Home › Privacy
Privacy
This notice covers the Physics, Maths and Biology websites and the Android apps. Revision progress is stored in your browser unless you choose to sync it through an optional account. Google Analytics remains off until you consent. The sections below explain what is collected, why, who receives it and how long it is kept.
Who is responsible
Ink Learning Ltd, a company registered in England and Wales under number 17382113, whose registered office is at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, is the controller for the personal data described here. It publishes all three libraries and both Android apps. For anything about this notice, including a request to exercise any of the rights below, write to support@inklearning.co.uk.
This notice is written under the UK GDPR and the Data Protection Act 2018. Ink Learning Ltd is established in the United Kingdom, so the Information Commissioner's Office is its supervisory authority; how to complain to it is under “Your rights” below.
This is the only privacy notice on this address. The physics, maths and biology libraries used to carry a notice each; those addresses now come here, and anything the old pages promised that still applies is stated on this one.
What stays in your browser
All three libraries remember what you have done, and all three do it in your own browser's local storage rather than on our side: checklist ratings, a record of each card and question you have graded and how it went, your study plan, and where you had got to. None of it is attached to requests, so none of it reaches a server unless you sign in to the optional account described next and sync it. Without an account, clearing your browser data erases it, no copy exists anywhere else, and none of it is personal data we hold.
The three keep their storage apart. Each library writes under its own key prefix, so nothing you have read or rated in one is visible to another, and a reader who uses two of them has two separate sets of progress rather than one they overwrite by accident. The tools also offer a copy-and-paste way to move progress between devices yourself, without any account at all.
The optional account
Every library offers the same optional account, and everything on this address works exactly the same without one. You sign in with Google, once, and the one account serves physics, maths and biology alike. Its only purpose is to carry your revision between devices, kept per library so one subject's progress never overwrites another's: which topics you have read and the last one you opened, your checklist ratings, a record of every card and question you grade, with its score, the time and a random identifier for the browser or phone it came from, how many cards you grade each day, and your study plan (minutes a day, study days, the days you finished, and any exam dates, names and units you enter). It also holds the settings you choose: the flashcard set you last picked, your exam board and any optional units or papers where a library asks for them, and on the account page your exam year, exam board and subjects.
When you sign in, Google tells us your email address and a stable identifier, under Google's own privacy policy; we never see a password and ask for nothing else. The sign-in itself is handled for us by Supabase, our database provider, and what we hold — that identity, the settings above and the synced progress — lives in Supabase's database in London, in the single database region fixed when the service was created rather than spread wherever traffic goes, and is kept only while the account exists. Signing out removes a device's access, and the account pages can also sign out every device holding the account at once.
Two buttons on any of the account pages cover the rights this gives you, without your having to write to anyone, and the same two are inside the Android apps. "Download everything we hold" sends you the account record itself: your email address, every progress row with the times they were set, when each device last signed in, and, if you used the daily session the server planned before 28 September 2026, your enrolment, every session it planned, every answer you gave it and the review state it worked out from them. "Delete my account" ends it: deleting the account erases it and everything synced with it, for all three libraries at once, immediately. Deletion leaves each device's own local copy of your revision alone, because the account is the copy that travels and the local one is yours.
What we collect across the whole address
Page counts. The site is hosted on Cloudflare Pages and served with Cloudflare Web Analytics, which records page views and loading-speed measurements so we can see which pages are used and which are slow. It is on for all three libraries. It sets no cookie, uses no device fingerprint and does not follow you between websites: it is a count of pages, not a profile of a person.
Server logs. Cloudflare keeps short-lived logs of requests, including IP addresses, as part of delivering the site and protecting it from abuse. An IP address can in some circumstances identify a person, so we treat these as personal data even though we never look anyone up in them.
Google Analytics, and only if you say yes. It is a separate question in each place you can read this material: once in the browser, and once in each of the two Android apps. Answering it in one is not answering it in the others.
