the account. Email [email protected] from the address you want us to reply to, with the student’s name and account email. We may ask a question or two to confirm you are the parent or guardian before we act.

Access, export and deletion

You can ask us to:

• send you a copy of your data in a common format,
• correct something that is wrong,
• delete your account and its data, or
• stop sending you optional emails (the unsubscribe link does this straight away).

Email [email protected] from your account’s email address. We answer within 30 days, and usually much sooner.

Security

The site runs only over HTTPS. Passwords are stored as one-way hashes, and email sign-ins use one-time codes. No system is perfectly secure; if we learn of a breach that affects your data, we will tell you.

Changes to this policy

If we change this policy in a way that matters, we will update the date at the top of this page and tell account holders by email or with a notice on the site before the change applies.

Contact

Write to [email protected] or use the contact form. We reply within one to two working days.

Service

PapaMarks, at papamarks.com