Your data, in plain English

Who we are

revolve. is run by Alex Papaspyrou in the UK. Alex is responsible for your data (the “controller”, in legal terms). For anything about your data, email support@revolverevision.co.uk.

What we collect

• If you join the waitlist: your email address, when you joined and which page of the site you joined from. Once you have an account, we check its email against the waitlist to see if you get the free week of Pro.
• Your account: your name, email address and password. Your password is scrambled (hashed) so nobody, including us, can read it.
• Your revision set-up: your goal, tier, subjects, science route and exam dates.
• Your studying: which cards you’ve reviewed, how you rated them, when each is due again, and your study sessions (date, topic, number of cards and how long you studied). We use this to work out your XP, streak and badges. Each day we also note how many cards you’ve learned and mastered in each subject, so your report can show progress over time.
• Your quizzes: which quiz questions you’ve answered, whether you got them right, and which are in your Mistakes list.
• If you use the AI tutor: the messages you send it, together with what’s on your screen when you send them (the flashcard, quiz question or text of the page you’re on). We don’t save the conversation: it stays in the app until you close it. We only keep a count of how many messages you’ve sent today.
• If you add a parent or carer (Pro): their email address, whether they’ve confirmed, and when we last sent them a report.
• If you ask a parent or carer to pay for Pro: we use their email address once, to send them the link. The link shows them your first name and a short summary of how your revision is going, and stops working after 30 days. If they pay, Stripe keeps their email and payment details as the customer, and they can choose to get weekly reports.
• If you join a teacher’s class: which class you’re in, the name you give your teacher and when you joined. If you sign up from a teacher’s join link, we also save the class code with your account, because while revolve. is invite-only, a class code is what lets you sign up.
• If you’re a teacher: your class plan (how many classes it covers, how many students each class can hold, when it’s paid until and, if you give it to us, your school), and the name, subject and code of each class you make. Anyone who enters one of your class codes sees the class name and subject, your name and your school before they choose to join.
• If you report a mistake on a card: which card, what you said was wrong and any note you add, so we can fix it.
• Leagues: the weekly league you’re in and your XP that week. Other players only ever see a nickname we generate for you, never your name or email.
• Visits to the site: anonymous page views, which page sent you here, your country, and your device and browser type. This uses Vercel Web Analytics, which doesn’t use cookies and doesn’t identify you.
• Security logs: our hosting providers keep short-lived technical logs, including IP addresses, to keep the service running and stop abuse.
• Limits that stop abuse: to stop people guessing links, spamming emails or overloading the app, we count requests for a short time against your IP address, your account, or an email address someone has asked us to send to.
• The bot check: when you log in, sign up or ask to reset your password, Cloudflare Turnstile checks you’re a person, not a bot. It looks at your IP address and details of your browser and device, not what you type into the form.

We don’t ask for your date of birth, location or photos, and we don’t ask students for their school. A teacher can tell us theirs, so if you join their class, we’ll know which school it’s at.

If you buy Pro: payment is handled by Stripe. We never see or store card details. We keep your Stripe customer reference and your plan (monthly or yearly, when it renews, whether it’s cancelled) so we know to switch Pro on.

Why we use it

• To run the app you signed up for: your account, revision plan, progress, streaks and leagues. The legal basis is that it’s needed to provide the service.
• To send study reminders: at most one email a day, only if you haven’t studied yet and your streak is about to end or cards are due. It’s part of the service you signed up for, so they’re on unless you turn them off, which you can do in Settings or with the link in any reminder.
• To send a weekly report to a parent or carer: only if you add their email, and only once they’ve clicked the link in our confirmation email to say yes. It covers your revision time, readiness for each exam and the topics to work on. The legal basis is their consent: they can stop the reports with the link in any of them, and you can remove them in Settings.
• To show your teacher how your revision is going: only if you join their class with its code, after we’ve shown you whose class it is and what they’ll see. Your teacher sees the name you gave them, how much you revise (when you last revised, how many days, minutes and cards this week, your streak and your revision time in past weeks), and whether you’re keeping up, slipping or haven’t revised lately (worked out from how many days you’ve revised in the last week). For the subject the class is for, they also see how far you’ve got, how ready you are for each exam, your exam dates, the topics to work on and your predicted grades. If the class is for all subjects, that’s every subject you study. We show you which before you join. They never see your email address, your parent or carer’s details, your AI tutor messages or anything about payments. The legal basis is your consent: you can leave the class whenever you like on the Classes page, and your teacher stops seeing your revision straight away. If your teacher copies anything into your school’s own records, your school’s privacy notice covers that.
• To run classes for teachers: so a teacher with a class plan can make classes, share their codes and see the students who join. The legal basis is that it’s needed to provide the class plan they asked for.
• To answer you in the AI tutor: only when you send it a message, we send that message, the earlier messages in the same chat and what’s on your screen to Anthropic, whose AI (Claude) writes the reply. The tutor is an AI, so it can get things wrong; don’t share personal details with it. The legal basis is that it’s needed to provide the tutor you asked to use.
• To estimate the grade you’re working at: worked out from your cards and quizzes, and shown to you, to your parent or carer in their weekly report if you’ve added one, and to your teacher if you’ve joined their class. It’s a guide, not an official prediction, and nothing is decided about you because of it. The legal basis is that it’s part of the service.
• To email you when revolve. opens: one email to the waitlist, because you asked for it. The legal basis is your consent, and you can withdraw it any time.
• To understand how the site is used and keep it secure: anonymous analytics, security logs, the bot check and the limits that stop abuse. The legal basis is our legitimate interest in running a working, safe service.

