Privacy policy

• Account: email address and, if you sign in with Google, the name and profile picture Google returns.
• Study data: subjects, qualifications, target grades, exam dates, every attempt you submit, the marks we award, and the observations we generate from your work.
• Uploads: photos of handwritten answers you send from your phone. These are stored so we can mark them against the mark scheme.
• Billing: payments are handled by Stripe. We never see or store card numbers. We keep a Stripe customer ID and a record of your pass purchases.
• Technical: IP address and user agent in request logs retained by our hosting provider; authentication cookies set by Supabase to keep you signed in.
• Product use: timestamps and internal identifiers for setup, practice, checkout, and pass-purchase events; aggregate marks, rep and session counts, duration bands, launch and plan type, pass status, and deployment environment. Product analytics never includes answers, photos, or email addresses.

To run and improve the product: build your practice plans, mark your answers, show your progress, understand whether students complete the practice loop, and keep your account secure. We do not sell your data, use it for advertising, or share it with anyone outside the processors listed below.

• Supabase (EU region): database, authentication, file storage.
• Vercel: application hosting and edge request routing.
• Stripe: payment processing.
• Google (Gemini): AI marking of your answers, answer explanations, and session debriefs.
• Cloudflare R2: public delivery of exam question and mark-scheme images.

Marking, answer explanations, and session debriefs send the relevant question and mark-scheme images, your answer, and recent session data to Google. Google's own data-processing agreement governs whether that content can be used to train its models; we encourage you to review Google's published DPA.

Account and study data are retained while your account exists. When you delete your account we delete it from our database; provider-side backups age out on our processors' standard schedules (typically up to 30 days). Billing records (Stripe customer ID, pass purchase history) are retained for seven years to meet UK tax and accounting obligations. Server logs are retained per our hosting provider's standard retention for the plan we're on.

Under UK/EU GDPR you can:

• Access the personal data we hold about you.
• Correct it if it is inaccurate.
• Delete your account and the associated study data.
• Receive a copy of your data in a machine-readable format.
• Object to or restrict our processing of it.
• Lodge a complaint with the UK Information Commissioner's Office (ico.org.uk) or your local EU data-protection authority.

You can exercise the access, deletion, and data-export rights above directly in Settings (Download my data; Delete your account), or email hello@papergrinder.com and we'll action your request within 30 days.

We set authentication cookies (managed by Supabase) to keep you signed in, and, if you open an invite link, a cookie that remembers the invite code for up to 14 days or until you finish signing up. These are strictly necessary and are the only cookies we use. We do not run analytics cookies, advertising cookies, or any tracking pixels.

Paper Grinder is built for secondary-school students. In the UK and EU, users under the age of 16 need parental consent under UK GDPR Article 8. We do not verify ages: by creating an account you confirm that you are 16 or older, or that your parent or guardian consents to you using Paper Grinder. If you believe a child under 16 is using an account without consent, email us and we'll delete the account.

Data may be processed in countries outside the UK and EEA (notably the United States, for Stripe, Vercel, and Google). Each processor is contracted under the UK International Data Transfer Addendum or EU Standard Contractual Clauses.

Material changes are announced by email at least 14 days before they take effect. The "last updated" date at the top reflects the latest revision.

Controller: Paper Grinder (United Kingdom). Contact: hello@papergrinder.com.