Draft. Highlighted items need your details, and the whole policy should be checked by someone qualified in UK data protection law before launch. Remove this notice when it's final.
Privacy policy
Last updated [date]
- We collect what the app needs to teach you: your email address, your study progress, and the work you choose to send to Demo or a teacher.
- We don't show adverts, sell your data, or use tracking or advertising cookies.
- Work you send to Demo is processed by OpenAI to mark it or reply. It is not used to train their models.
- You can export your data, and you can delete your account and everything stored with it from the Account page at any time.
Who we are
Demosthenes is run by [legal name, or your name if a sole trader], [postal address]. We are the controller of your personal data under UK data protection law. Contact us about anything in this policy at [privacy email address]. Our registration number with the Information Commissioner's Office is [ICO registration number].
What we collect and why
| Information | Why we use it | Legal basis |
|---|---|---|
| Your email address | To create your account, send sign-in codes, and send messages about your subscription. | Contract |
| Study data: courses chosen, answers you rate, review schedule, notes, Sandbox and Debate reads, saved reading | To schedule reviews, show your progress and tailor what Demo suggests. This is the service itself. | Contract |
| Work you send to Demo: typed answers, photos or drawings of written work, Debate and Ask Demosthenes messages | To mark your work and reply. Sent to OpenAI for processing (see below). | Contract |
| Work you send to a teacher, and the teacher's email address | To email your work to the teacher you choose. The email shows your address as the one to reply to. | Contract |
| School accounts: the school email your school added, your name as your school gave it, your seat and classes, and papers you hand in for your teacher | To link you to your school and your classes. In your own classes, your teacher sees your study in their subject (questions answered, how each topic is going, exam papers and their marks). Not your conversations with Demo, your notes, or other subjects. A personal account has no teacher access at all. | Your school's agreement with us [Confirm with your adviser: for school accounts the school is normally the controller and Demosthenes its processor.] |
| Billing: your Stripe customer reference, what you bought, subscription status and dates | To give you what you paid for, and to keep the records the law requires. | Contract; legal obligation |
| Weekly usage counts for AI features | To apply the fair-use limits on each plan. | Contract |
| Error reports: what went wrong, the page, your browser type | To find and fix faults. | Legitimate interests (a working service) |
We never see or store your card details: Stripe handles payments. Please don't put other people's personal information in work you send to Demo.
Children
Demosthenes is built for GCSE and A-level students, so many of our users are under 18. You must be 13 or older to create an account. If you're under 18, please ask a parent or guardian before buying a subscription or the Pass.
We design for young users by default: there are no adverts, no data sold or shared for marketing, no location tracking, and no public profiles. The picture Demo builds of how you learn is used only to teach you, and you can delete it at any time. We have assessed the service against the ICO's Age Appropriate Design Code. [Confirm once your data protection impact assessment is complete.]
Who we share it with
We use these companies to run the service. They process your data only on our instructions.
| Company | What they do | Location |
|---|---|---|
| Supabase | Sign-in and database | [region of your Supabase project] |
| Vercel | Hosts the website and its server functions | USA / global network |
| OpenAI | Marks your work and writes Demo's replies. Data sent through OpenAI's API is not used to train its models, and may be kept by OpenAI for up to 30 days to detect abuse. | USA |
| Stripe | Takes payments and manages subscriptions | USA / Ireland |
| Resend | Sends the emails you ask us to send, and subscription emails | USA |
| Sentry | Error reports | Germany (EU) |
Your browser also loads fonts, maths rendering and code libraries from Google Fonts, jsDelivr, esm.sh and Sentry's CDN, and images and details from Wikimedia Commons, Wikipedia, the Art Institute of Chicago and the Metropolitan Museum of Art. Like any website you visit, these services receive your IP address when your browser requests something from them.
Where data leaves the UK, it is protected by the UK's adequacy regulations or by appropriate safeguards such as the UK International Data Transfer Addendum or the UK Extension to the EU–US Data Privacy Framework.
We don't sell your data, and we share it with no one else unless the law requires us to.
How long we keep it
- Your account and study data: until you delete your account.
- Work sent to OpenAI: up to 30 days on OpenAI's side. We don't keep a separate copy of photos you send for marking.
- Payment records: Stripe keeps these for as long as UK tax law requires, which is usually six years.
- Error reports: up to 90 days.
- Database backups: up to [your Supabase backup retention] days, after which deleted data is gone from backups too.
Storage on your device
The app keeps your progress, preferences and sign-in session in your browser's local storage, and caches its own files so it works offline. This storage is strictly necessary for the service to work, so it doesn't need your consent. We use no tracking or advertising cookies. Stripe sets its own cookies on its checkout pages.
Your rights
You have the right to access your data, correct it, delete it, move it elsewhere, and object to or restrict how we use it.
- Delete: go to Account, then Delete my account. This deletes your account and everything stored with it, and cancels any subscription at once.
- Move: go to Account, then Export JSON backup, for a copy of your study data.
- Anything else: email [privacy email address]. We'll reply within one month.
If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We'd appreciate the chance to put it right first.
Changes
If we change this policy in a way that matters, we'll tell you in the app before the change takes effect.