How GCSE Gym uses your data
Written for students first. Last updated 15 October 2026.
- We keep only what we need to help you revise: no surname, school or home address.
- No ads, no tracking cookies, no selling or sharing data for marketing, no device IDs.
- Your answers are marked by AI. The AI company doesn't use them to train its models.
- You can see, download, correct or delete everything, any time.
- You need to be 13 or over to use GCSE Gym.
Who we are
GCSE Gym (gcsegym.com) is responsible for your data (the "controller"). Contact us about anything to do with your data at hello@gcsegym.com.
What we collect, why, and our legal basis
| What | Details | Why | Legal basis |
|---|---|---|---|
| Your account | Email address, first name or nickname, a username we make for you, your password (scrambled so nobody can read it), the month and year you were born, the year you sit your exams, and whether the email is yours or a parent's. | To run your account, keep it secure and apply the right rules for your age. | Contract (providing the service you signed up for). Your age: legitimate interests and our legal duties to children. |
| Your learning | Your subjects, exam boards, tiers and set texts; your answers (including any photos of your working); marks, feedback and how confident you felt; time taken per question; tutor conversations; cram plans; what you're covering in class; topics you've marked as not covered yet; your strength scores. | So the app can mark your work, pick what you practise next and show your progress. | Contract. |
| How you use the app | When you sign in (time, and device type and browser, e.g. 'mobile · Safari', never a device ID), when you were last active, and how many minutes a day you have the app open and in use. | To support you if something goes wrong, keep the service working well, and keep our promise to tell whoever pays if a subscription isn't being used. | Legitimate interests. |
| Unfinished sign-ups | If you start signing up but don't finish: the email and month and year of birth from the first step, and the invite code. | To save your place and send at most two reminders. | Legitimate interests. Deleted after 30 days. |
| Parents, carers and payment | A parent or carer's email if you give it to us; payment requests you send; a Stripe customer reference; the payer's email from Stripe. | To send payment requests and scorecards you ask us to send, take payment, send receipts and renewal reminders, and tell the payer if a subscription goes unused. | Contract (with whoever pays) and legitimate interests. |
| Marketing choices | Whether you said yes or no to marketing emails, the exact words you saw, and when. If you unsubscribe or delete your account, a scrambled (hashed) copy of your email. | To only email people who asked, and never email people who said stop. | Consent (for the emails). Keeping the record: legal obligation and legitimate interests. |
| Things you send us | Feedback, mark challenges, subjects you ask us to add, and scorecard share links you create. | To reply, fix things and build what's needed. | Legitimate interests. |
| Messages and help | Messages between you and the GCSE Gym team, and your questions to the help assistant (answered by AI). | To answer your questions and contact you about your account if we need to. | Contract and legitimate interests. |
| Weekly summary and badges | Which badges you've earned and your streak, worked out from your sessions; whether you want the weekly summary, and whether a copy goes to your parent or carer. | To send your weekly summary (and your parent's copy, only if you turn it on) and to celebrate progress. | Contract. The parent copy: your choice, which you can turn off any time. |
| Challenges and share cards | If you share a "beat my mark" challenge: the question, your mark and your nickname, shown to anyone with the link for 30 days. Share cards show achievements only, never your name. Friends who answer a challenge without an account: their answer is marked by AI and not stored. | So you can challenge friends and share progress, only when you choose to. | Your choice (contract). Friends' answers: legitimate interests, and not kept. |
| Classes with a teacher | If you join a teacher's class with a code: for that one subject, your nickname, sessions, when you last trained and your topic strengths are shown to that teacher, plus your practice answers with marks and feedback only if you choose 'progress and answers'. A record of when teachers view your progress, visible to their school. Schools and teachers: school name and URN, staff names, school emails, subjects taught, and the school's safeguarding lead. | So a teacher you choose can see where to help you. You can leave a class any time and they stop seeing anything straight away. | Your choice (consent), which you can withdraw by leaving the class. Teacher accounts: legitimate interests. |
| Keeping you safe | If something you write suggests you might be at risk, a flag on that message. | So a person can check you're OK and point you to support. | Legitimate interests and, in an emergency, vital interests. |
| Homework help and mastery | Your homework-help conversations with the tutor, which topic each one was about, and your progress towards mastering it (worked out from your session scores). | So the tutor can help, and so topics you found tricky come back in your sessions until you've mastered them. Teachers don't see that you asked for help. | Contract. |
| The Recovery Room | The wellbeing check-in isn't stored or sent anywhere: it works only on your screen. If you send us a message from the Recovery Room, we keep it with your other messages and mark it as urgent. If you tap 'Take a lighter week', we change your weekly goal. | So the team can see your message quickly and reply. | Legitimate interests and, in an emergency, vital interests. We don't use any of this for anything else. |
| Security and email records | Failed sign-in attempts (username and time), email confirmation and password reset links, and a log of emails we've sent you (type and time). | To stop people guessing passwords, and to avoid sending duplicate emails. | Legitimate interests. |
"Legitimate interests" means we've weighed our reason against your privacy and decided it's fair and expected, with your interests, as a young person, coming first. You can object to any of it (see your rights below).
