Privacy Policy

CtrlAltRevise ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and what rights you have in relation to it.

For the purposes of applicable data protection law (including the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018), CtrlAltRevise acts as the data controller in respect of personal data processed through the Platform.

By using the Platform you confirm that you have read this Privacy Policy. If you do not agree with our practices, please do not use the Platform.

Account information

• Display name and email address provided at registration.
• If you register via Google OAuth: your name, email address, and profile picture as supplied by Google.
• Qualification preferences, target exam session, and exam date, if you choose to provide them during onboarding. All such fields are optional.

Learning activity data

• Lessons viewed and progress within topics and qualifications.
• Quiz attempts, answers submitted, scores, and timestamps.
• Pseudocode submissions and practice session inputs.
• Mock examination attempts and results.
• Mastery and spaced-repetition review queue data.

Payment and billing

• Subscription payments are processed by Stripe, Inc. We do not store full payment card details on our servers. We retain a Stripe customer identifier and subscription status for account management.

Technical and usage data

• IP address, browser type, and operating system collected on each request.
• Authentication session cookies and local storage values used to keep you logged in and to remember your theme and preferences.

We process your personal data on the following lawful bases:

• Contract performance — to create and manage your account and to deliver the services you have requested, including processing payments.
• Legitimate interests — to improve the Platform, detect fraud, ensure security, and analyse aggregate usage patterns, where those interests are not overridden by your rights.
• Legal obligation — to comply with applicable law, including financial record-keeping requirements.
• Consent — where you have given specific consent, such as receiving optional marketing communications. You may withdraw consent at any time.

• To create, maintain, and authenticate your account.
• To deliver personalised learning content, track your progress, and surface spaced repetition review material.
• To process payments and manage your subscription.
• To send transactional emails, including registration confirmation, password reset, and subscription receipts.
• To diagnose technical issues, improve Platform content, and develop new features.
• To detect, investigate, and prevent fraudulent or unlawful activity.

We do not sell your personal data to third parties. We do not use your personal data for targeted advertising.

We share personal data with the following third-party processors, solely to the extent necessary to operate the Platform:

• Google LLC (Google OAuth) — used for optional sign-in via Google. When you choose Google sign-in, Google shares your name, email address, and profile picture with us. Google processes data in accordance with its Privacy Policy.
• Stripe, Inc. — used for payment processing and subscription management. Stripe processes your payment card data in accordance with its Privacy Policy and is certified to PCI DSS Level 1.
• Infrastructure and database providers — your data is stored on servers provided by our cloud infrastructure partners. These providers act as data processors under our instruction and are contractually prohibited from using your data for their own purposes.

Where we transfer personal data outside the UK or European Economic Area, we ensure appropriate safeguards are in place, such as adequacy decisions or standard contractual clauses.

We use cookies and browser local storage for the following purposes:

• Essential — authentication: session cookies that keep you logged in. These are strictly necessary; the Platform cannot function without them.
• Functional — preferences: local storage values that remember your chosen theme (light/dark) and accent colour. These do not track you across sites.

We do not currently use advertising, analytics, or cross-site tracking cookies or scripts from third parties.

We retain your personal data for as long as your account is active or as necessary to provide the service. Specifically:

• Account data is retained until you delete your account or request erasure.
• Payment and billing records are retained for seven years to comply with financial record-keeping obligations.
• Following account deletion, learning activity data may be retained in anonymised or aggregated form (not linked to you personally) for Platform improvement.

Under UK GDPR and applicable data protection law, you have the following rights in relation to your personal data:

• Access — to request a copy of the personal data we hold about you.
• Rectification — to request correction of inaccurate or incomplete data.
• Erasure — to request deletion of your data where there is no compelling reason for us to continue processing it.
• Restriction — to request that we restrict processing of your data in certain circumstances.
• Portability — to receive a copy of data you have provided to us in a structured, machine-readable format.
• Objection — to object to processing based on legitimate interests or for direct marketing.
• Withdraw consent — where processing is based on consent, to withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at ctrlaltrevise@gmail.com. We will respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

CtrlAltRevise is designed for students preparing for Cambridge examinations, who are typically aged 14 and above. We do not knowingly collect personal data from children under 13 years of age. If you are between 13 and 17, we encourage you to review this Policy with a parent or guardian.

If you are a parent or guardian and believe your child under 13 has provided personal data to us without your consent, please contact us at ctrlaltrevise@gmail.com. We will take prompt action to delete the data.

We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These include:

• HTTPS encryption for all data in transit.
• Industry-standard password hashing (bcrypt) for stored credentials.
• Access controls limiting data access to authorised personnel.

No method of transmission or storage is completely secure. We cannot guarantee absolute security of your data, but we will notify you and relevant authorities promptly in the event of a data breach affecting your rights and freedoms.

CtrlAltRevise is an independent learning platform. It is not affiliated with, endorsed by, or sponsored by Cambridge University Press & Assessment or Cambridge Assessment International Education. "Cambridge", "IGCSE", and "A Level" are registered trademarks of Cambridge Assessment International Education.

We may update this Privacy Policy from time to time to reflect changes to our practices or for legal, regulatory, or operational reasons. We will notify you of material changes by posting a notice on the Platform or by email. The date at the top of this page reflects when the Policy was last updated. Continued use of the Platform after changes take effect constitutes your acceptance of the revised Policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

CtrlAltRevise
Email: ctrlaltrevise@gmail.com

For our full Terms of Service, see the Terms of Service.