Privacy policy.

Who we are

Untutored makes practice apps for children preparing for the 11+, and later the GCSE and A-Level. It is made and run by Theo Fletcher in Winchester, United Kingdom. It is independent and self-funded: there are no investors, no advertisers and no data business behind it.

This policy covers two things: this website, untutored.co.uk, and the Untutored 11+ app for iOS and Android. Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Untutored is the data controller for the small amount of personal data the website handles. The app sends us nothing, so there is no personal data from it for us to control. Any future app will be covered by an update to this policy before it is released.

The short version: there are no accounts, no sign-in, no analytics, no advertising, no tracking and no mailing list. The only personal data we ever receive is what you choose to type into the contact form, and we use it only to reply to you.

You can contact us about anything in this policy at privacy@untutored.co.uk.

What we collect

On this website. If you send a message through the contact page, we receive what you type into the form: your name, your email address, the topic you pick (Question, Bug report, Accessibility, Schools or Press) and your message. We use these to reply to you and to deal with whatever you asked about, and for nothing else. Our lawful basis is our legitimate interest in answering the people who write to us. You do not have to tell us anything you would rather not, though we cannot reply without an email address. Nothing you send is added to a mailing list, and we do not send marketing. The form also has a hidden field that only automated spam programs fill in; if it is filled, the message is dropped and nothing is sent.

The website has no accounts, no newsletter and, at present, no way to donate or pay. If that changes, this policy will change first.

Cloudflare, the company that hosts the site, keeps short-lived technical logs of requests to it: the internet (IP) address a request came from, the browser used and the page asked for. Every website host does this, to keep the site up and to block attacks, and our lawful basis for it is the same legitimate interest in running a secure site. We do not use these logs to identify or profile anyone.

The website also remembers one setting in your browser: whether you have turned on the dyslexia-friendly font at the bottom of every page. That is stored on your device only, as described under “Cookies and analytics” below, and is never sent to us.

In the Untutored 11+ app. The app collects no personal data. It has no accounts, no sign-in, no server, no analytics, no advertising, no crash reporting and no third-party software development kits (SDKs). It never connects to the internet; on Android it explicitly blocks the internet permission, so it cannot connect even by accident. Everything the app knows about your child is written to your own device and nowhere else. It keeps one record, in the app’s own private storage area, which other apps cannot read. That record contains:

• the profile name typed in when a profile is created, which can be any word and does not need to be a real name, and the avatar chosen from twelve drawn creatures, so the app can greet the child and tell profiles apart when several children share a device;
• the daily goal, and an optional exam date entered by a parent, which the child is never shown, so the app can tighten the practice schedule as the exam approaches;
• practice history: which questions were answered, whether they were right, when, how long rounds took, the difficulty level for each topic, and the streak and badges, so the app can choose the next questions and build the parent report;
• accessibility settings: text size, dyslexia-friendly font, colour scheme, reduce-motion and haptics preferences, so the app remembers how the child likes it set up.

While it runs, the app reads two settings from your device, its light or dark appearance and its Reduce Motion setting, to draw the screen; neither is stored. It uses your device’s clock and time zone to work out which calendar day a practice round happened on. We never receive a copy of any of this.

Crash reports. The app contains no crash-reporting software. If you have opted in, in your iOS or Android settings, to share diagnostics with app developers, Apple or Google may make anonymised crash logs for the app available to us through their developer tools. These describe the state of the app’s code when it crashed. They contain nothing from your child’s record, no name and no other content from the app. You can change that choice at any time in your device settings (iOS: Settings → Privacy & Security → Analytics & Improvements; Android: Settings → Google → Usage & diagnostics).

Children’s data

Untutored 11+ is used by children of about nine to eleven, so it is built to collect nothing about them. The app does not ask a child for anything it could send us, and it cannot send us anything at all. There is nothing for a parent to consent to, because nothing is collected.

That is also how the app meets the laws and store rules written for children:

• UK GDPR and the Information Commissioner’s Age Appropriate Design Code: no personal data is collected from a child, no profiling leaves the device, nothing nudges a child to share more, and the most private setting is the only setting, because everything stays local.
• COPPA, the US Children’s Online Privacy Protection Act: the app collects no personal information from children under 13 and transmits no persistent identifier.
• The Apple App Store and Google Play family policies: the app has no third-party analytics or advertising, no external links a child can tap and no purchases.

The parent report and the erase control live in the parent area, behind the grown-ups’ door in the app, which is guarded by an adult gate.

This website is written for parents and carers. We do not knowingly collect anything from a child through it. If you think a child has sent us a message through the contact form, email privacy@untutored.co.uk and we will delete it.

