Privacy policy

Last updated: November 2, 2026

In short: we store only what we need to run your account (your email and what you can access), your progress (so you can pick up where you left off) and anonymous totals. We don't sell your personal information, we don't share it for targeted advertising and we don't run ads. The site is for students 13 and older. You can have everything deleted by emailing us.

1. Who runs this site?

apmathrevision.com (AP Math Revision) is one of the Math Revision sites run by Pete Bromfield in the United Kingdom; they share one sign-in system and database. Questions about your data: pbromfield@ibmathrevision.com. Our team reads every message.

2. What we store, and why

What	Why	Where
Your email address	To sign you in, save your progress and send the emails you asked for (receipts, sign-in links, updates).	Firebase Authentication (Google Cloud)
Name and avatar (if you sign in with Google or Microsoft)	To personalize the site.	Firebase Authentication
Your class, practice attempts, answers and scores	To show you (and your teacher, if you're in a class) your progress.	Firestore and Cloud Storage (Google Cloud)
Updates email (if you signed up)	To send the tips and news you asked for.	Firestore
Your plan and payment records	To unlock your plan, and because tax law requires us to keep receipts.	Stripe (card details never reach our servers) and Firestore (plan status only)
Your devices: a random device ID your browser makes, a label such as "Chrome on Windows" (worked out from the browser's user-agent, which we don't keep), when each device was first and last used, and which of our sites it was used on, and a scrambled code for the network it was used on	Accounts are personal and can be used on up to 5 devices; this is how we count them. To protect paid accounts, we also note how many different devices an account is used on, so we can spot a shared login. So that one phone or laptop counts once, we keep a scrambled code for the network each device was used on (made from the first part of its IP address, and different for every account); we never keep the IP address itself or your location. We keep an eye on account use: if we suspect an account is being shared, we may email you about it, and the account may be paused while we review it. Teacher, school and class accounts are not limited. You can see and remove your devices on your account page. No other fingerprinting.	Firestore; the device ID also sits in your browser's local storage. A device unused for 60 days is deleted automatically.

We don't collect sensitive information such as government ID numbers, precise location, health information or financial account numbers (card details go straight to Stripe).

3. Who else sees your data

We share as little as possible, and only with the service providers that run parts of the site for us:

Google Firebase: sign-in, database, file storage, hosting and our server code.
Stripe: card payments. We never see your card number.
Resend: sends our emails (receipts, sign-in links, updates). We give it your email address and the email.
AI marking (Google Gemini): only where AI marking is switched on and you ask for feedback on your working, the question and your answer (or a photo of your working) are sent to Google's Gemini service to write that feedback. We don't use them to identify you.
Emergent (emergentagent.com): stores some uploaded files, such as photos of written work and class handouts.
Crisp (crisp.chat): the live chat, where offered. Nothing from Crisp loads until you press "Chat with us". Then Crisp's chat window loads from Crisp's servers, keeps a chat session ID in your browser and, if you send a message, stores it and any email address you give.
ipapi.co: only if you click "Accept all" in the cookie banner: at most about once an hour per visit, our site asks this geolocation service for the approximate location of your internet connection and records the country and city with the page you visited, so we can see where visitors come from. We don't store coordinates or link it to your account.
Your teacher: if you join a class, your teacher sees your progress for that class.
A parent or guardian you link (or who asks and you approve): see section 7.

No advertising networks, no tracking pixels, no profiling.

4. Cookies and local storage

Firebase sign-in storage keeps you signed in.
Google Analytics runs only if you accept analytics cookies in the banner (IP anonymized, no advertising features).
Our own page counts: to see which parts of the site help and what is broken, each page sends us a small anonymous note when you leave it: the page address, where the visit came from (for example a search engine or another page of ours), which kind of link or button was clicked, menu links used, how far down a long page you scrolled, how fast the page loaded, and any error or "page not found". It has no cookie, no ID and no IP address, is never linked to you or your account, and is only added into daily totals. Only if you click "Accept all", it also counts what you type into the site search box (never anything with an email address or long number) and which features you used each week (remembered in your browser). Nothing you type into answers or forms is ever sent. Page-level details are deleted after 90 days. Turning on "Do Not Track" or Global Privacy Control in your browser stops it.
Only after you press "Chat with us", Crisp keeps a chat session ID in your browser (see section 3).
Local storage remembers small preferences (for example banner dismissals). It never leaves your device.
Device ID: a random ID in local storage that identifies this browser as one of your (up to 5) devices. It is sent to us only while you're signed in, with each request, and is deleted from our records when you remove the device or don't use it for 60 days.
Where you came from: if you arrived from another site or a tagged link (for example a newsletter), the site name and campaign tags are kept in your browser for this visit (30 days if you accept analytics cookies), and sent to us only if you sign up for emails, so we know which newsletters and pages help. We also keep the page you first arrived on and the type of site that sent you (a search engine, another site, or none), and add them to your account once when you create one, so we know which pages help people join. If you tapped one of our sign-up buttons in the same tab just before, we add which one (a short tag naming the button, and the page it was on). Not with Do Not Track or Global Privacy Control switched on.