We also keep anonymous daily counts of how many times the sign-up pages are opened. These contain nothing about who you are.
AI marking and decisions
Your answers are marked by AI against the mark scheme, and the app uses your marks to choose what you practise next. These are suggestions to help you revise. They don't have legal or similar effects on you, and they aren't predictions of your real grades. If a mark looks wrong, tap "Challenge this mark" and a person will check it.
Who else handles your data
A few companies run parts of GCSE Gym for us. They can only use your data to provide their service to us, under contracts that require them to keep it safe.
| Company | What they do | Where |
|---|---|---|
| Vercel | Hosts the website | UK (London) |
| Neon | Stores the database | UK (London) |
| Anthropic | AI marking, tutor, notes and questions | USA |
| Resend | Sends our emails | USA |
| Stripe | Takes payments | USA and Ireland |
Your account and learning data are stored in the UK (London). Some of the services above are based in the USA. When your data goes outside the UK, it's protected by the UK's data bridge with the USA (for certified companies) or by the UK's approved contract terms (the International Data Transfer Addendum). Anthropic doesn't use your answers to train its AI and deletes them after a limited period. The small team running GCSE Gym can also see account details, answers and usage, to support you, check marking quality and keep you safe. Nobody else sees your data unless you share a scorecard, or the law requires it.
Parents and carers
- We email a parent or carer only when you ask us to (a payment request, a scorecard, or a copy of your weekly summary if you turn that on), plus one reminder about a waiting payment request.
- If a paid subscription goes unused for two months, we email whoever pays to say so, with a one-click cancel link. It says only that no sessions have been done, never what you've written or scored.
- We never use a parent's email for marketing unless they opt in themselves.
How long we keep it
| Your account and learning | While your account is open. Deleted straight away when you delete your account. |
| Sign-in records | 12 months. |
| Daily time in the app | 24 months. |
| Unfinished sign-ups | 30 days. |
| Failed sign-in attempts | 1 day. |
| Email log | 24 months. |
| Hashed 'don't email' list | Kept so we never email you by mistake. It can't be turned back into your email. |
| Payment records | Held by Stripe for as long as tax and finance law requires (usually 6 years). |
Cookies
We use two cookies, both needed for the site to work: one keeps you logged in, one remembers your place while you sign up. No tracking or advertising cookies, so there's no cookie banner. More about cookies.
Your rights
You can ask us to:
- show you the data we hold about you, or give you a copy to take elsewhere;
- correct anything that's wrong;
- delete your data (or do it yourself: Account → Delete my account);
- stop or limit using your data for something, or object to it;
- stop marketing emails, any time (the link in every email, or your Account page).
Email hello@gcsegym.com or use the Feedback button. We'll reply within one month. These are your rights, even if you're under 18; a parent or carer can also ask on your behalf. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Things to know
- Please don't write personal details in your answers or tutor messages.
- Questions are original and written in the style of the exam boards. GCSE Gym isn't connected to any exam board.
- If you write something that suggests you might be struggling, the app will show you where to get support (like Childline, 0800 1111, and our Recovery Room), and a member of our team may check in.
- We tell you what's changed if we update this notice in a way that matters. See also our terms and how we handle marketing.