Where your data lives

Your child’s record lives only on your own device, in the app’s private storage. It is protected by the operating system’s app sandbox and by whatever passcode, Face ID, Touch ID or screen lock you use. Because nothing is transmitted, there is no data in transit to secure and no server of ours to breach. The app uses no encryption beyond what the operating system provides.

Your device may include the app’s record in a device backup that you control, such as iCloud Backup on iOS or Google backup on Android, if you have those switched on. Those backups are made by Apple or Google under their own terms and privacy policies, are encrypted by them, and are not visible to us. If you would rather the record were not backed up, turn off backup for the app in your device settings, or erase the record from within the app.

Your contact message travels from your browser to our website over an encrypted (HTTPS) connection, is turned into an email by Cloudflare Email Routing, and is delivered to our inbox with your address as the reply-to, so we can answer you directly. It is not stored on the website’s server and there is no database behind the form. The only copy is the email in our inbox, together with any replies.

Technical logs are held by Cloudflare on its own systems, not by us.

Who we share it with

Nobody, in the sense of selling, renting, trading or passing on your data. We do not share anything with advertisers, data brokers, schools or anyone else, and we never will.

A few companies handle data on our behalf, or as a side effect of how the web works:

• Cloudflare hosts the website, protects it from attacks and turns contact-form messages into email. It sees the technical data described in section 2.
• Apple and Google distribute the app through their stores and, if you have opted in, pass us anonymised crash logs, as described in section 2. Device backups are theirs too.

Cloudflare and Apple are US companies that operate worldwide, so some of this handling may happen outside the United Kingdom. Each does so under its own privacy policy and the UK’s rules on international transfers.

Supporters named in the app. The app’s opening screen shows the line “With help from:” followed by a name. These are people who have supported Untutored and agreed to be thanked in the app. The list is built into the app when it is released; the app does not fetch it, and it contains nothing about you or your child. Anyone named who would like their name removed can email privacy@untutored.co.uk and it will be gone from the next release.

Some pages link to other websites, such as the research sources and the app stores. Those sites have their own privacy policies, and this one stops at our door.

How long we keep it

Contact messages. We keep your email for up to twelve months after our last reply, so that we can pick the thread up if you write again, and then delete it. If your message reports a bug or an accessibility problem, we may keep a note of the problem itself, without your name or address, until it is fixed.

Technical logs at Cloudflare are kept for a short time and then discarded automatically.

Your child’s record stays on your device for as long as you keep it there. You can erase it from inside the app at any time, and deleting the app removes it too. We never hold a copy, so there is nothing for us to keep or delete.

Your font preference stays in your browser until you turn the toggle off or clear your browser’s site data.

Your rights

Under UK GDPR you have the right to ask what personal data we hold about you and to receive a copy, to have it corrected, to have it deleted, to restrict or object to how we use it, and to have it given to you in a portable form. To use any of these rights, email privacy@untutored.co.uk. We will reply within one month and will not charge you. For the website, the only personal data we are likely to hold is your contact messages, so in practice most requests come down to deleting an email thread, which we are glad to do.

For the app, we hold no personal data about you or your child to act on. The only copy of the record is on your device, and you have direct control over it:

• To see it: the parent area shows everything the app has recorded for each child.
• To correct it: the profile name, avatar, daily goal, exam date and settings can all be changed from within the app.
• To erase it: open the parent area, choose the child’s profile and press Erase this profile. The app says exactly what will be deleted and asks you to confirm. Erasure removes the record from the device’s storage, not just from view, and cannot be undone. Other profiles on the same device are unaffected. Deleting the app from the device also removes the record.

We make no decisions about you by automated means.

If you believe we have handled personal data improperly, you can complain to the Information Commissioner’s Office at ico.org.uk. We would rather you told us first at privacy@untutored.co.uk, so that we can put it right.

Cookies and analytics

This website sets no cookies. None at all: not for analytics, not for advertising, not for preferences. There is no analytics or tracking software of any kind, no advertising, no social media buttons and no embedded content from other companies, so nobody can follow you across other websites through ours. That is why there is no cookie banner: there is nothing to ask you about.

The one thing the site stores in your browser is your choice of font. When you press “Dyslexia-friendly font” at the bottom of a page, the setting is saved in your browser’s local storage under the name untutored-font, so the page can apply it before it draws. It is a single word, it is not a cookie, it is never sent to us or to anyone else, and it disappears if you turn the toggle off or clear your browser’s site data.

The app likewise has no cookies, no analytics, no advertising identifiers and no tracking of any kind.

If we ever add analytics to this website, we will update this section first and ask for your consent where the law requires it.

Changes to this policy

If the website or a future version of the app changes what it stores or does, this policy will be updated before that change goes live, the date at the bottom of this page will change, and the app’s privacy details in the App Store and Google Play will be updated to match. If a change is significant, we will say so plainly on this page rather than quietly editing it. The current version is always at untutored.co.uk/privacy.