On the website, a banner asks once, on the first page you open. Accept, and we load Google Analytics, which counts page views, how far down a page people read, which PDFs are taken, which questions the players put in front of you and when the worked answer to one is opened, when a flashcard session or a set of practice questions finishes, when somebody signs in, and where visitors arrived from — including from the Ink Learning YouTube channel, which is the thing we most want to know and cannot see any other way. The counts about questions carry the topic and the question's printed code, which are facts about the material rather than about you, and what you write in a question's working box is never among them: it stays on your device and is sent nowhere. Google receives the visit, an identifier it sets to tell one visit from the next, and which browser and device you are on. Your IP address is used to work out a rough location — the country, usually the town — and is then discarded rather than stored. That is how the service works rather than a setting we chose.
In the physics and maths apps, the same question is asked once on the way in, before the library is reachable, and nothing is counted while it is unanswered. The apps do not run the website's script; they use Google Analytics for Firebase, which is the same service reporting into the same place by the only route an Android app has. Say yes and the app counts three things of its own: that a topic was marked as read, and which topic it was; that a run of flashcards finished, with how many cards were graded and which of the three kinds of run it was — a review of what was due, a first look at new cards, or a cram through a shuffled deck; and that somebody signed in with a code — that it happened, never who did it. Firebase also keeps a few counts we do not choose and cannot switch off one by one, chief among them the first opening after an install, the start of each session, how long the app is used for, and an update to the app or to Android. Every one of them carries a label saying whether it came from the physics app or the maths app, which is how one set of reports can compare the two.
What holds those counts together is an app-instance identifier: a random number Firebase gives to this installation of this app, so that one visit can be told from the next. It is not your advertising ID, which the apps do not collect: the collection Firebase would otherwise do is switched off in the app itself, and the permission Google's advertising-ID service needs is taken out of the app before it is built. It is not your account: signing in changes nothing about the counting, and no event carries your name, your email address or anything you have typed. Firebase also sees the model of phone, the version of Android and of the app, and a rough location worked out from the connecting address as on the website. Uninstalling ends that identifier and a fresh install begins a new one. Nothing joins it to the website's identifier, so a phone and a browser are two readers in the reports even when they are you: linking them would need an identifier for the person rather than for the installation, and there is deliberately none.
Google Signals and ad personalisation are switched off in the page itself rather than in a setting somewhere, so none of this builds an advertising profile or follows you to other websites. Refuse, or ignore the banner, and Google's script is never fetched: no cookie, no identifier, no request to Google at all. That is a stronger promise than a consent signal that loads the script and asks it to behave, and unlike one it is a promise you can check for yourself in your browser's network tab.
The apps refuse the same things in the same way — advertising storage, advertising data and ad personalisation are all denied in the app's own code rather than in a console setting somebody could turn back on later. One promise is weaker on a phone than in a browser: the analytics library is part of the download and cannot be left out of it, so saying no does not mean it was never fetched; it means it is never switched on. The app ships with collection switched off, only a yes turns it on, and a no in Settings turns it off again as it is tapped. Either way nothing about your use of the app is gathered or sent.
Unless you sign in to the optional account, we ask for no name, no age and no payment details anywhere on this address, and the only email address we ask for is the optional reply address on a mistake report, described below.
Reporting a mistake
Every page of every library, and both apps, can send us a report that something is wrong. It goes only when you press send, and it carries the category you picked, the exam board you chose if the category asks for one, the note if you typed one, which element you flagged, the page it is on, a short excerpt of the flagged text and the build version, and nothing else. It carries no name and no link to your account, even if you are signed in: a report carries nothing that ties it to a person.
An optional email address is the one exception, and it exists because a reporter asked for it: somebody who has found a real error often wants to know what came of it. The field is blank unless you fill it in, it is stored on the report itself, and it is used to reply to you about that report and for nothing else. It is never added to a mailing list, never linked to an account, and never used to identify you across reports. The lawful basis for holding it is your consent, given by typing it.
Leave the field empty and the report is anonymous, which also means we cannot find yours again to erase it on request: the way to keep something out of a report is not to type it into the box. An address you did give is the one thing that can find its report again, so asking us to erase it is a request we can act on. A report is kept until it has been read and acted on, and is deleted when it is no longer needed.