We don’t use your data for advertising, we don’t build profiles of you to sell or share, and we don’t make any decisions about you automatically beyond choosing which flashcards and quiz questions to show you next.

Who else handles it

We use these providers to run revolve. They only process your data on our instructions:

• Supabase stores your account and study data in a database in Ireland (EU), and sends sign-up and password emails.
• Vercel hosts the website and provides the anonymous analytics.
• Stripe takes payments for Pro and keeps the payment records it’s legally required to.
• Resend sends our emails (waitlist invites, study reminders and parent reports), so it handles your email address and the email itself.
• Anthropic runs the AI behind the tutor. It gets what you send the tutor and what’s on your screen at the time, only to write the reply. It doesn’t use them to train its AI, and deletes them after a short time.
• Sentry tells us when something in revolve breaks. Its error reports describe the fault, the page and your browser type, with no name, email address or IP address.
• Cloudflare runs Turnstile, the bot check on the log-in, sign-up and password reset forms. It sees your IP address and details of your browser and device when you use those forms. It uses them only to tell people from bots, and to get better at spotting bots, not to work out who you are or build a profile of you.

All seven are US companies, so some data may be handled in the US. Where that happens, it’s covered by the UK’s approved safeguards for international transfers. We don’t sell or give your data to anyone else, apart from a parent, carer or teacher you choose to share it with, unless the law requires it.

Cookies and your device

We only use what’s needed to keep you logged in. There are no advertising or tracking cookies, so there’s no cookie banner.

So revolve. works without signal, your device keeps a copy of the cards, your progress and anything you study offline until it syncs. Your sound-effects setting is saved there too. Logging out or deleting your account wipes it from the device. If you open a teacher’s join link before logging in, the class code waits on your device until you’ve logged in and seen the class.

How long we keep it

• Your account and study data: until you delete your account.
• A parent or carer’s email: until you remove it, they stop the reports, or you delete your account.
• Your waitlist email: until you ask us to remove it, or until you delete the account you make with that email.
• Being in a class: until you leave it, your teacher takes you out or deletes the class, or you delete your account. If a teacher’s plan ends, they can’t see anything about their students until it’s renewed.
• A teacher’s class plan and classes: until the teacher deletes them or their account, or we remove the plan. Removing a plan deletes the teacher’s classes and takes everyone out of them. Everyone keeps their own account and progress.
• Card reports: we keep them to track which cards we’ve fixed. If you delete your account, your reports stay but are no longer linked to you.
• AI tutor messages: we don’t keep them. Anthropic keeps them for a short time for safety checks, then deletes them. The count of today’s messages goes after about two days.
• Security logs: a short time, set by our hosting providers.
• Request counts that stop abuse: about two days.

Deleting your account

Go to Settings → Delete account. That deletes your login, your progress, sessions, league place and profile straight away, takes you out of any classes you’re in (and deletes any you run), and removes your email from the waitlist. It can’t be undone. If you can’t log in, email us and we’ll do it for you.

Your rights

You can ask us to:

• give you a copy of the data we hold about you
• correct anything that’s wrong
• delete your data
• stop using your data for something, or limit how we use it

Email support@revolverevision.co.uk and we’ll reply within a month. If you’re unhappy with how we’ve handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk.

Age

You need to be 13 or older to make an account. If we find out someone under 13 has signed up, we’ll delete their account. If you’re a parent or carer and think your child has, email us.

Changes

If we change this notice, we’ll update the date at the top. If it’s a big change, like adding paid plans, we’ll tell you in the app before it happens.