Third-party advertising cookies: none.

Help improve the site: tap counts and answer timing

Two more things help us improve the site. Both are on unless you turn them off.

Tap counts. On about one page view in four, the anonymous note above also lists which links and buttons on the page were tapped, named by the part of the page they are in and the name we gave them in our code. Now and then it also lists the links and buttons the page showed, so we can see what nobody uses. There is no cookie and no ID, nothing about where on the screen you tapped and nothing you type. The counts are only added into daily totals for each page and are deleted after 90 days.
Answer timing. When you answer practice questions while signed in, we note how long you take before your first answer, whether you change your answer and how often you switch between multiple-choice options. We use this only to personalize your practice.

To turn both off: use this switch in each browser you use. Tap counts are anonymous, so they can only be turned off in the browser. To turn answer timing off for your account on every device, email pbromfield@ibmathrevision.com.

5. Where your data is processed

We are based in the United Kingdom, and the companies that run parts of the site store or process data in these places:

Google (Firebase): our server code runs in Google's us-central1 region in the United States, with a few older functions in europe-west1 (Belgium); other Firebase services may keep data in the United States or other Google locations.
Google (Gemini API): AI marking and feedback, which may be processed in the United States or other countries.
Stripe: card payments, processed in the United States and other countries.
Resend: a US company that delivers our emails, so your email address and the email itself are processed in the United States.
Emergent, Crisp and ipapi.co: their servers may be in other countries.

How we protect it: each provider gets only what it needs for its job; every connection to them is encrypted (HTTPS); card details go straight to Stripe and never reach our servers. We use each provider under the terms it offers its customers, and each publishes its own privacy terms. If you'd like to know more, email us.

6. How long we keep it

Account and progress data: until you ask us to delete it. Payment records: as long as tax rules require. Updates emails: until you unsubscribe or ask us to delete them. Device records: 60 days after a device was last used. Anonymous page-level counts: 90 days.

7. Children and teens

The site is for students aged 13 and older, their parents and their teachers. Children under 13 must not create an account. We don't knowingly collect personal information from a child under 13; if we learn that we have, we delete that account and its data. If you are a parent or guardian and think your child under 13 has given us information, email pbromfield@ibmathrevision.com and we'll delete it.

If you are 13 to 17, a parent or guardian can ask us about your data, and you can ask us to delete it yourself.

A parent or guardian the student links (or approves) sees their practice, topics, homework and test scores on a read-only parent dashboard and can choose a weekly summary email of the same. That email is off until the parent turns it on; the dashboard first says what it contains and how to stop it, it carries no advertising, and we record when it is turned on or off and which notice was shown. It stops from the dashboard or the one-click link in any email. The student can stop sharing with a parent at any time from their account page.

When a teacher uses the site with a class, we use students' information only to run the site for that class: never for advertising, and never sold.

8. Your privacy rights, including US state rights

Wherever you live, you can ask us to:

Know and access: tell you what personal information we hold about you and give you a copy.
Correct: fix anything that's wrong.
Delete: delete your account and its data. We'll do it within 30 days.
Portability: give you your data in a machine-readable format (JSON).

Residents of California and of other US states with consumer privacy laws (for example Colorado, Connecticut, Virginia and Utah) may have these rights under their state's law. We give them to everyone, whether or not a law requires it, and we won't treat you differently for using them.

We don't sell or share personal information. We don't sell it, we don't share it for cross-context behavioral (targeted) advertising, and we don't use it for profiling that has legal or similarly significant effects, so there is nothing to opt out of. We honor Global Privacy Control and Do Not Track signals as section 4 describes.
What we collect (the categories state laws use): identifiers (email address, name, device ID); commercial information (your plan and payment records); education information you give us (practice answers, scores, class); internet activity (the anonymous page counts and answer timing in section 4); and approximate location (country and city, only if you accept analytics cookies). We get it from you, from your teacher or parent where they link to you, and from our service providers. We use it for the purposes in section 2 and disclose it only to the service providers in section 3, for those purposes.
How to ask: email pbromfield@ibmathrevision.com from the email address on your account. We may ask you to confirm it's you. A parent or guardian can ask for a child's data, and you can have someone ask for you with your signed permission. If we can't do what you ask, we'll say why; reply to that email to appeal and we'll look at it again.

If you live in the UK or the European Union, you have these rights under the UK GDPR or the GDPR, and you can complain to the UK Information Commissioner's Office or your local data protection authority.

9. Changes

If we change this policy in any meaningful way, we'll email everyone with an active account. Small clarifications just get a note at the top of this page.

10. Contact

Pete Bromfield · AP Math Revision · pbromfield@ibmathrevision.com. See also the terms of service.