So that the form cannot be flooded by machines, a report runs a Cloudflare Turnstile check before it sends, under Cloudflare's own privacy policy, and the sending connection's IP address is used transiently to limit how many reports one address can send in a day. That address is never stored by us: the rate limit keeps only a salted, hashed counter that cannot be turned back into an address, and the counters are swept daily.
The apps
There is an Android app for physics and one for maths, and there is no biology app. Each keeps everything on the phone unless you sign in and enable sync, and signed out each sends us two things at most: a request for the library itself when it checks for new topics, which is the same request your browser makes when you read a page, and, only if you choose to send one, a mistake report as described above. Signed in, it also syncs as the account section says. That is what an app sends us; what it sends Google is the counting described above, and only if you agreed to it. Answer no to the question either app asks on the way in, or turn it off in Settings afterwards, and there is none of that.
The apps ask for two permissions and use them for one thing each: notifications, to show the daily reminder if you switch it on, and alarms, to show it at the time you chose rather than whenever the phone gets round to it. Neither is used for anything else. If a store distributes an app, that store keeps its own record of the installation under its own policy rather than this one.
Why, and on what legal basis
The page counts and the server logs are processed under our legitimate interests: knowing whether the material reaches students, and keeping the site fast, available and protected from abuse. That balance is straightforward because neither purpose needs to know who you are and neither is used to profile or target anyone. If you would rather not be counted, any browser setting or extension that blocks analytics scripts stops it, and everything here works the same without it. An account is processed to provide the sync you asked for when you created it.
The analytics is different from everything else on this page: it runs on your consent and on nothing else. That is what the banner is for, and it is why it starts switched off — putting an identifier on your device needs asking first. On the website you can at any time, and refusing takes effect on the page you are reading rather than the next one.
The apps rest on that same consent and nothing else. Each asks once, on the way in, before there is any library to read, and the answer then lives in Settings under “Counting visits” for as long as the app is installed. Changing it there takes effect as you tap it rather than at the next start. The answer stays on the phone that gave it: it is not carried by the account, and it is not in the app's backup, so a second device is asked for itself rather than assumed to agree.
Who else sees it
Cloudflare does, as our hosting and analytics provider, as the operator of the check on the report form and as the store that holds mistake reports, which carry no account and no name. It processes on our behalf under its own terms and describes what it collects in its Web Analytics documentation. Supabase does, as the database behind the optional account, holding what the account section describes on our behalf and nothing else. Google does, only if you choose to sign in or you agreed to the analytics. Nobody else. We sell nothing to anyone and share nothing for advertising. Cloudflare is a global provider, so its processing may take place outside the United Kingdom, under the transfer safeguards set out in its own terms; what the account holds does not leave the United Kingdom, in the one Supabase region described above.
Google, as our analytics provider, and only if you agreed to it. Google processes the analytics on our behalf under its own privacy policy and the data protection terms that come with the service. Google is a global company, so this involves a transfer outside the United Kingdom; that transfer relies on the UK Extension to the EU–US Data Privacy Framework and on the standard contractual clauses in Google's terms. We see the reports, nobody else sees the data, and none of it is sold or shared for advertising. Firebase, which is how the apps count, is Google's too and reports into the same place under the same terms; no third party is involved in either the website's counting or the apps'.
How long it is kept
Unless you sign in, nothing about your revision is kept by us at all, so there is no retention period to state for it: it never leaves your device. What an account holds is kept while that account exists and erased when you delete it. The page counts are totals rather than records of a person and are kept while they are useful. The server logs are short-lived, held by Cloudflare under its own retention policy and not copied to us.
Google holds the analytics events for 2 months, the shortest period the service offers, and deletes them after that. The apps' events go to the same place and are kept for the same period. The totals in the reports outlive the events they were counted from, which is the point of a total: they are counts of pages and of screens rather than records of a person.
Cookies
None until you say yes, and Google's only after that.
