Privacy policy

The short version

• You can use the past papers, drills and mock exams without an account. Your progress then stays in your own browser and never reaches us.
• If you make an account, your progress is saved to it so it follows you between devices.
• We do not run advertising. We count page views with Vercel Web Analytics, which uses no cookies, and we use no other analytics or tracking scripts.
• We do not sell your data.
• The AI tutor sends what you give it to outside AI companies. Read that section before you use it.

What we collect

If you only browse. Your answers, timings and confidence ratings are kept in your browser's local storage, on your device. We do not receive them. Clearing your browser data removes them.

If you make an account. We keep:

• Your email address and a display name (by default the first part of your email).
• Your password, which is handled by our sign-in provider and stored only as a one-way hash. We never see it.
• Your revision activity: every answer you give, whether it was right, how long it took, how sure you said you were, your practice sessions and mock exams, and the schedule that decides when a question comes back for review. Your streak, daily goal, topic badges and achievements are worked out from this; they are not stored separately.
• When you first sign in, anything your browser had saved before is copied into your account.

If you use the AI tutor. We keep the question you typed or photographed, any working you added, the images you uploaded, and the answer you were given. They stay in your chat history until you delete the chat or your account, and a chat is deleted automatically, with its images, 30 days after you last open it or add to it.

If you share a result. We keep a card with the score, the paper, how many questions and (if you have them) your grade estimate and streak, and the date. The public page for a card shows those and never your name, email or account. Anyone with the link can see it until you delete it, and deleting it ends the link at once. We also keep who made each card, so that you can see and delete yours.

If you set your goals or an exam date. When you first sign in we ask which subjects you are studying, the grade you are aiming for and how many questions a day you want to do, and we keep your answers, and your exam date if you give one, so your dashboard and study plan fit you. You can skip the questions, change or clear any answer at any time, and all of it is deleted with your account.

If you ask an AI to mark your answer. We keep the answer you typed for each part, the marks and comments you were given, and when. You can look back at them, and they are deleted with your account.

If you pay. We keep the plan, amount, payment method, the transaction ID you typed, the receipt image if you attached one, and whether the payment was approved.

If you write to us. We keep your message, your email address, the name you gave, and your account if you were signed in. If you press “Report this answer” under an AI answer, or report an AI mark, the report includes the AI's answer or mark, the answer you gave and your note, and a person reads it.

What we use it for

• To run the site: to save your progress, show it back to you, and schedule reviews.
• To answer your tutor questions.
• To check payments and give you the plan you paid for.
• To reply when you write to us, and to keep the site safe from abuse (for example, limiting how many messages or tutor requests one account can send in a day).

We do not use your answers or your uploads to build advertising profiles, and we do not share them with other students.

Who else handles your data

We use outside companies to run parts of the site. They process data for us, under their own terms:

• Supabase hosts our database, sign-in and file storage. Everything in your account, including tutor uploads and payment receipts, lives there. These are kept in private storage that only our servers can open.
• Our web host, Vercel, serves the site and sees ordinary request information such as your IP address. Its Web Analytics tells us how many people visit which pages, and broadly where from and on what kind of device. It uses no cookies and is not linked to your account.
• Email. Supabase sends your sign-up and password-reset emails. If an email service is connected, we also use it to send ourselves a notice when someone writes to us; that notice contains the message and the sender's email address.
• AI providers, for the tutor, explanations and marking. When you use the AI tutor, your question, working and any images are sent to AI companies to produce and check the answer. At the time of writing these are DeepSeek (drafts the answer), Anthropic (checks it) and OpenAI (screens the input and the answer for unsafe content). When you ask for an explanation of a question on the results page, DeepSeek is sent that exam question, its official answer or mark scheme, and which option you chose. When you ask an AI to mark an answer, DeepSeek is sent the exam question, its mark scheme and the answer you typed. When you add photos of your written answers to a mock paper, OpenAI screens each photo and DeepSeek reads it, and we delete the photo as soon as it has been read. They receive that content, not your name or email, and they may process it outside your country. Do not put anything into the tutor you would not want an outside company to read: no photos of people, no names, addresses or phone numbers.

We may also disclose information if the law requires it, or to protect someone's safety.

Cookies and local storage

We use only what the site needs to work: a sign-in cookie if you have an account, and your browser's local storage for your saved progress, your light or dark theme, and which achievements you have already seen. None of this tracks you across other sites, so there is no cookie banner to accept.

How long we keep it

We keep your account and its data until you ask us to delete it, except AI tutor chats, which are deleted 30 days after you last use them. Messages you send us are kept until we have dealt with them and for a reasonable time after, in case you write back. Data in your browser stays until you clear it.

Your choices

You can delete your account and everything linked to it yourself, at any time: your activity, tutor requests and uploads, plan and payment records. Choose “Delete account” in the account menu, or go to the delete your account page. It happens straight away and cannot be undone.

You can also ask us to show you what we hold about you, correct it, or delete your account for you. To ask, use the contact form and choose “My data or my account”. Write from the email address on your account so we can be sure it is you.

You can also leave at any time: signing out and clearing your browser data removes what is stored on your device.

Younger students

Many of our students are under 18. Note Academy is for people aged 13 and over: we do not knowingly make accounts for, or collect data from, children under 13, and will delete an account if we find that its owner is younger. If you are under 18, or under the age at which you can agree to this yourself where you live, please make an account and use the tutor only with a parent or guardian's permission. Parents and guardians can contact us at any time, at ali.ateeb322@gmail.com or through the contact form, to see or delete a child's data.

Security

The site is served over HTTPS, passwords are hashed, and each account can read only its own records. No system is perfectly secure, so if we learn that your data has been exposed in a way that could harm you, we will tell you.

Changes

If we change this policy in a way that matters, we will change the date at the top of this page and, where we can, tell signed-in students. Questions about it are welcome through the contact form.