Privacy Policy

Last updated: 2 May 2026

GCSE Boss ("we", "our", "us") provides a GCSE revision app for iOS. This Privacy Policy explains what information we collect, why we collect it, and what your rights are. It applies to your use of the GCSE Boss iOS app and the gcseboss.com website.

Who we are

GCSE Boss is a trading name of Apavai Ltd, a company registered in England & Wales (Company No. 17036797), registered office 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ. For privacy questions, use our contact form (choose "Support") or write to us at the address above.

Information we collect

Account information

When you create an account, we collect: your name (or chosen display name), email address, role (student or parent), and a password (stored as a hash, never in plain text). For students, we also store the GCSE subjects and exam boards you choose during onboarding.

Activity data

To make the app work, we record what you do inside it. This includes:

• Quiz attempts and results, by question and topic
• Flashcard reviews and confidence ratings
• Sessions completed and time spent
• Streak counters, XP, and achievement state
• Daily mood check-in responses (if you choose to use that feature)
• Homework scanner inputs (image data is processed for question recognition; the original image is not retained beyond what's needed to return the result)

Linked accounts

Paid plans allow up to two parents to link to a student account. Family plans can cover up to two students. When a parent links, we record the link relationship and share student progress data with the linked parent's account. You can unlink at any time from inside the app.

Subscription and payment

Subscriptions are processed via Apple's App Store and managed for us by RevenueCat. We do not receive or store your card details, billing address, or Apple ID password. We do receive a subscription identifier and entitlement status from Apple via RevenueCat.

Device and diagnostic data

We collect basic device data (iOS version, device model, anonymised device identifiers) for diagnostics, performance monitoring, and abuse prevention. We do not use this data to track you across other apps or websites.

How we use your information

• To provide the core revision experience: serving questions, generating explanations, tracking progress
• To personalise your study plan based on the subjects, exam boards, and topics you've engaged with
• To populate the parent dashboard for the linked parent of a student account
• To improve the app's performance, fix bugs, and develop new features
• To communicate with you about your account, the service, and security matters
• To comply with legal obligations and respond to law enforcement requests where required

Third parties we share data with

We use a small number of carefully chosen vendors to operate the service:

• Apple: for App Store distribution, authentication via Sign in with Apple (if used), and subscription billing
• RevenueCat: for subscription state management; receives a subscription identifier and entitlement state, not personal content
• Google AI (Gemini): for generating practice questions, explanations, and homework scan analysis. Question text is sent at generation time. We do not send your name or email to Gemini.
• Railway: our backend hosting and PostgreSQL database provider

We do not sell your data to advertisers, brokers, or any other third party. We do not share your data with anyone other than the vendors listed above and any successor entity in the event of a business transfer.

Data retention

We retain account and activity data for as long as your account is active. If you delete your account, we delete or anonymise associated personal data within 30 days, except where retention is required by law (for example, financial records of past transactions, which we retain for the period required by HMRC).

Your rights

Under UK GDPR you have the right to:

• Access: ask us for a copy of the personal data we hold about you
• Rectification: ask us to correct inaccurate data
• Erasure: ask us to delete your account and associated personal data
• Portability: ask us to provide your data in a machine-readable format
• Object: object to certain types of processing
• Withdraw consent: for any processing based on your consent

To exercise any of these rights, use our contact form. We respond within 30 days. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

Children's data

GCSE Boss is designed for users aged 13 and over. We do not knowingly collect personal data from children under 13. Where users are under 16, parental consent is required to create an account and link a parent. If we discover we have collected data from a child under 13 without proper consent, we will delete it.

Security

We protect your data using industry-standard measures: TLS for data in transit, encryption at rest for our database, hashed passwords, and access controls limiting who on our team can read user data. No system is perfect. If you believe your account has been compromised, contact us immediately.

International transfers

Some of our vendors (Google AI, RevenueCat) are based outside the United Kingdom. Where data is transferred internationally, we rely on standard contractual clauses or other lawful transfer mechanisms as required under UK GDPR.

Changes to this policy

We may update this policy from time to time. If we make material changes, we'll notify you via the app or email. The "last updated" date at the top of this page always reflects the current version.

Contact

Questions about this policy or your data? Use our contact form or write to us at the address above.