GCSE-readyFor schools: data protection
Last updated 2 November 2026
This page is for teachers, school data protection leads and data protection officers who want to know how GCSE-ready handles pupils' data. It summarises our privacy notice, which is the full and binding description. If the two ever differ, the privacy notice applies.
In short
- Pupils can use every lesson without an account. You do not need to share any pupil data with us.
- There are no adverts, no tracking cookies, no data selling, and no messaging or contact between users.
- GCSE-ready is free. No payments are taken.
- Accounts are optional and made by the student. We do not take class lists or pupil data from schools.
Using GCSE-ready in class without pupil accounts
Teachers can share any lesson link with a class. Without an account, a pupil's progress is saved only in the browser on the device they are using, and is never sent to us. Notes, the essay planner, lessons made in My work, display settings and similar tools always stay on the device.
The only thing sent from a device without an account is a set of anonymous usage counts, such as "a Maths lesson was finished". These counts have no name, account, email, device ID or exact score, and our server only adds them to daily totals. They can be switched off in Settings or on the privacy notice, and nothing is sent if the browser has Global Privacy Control or Do Not Track switched on. No cookies are used. If a student chooses Year 7 or Year 8 in the app, the counts start switched off on that device until they switch them on.
Shared or school computers: in Settings, "Remove everything from this device" clears every GCSE-ready setting, note and saved lesson from that browser and signs the user out. Progress saved to an account stays in the account.
What we collect only if a student creates an account
A student may choose to create a free account so their progress follows them across devices. To create one, the student must tick to agree to the Terms of use and the Privacy notice. Students who choose Year 7 or Year 8 must also tick that a parent or carer has said they can create an account.
| Data | Why |
|---|---|
| Email address, first name if given, how they sign in (Google, email and password, or an emailed code), whether the email is confirmed, when the account was made, and which version of the Terms and Privacy notice they agreed to and when. Passwords are kept only as a scrambled (hashed) version. | To provide the account and sign the student in. |
| Saved progress: course, lessons done, answers and scores, mock test results, review lists, streak, badges, study paths and the latest weekly report text. | To keep progress the same on every device. |
| Sign-in security data: scrambled sign-in tokens and codes, email confirmation links, and counts of wrong password attempts and sign-in emails. | To keep accounts secure. |
| Weekly parent email (optional): a parent's or carer's email address that the student types, the student's first name and the latest weekly report text. | To send one invitation, then a weekly report only after the parent confirms by email. Every email has a one-click stop link. |
AI tools
Ask AI, Correct my answer and My work send the text a pupil types to an AI model run by Cloudflare. They are sent without the pupil's sign-in, so they are never linked to an account. They only help with school subjects, and personal, health or unsafe questions get a reply pointing to a trusted adult and services such as Childline instead of an answer.
- Text sent to Correct my answer and My work is not kept by GCSE-ready after the reply is written.
- If an Ask AI question is about the curriculum, we keep the question text, with email addresses, phone numbers, names and school names removed and with no account or internet address, for 6 months after it was last asked, to see which topics need new lessons.
- Files added to My work are read on the device and are never sent.
Pupils are told not to type their name or other personal details into these tools.
What we do not collect
We do not collect location (only the country, inside the anonymous counts), contacts, photos, or anything from the camera or microphone. We do not build profiles of students, use their data for marketing, or share it with advertisers. There is no chat, messaging or public profile, and nothing a student writes is shown to anyone else.
Who handles data for us, and where
The data controller is The Ready Society, which runs GCSE-ready. These companies process data for us:
| Company | What it does |
|---|---|
| Cloudflare, Inc. | Hosts the website, the app and our database (Cloudflare D1), and runs Cloudflare Workers AI, which writes Ask AI answers, Correct my answer feedback and My work lessons using Meta Llama models. |
| Confirms who the student is, only if they choose "Sign in with Google". | |
| Resend | Sends our emails: sign-in codes, email confirmation, the weekly parent email and the parent newsletter. |
Data may be processed outside the UK, including by Cloudflare, Google and Resend in the United States and other countries. For transfers from the UK we rely on the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge), under which these companies are certified, with standard contractual clauses and the ICO's UK International Data Transfer Addendum in their data processing terms as a backup. You can ask us for details.
Videos use YouTube's privacy-enhanced mode (youtube-nocookie.com), and nothing loads from YouTube until a pupil presses play. Fonts are served from our own site. The Google sign-in script loads only on the sign-in page.
Stripe is set up for payments but is not used while GCSE-ready is free. No payments are taken and no card details are collected.
How long we keep data
| Data | How long |
|---|---|
| Account details and saved progress | Until the student deletes the account, which they can do themselves on the account page. Deleting it removes the account, progress, sign-ins, any parent email link and email codes. |
| Sign-in tokens | 60 days. |
| One-time email codes | Stop working after 10 minutes; deleted within a day. |
| Email confirmation links | 7 days. |
| Weekly parent email | Until the parent stops the emails or the student removes the address. Unconfirmed invitations are deleted after 14 days. |
| Anonymous curriculum questions from Ask AI | 6 months after last asked. |
| Other AI questions and work sent for feedback | Not kept by GCSE-ready after the reply is written. |
| Anonymous usage totals | Daily totals for about 13 months, then monthly totals only. |
A daily automatic clean-up deletes data when its time is up.
How we keep data secure
- Passwords are stored only as a salted, scrambled hash. Sign-in tokens, one-time codes and email confirmation links are also stored only in scrambled form.
- Repeated wrong passwords and repeated sign-in emails from one device are limited.
- Daily limits on the AI tools use a scrambled code made from the internet address that changes every day and is deleted the next day, so devices cannot be followed across days.
- Only the site owner's accounts can open the admin page, and only with a confirmed email address. It shows the list of accounts but not answers, scores or activity for any individual student.
- The site is served only over HTTPS, with security headers that stop other sites framing our pages and block browser plug-ins.
The Children's Code
GCSE-ready is made for students aged about 11 to 16, and we follow the Information Commissioner's Office (ICO) Age Appropriate Design Code (the "Children's Code"). In practice:
- High privacy by default: no account is needed, and without one nothing about a pupil's learning leaves the device except anonymous counts that can be switched off.
- Collect only what is needed: accounts are optional and the first name is optional.
- No profiling, no adverts, no selling data and no sharing with other users.
- No location tracking and no camera or microphone access.
- No nudges to give up privacy: we do not send students reminder or "come back" messages.
- Parents see reports only with consent: the weekly email starts only after the parent confirms, and can be stopped at any time.
- Tools for students: students can delete their account, save a copy of their progress from Settings, switch off anonymous counts and remove everything from a device.
Your rights and pupils' rights
Students have the right to get a copy of their data, have it corrected or deleted, restrict or object to its use, take it to another service, and withdraw consent. A parent or carer can contact us on behalf of a child. We reply within one month. Anyone can also complain to the ICO at ico.org.uk/make-a-complaint or on 0303 123 1113, though we would like the chance to put things right first.
Contact
For data protection questions, email hello@gcse-ready.org. For a safeguarding concern, put "Safeguarding" in the subject line and see our safeguarding page. More for teachers on the page for teachers.