Nothing here sets a cookie of its own, and nothing at all is set before you have answered the banner. What the site remembers about your revision — checklist ratings, a record of the cards and questions you grade, how far through the day you are — it keeps in local storage on your own device, which is sent to a server only if you sign in to the optional account. Your answer to the banner is kept the same way rather than in a cookie, so that saying no to cookies does not itself leave one behind.
Say yes and Google Analytics sets cookies of its own, which is how it tells one visit from the next. Say no and it is never loaded, so there is nothing left to opt out of. Either way you can .
The apps have no cookies to set, because there is no browser in them. Say yes and Firebase keeps the app-instance identifier described above, and its own working files, in the app's private storage on the phone; say no and it keeps nothing. Your answer to the question is kept there too, in the app's own settings rather than in anything that syncs, and uninstalling the app removes the lot.
Cloudflare's page counting, described above, sets no cookie either and uses no device fingerprint. It is the one thing here that counts without asking, and it can, because it puts nothing on your device to be asked about.
Your rights
Under the UK GDPR you have the rights of access, rectification, erasure, restriction, portability and objection over personal data held about you, and the right to object to processing carried out on the basis of legitimate interests. Without an account there is very little here to exercise them against: no contact details, no user records, and everything about your revision on your own device. With an account, access and erasure are self-service, on the account pages and inside the apps, as the account section above sets out. Write to support@inklearning.co.uk and we will answer within one month.
The analytics is the one thing on this page that rests on your consent rather than on our legitimate interests, and consent can be withdrawn as easily as it was given: and pick the other button. In either app the same withdrawal is Settings, then “Counting visits”, then No, and it stops the collection as it is tapped rather than when anything is saved. Nothing else about the site or the apps changes, because nothing else about them depends on it.
If you are not satisfied with how this is handled, you can complain to the Information Commissioner's Office, the UK's supervisory authority, at ico.org.uk or by telephone on 0303 123 1113. If you are in the European Union or the European Economic Area you may also raise a concern with the supervisory authority in your own country. We would rather you told us first, but you do not have to.
Video and other links
Some physics and maths topics link to a video on the Ink Learning YouTube channel; no biology page does. The link opens YouTube, where Google's own privacy policy applies. Nothing is embedded in the pages, so nothing from YouTube loads or sets a cookie unless you follow the link. The same goes for links out to the exam boards.
On the website, following one of those links is one of the things the analytics counts, if you agreed to it: we see that a link out was clicked and where it went, which is the only way the traffic between the channel and the site is visible to us at all. The apps count nothing about a link out, whichever way you answered their question. What happens once you are on YouTube is YouTube's, under Google's privacy policy, exactly as it was before.
Children
These are revision libraries for A-level students, so most readers are sixteen to eighteen, and younger readers are welcome. Nothing here requires an account or asks for a name or an age, and the optional account is as optional for a younger reader as for anyone else.
The Information Commissioner's Children's Code applies to a site most of whose readers are under eighteen, and three of its standards decide the shape of the banner. High privacy by default, so it starts switched off and nothing is counted until it is answered. Refusing as easy as accepting, so the two buttons are the same size and sit in the same row — deliberately not a prominent “accept” beside a quieter “customise” that hides refusal a screen deeper. And no profiling, so Google Signals and ad personalisation are refused in the page rather than in a setting a later hand could turn back on.
The apps are held to the same three standards and show them the same way. The question comes before the library rather than after it, so nothing is counted before it is answered. Its two buttons are the same size, the same colour and the same weight, one above the other, and neither is dressed up as the answer we would prefer. There is no way past the screen except to answer it, because a question that can be sidestepped leaves an app that does not know what was meant. And advertising storage, advertising data and ad personalisation are refused in the app's own code, as they are in the page.
Changes to this notice
We update this notice before introducing a material change to data collection or processing.
Getting in touch
Anything about this notice, and any request under the rights above, goes to support@inklearning.co.uk. Corrections to the teaching are welcome there too, or through the report control on the page the mistake is on.