Education Quest1. Who we are
Education Quest is an app for 7+, 8+ and 11+ practice. It is provided by Education Quest, 92a Evelyn Street, London SE8 5DD ("we", "us"). We are the data controller for the information described here. We are registered with the Information Commissioner's Office (ICO) as a data controller, registration number ZC268026.
Questions about privacy: support@educationquest.co.uk.
2. Children and parents
Education Quest is used by children, but accounts belong to parents and carers. A parent creates the account, adds their children and controls the settings, which sit behind a PIN. Children can't create accounts, make purchases, change settings or contact anyone through the app.
We follow the UK GDPR and the ICO's Age Appropriate Design Code (the Children's Code). We collect the minimum about children, have high-privacy settings by default, don't profile children for marketing, and don't use nudges to share more data.
We suggest using your child's first name or a nickname. Please don't put surnames or other identifying details in a child's name.
3. What we collect
| Information | What it is |
|---|---|
| Parent account | Your email address and password (stored only in scrambled, hashed form), and how you sign in. If you choose Sign in with Google on our website, Google shares your name, email address and profile picture with us to create your account; we use only your email address and don't receive your Google password. |
| Children's profiles | A first name or nickname, school year and target exam or area (for example "11+, Sutton"), for up to 4 children. |
| Learning progress | Questions answered, whether each answer was right, which answer was chosen, the kind of mistake, scores, stars, coins, streaks, mock paper results and anything written in the writing desk, with dates and times. |
| App settings | Choices such as the voice, timers, how lessons work and display adjustments (for example bigger text). These are synced so they work on each device. |
| Email choices | Which progress emails you want, when, and to which address, plus when emails were last sent. |
| Security and fair-use records | When the parent PIN is locked after wrong tries or is changed, with the device name, and when children were added (one plan covers up to 4 children and 6 new profiles every 30 days). |
| Subscription status | Whether you have Premium, which plan and when it renews. Payments are handled by Apple, Google or (on our website) Stripe: we never see your full card details. |
| Messages to us | If you email us, your message and email address. |
We don't collect children's photos, contacts, location, precise device identifiers or advertising IDs, and the app has no chat or social features.
4. What stays on the device
Some things are only ever kept on the phone or tablet and never sent to us:
- Learning support needs. If you choose areas of need for your child (for example cognition and learning), that choice stays on the device. Only the adjustments, such as "bigger text", are synced.
- The parent PIN.
- Face ID, Touch ID or fingerprint sign-in. If you turn this on, your sign-in details are kept encrypted in the device's secure storage (the iPhone Keychain or Android Keystore), are never backed up or synced, and are only unlocked by your face or fingerprint. We never receive your face or fingerprint data: the device checks it.
- Reminders. Practice reminders are scheduled on the device.
Voice answers. If you turn on "Answer by voice", the device's own speech recognition (from Apple or Google) turns your child's spoken answer into words after the microphone button is tapped. We don't record, receive or keep any audio. Apple or Google may process the speech under their own privacy terms. Spoken explanations use the device's built-in voices.
5. How we use it and why
| What we do | Lawful basis (UK GDPR) |
|---|---|
| Run your account, save progress, sync between your devices, choose questions at the right level and show progress in the parent area | Contract: to provide the service you asked for |
| Send the progress and results emails you switch on, and the account emails you need (confirming sign-up, resetting a password) | Contract |
| Manage your subscription and free trial | Contract |
| Send security emails (for example when the PIN is locked or changed) and enforce fair-use limits | Legitimate interests: keeping accounts safe and the service fair |
| Show how your child compares with other children in the same year, using anonymous, combined figures from at least 20 children | Legitimate interests: helping parents understand progress. No other family can see your child's details. |
| Fix problems and improve questions, using combined, de-identified answer statistics | Legitimate interests |
| Keep records we must by law (for example for tax) | Legal obligation |
We don't use children's data for advertising or marketing, and we don't make decisions about anyone using automated processing that has legal or similarly significant effects.
6. Who we share it with
We use a few trusted service providers to run the app. They process data only on our instructions, under written contracts:
- Supabase: our database and sign-in system.
- Resend: sends our emails.
- RevenueCat: checks and manages subscriptions. It receives your account ID and purchase records, not your name or card details.
- Apple and Google: provide the app stores and take payments under their own terms and privacy policies. Google also provides "Sign in with Google" on our website, if you choose to use it.
- Stripe: takes card payments on our website. It receives your email address, card details and billing country to process the payment and prevent fraud. Your card details go straight to Stripe, never to us.
- Vercel: hosts our website. Vercel Web Analytics counts page visits so we can see which pages are used. It uses no cookies, doesn't track you across other sites, and doesn't store your IP address or anything that identifies you.
We may also share information if the law requires it, to protect someone's safety, or if the business is sold (in which case this policy would continue to apply). We never sell personal information.
7. Where it is stored
Our database is hosted by Supabase in Ireland, in the European Union. The UK recognises the EU as giving personal data the same level of protection as the UK (an "adequacy" decision), so no extra safeguards are needed for this. Some providers (such as Resend, RevenueCat, Stripe and Vercel) are based in the United States. When data leaves the UK, we rely on the UK government's adequacy regulations (including the UK-US data bridge) or the ICO's approved contract clauses (the International Data Transfer Agreement or Addendum) to protect it.
8. How long we keep it
- Your account and children's data: until you delete a child or your account. Deleting your account removes it straight away from our live systems, and from backups within 30 days.
- Security and fair-use records: while your account exists, and deleted with it.
- Free week record: when an email address first gets an account, we keep a scrambled, one-way code made from it (not the address itself) and the date its free week started. We keep this for 13 months, even if you delete your account, only so the free week can't be restarted by deleting the account and signing up again.
- Email delivery logs: kept by Resend for a short time (up to 30 days) to show whether an email arrived.
- Purchase records: Apple, Google, Stripe and RevenueCat keep transaction records as the law requires (usually up to 6 years for tax).
9. Keeping it safe
Data is encrypted in transit (HTTPS) and at rest. Each family's data is separated by database security rules, so one account can never read another's. Passwords are hashed, and the parent area is protected by a PIN that locks after 5 wrong tries. If a data breach ever put your information at risk, we would tell you and the ICO as the law requires.
10. Your rights
You can ask to see, correct, download or delete the information we hold about you and your children, or ask us to stop or limit using it. Most of this you can do yourself in the app:
- Change a child's name or year: Parent area › Family & account.
- Delete a child: Parent area › Family & account › the child › Remove.
- Delete everything: Parent area › Family & account › Delete account. See Delete your account.
For anything else, email support@educationquest.co.uk from your account's email address. We'll reply within one month. If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113, though we'd like the chance to help first.
11. Emails and reminders
Progress and results emails are off unless you switch them on, and every one has a one-click link to stop them. You can also change them in Parent area › Settings › Results by email. Account and security emails are always sent, as they're part of keeping your account safe. We don't send marketing emails unless you've agreed to them.
12. Changes and contact
If we make important changes to this policy, we'll tell you in the app or by email before they apply. Contact us at support@educationquest.co.uk or by post at 92a Evelyn Street, London SE8 5DD.