Privacy

ExtraLesson is for students preparing for CSEC Mathematics. Most of them are at secondary school and many are under 18, so this is written to be read by a sixteen-year-old rather than agreed to by a lawyer. It says what we hold, how long we hold it, and who else sees it. If you are a parent or guardian, the section at the end is for you.

What we store

• Your account. Name, email address, the island you chose if you gave one, your exam sitting and the modules you are working towards. Your password is stored only as a scrambled hash — we cannot read it, and nobody here can tell you what it is.
• Your work. Every answer you submit, what it scored, and which mark scheme rows you earned. Answers you have typed but not submitted are kept as a draft for 30 days so you can come back to a session.
• Photographs of your working, when you choose to take one, and the typed-up reading of what was on the page.
• Payment records. The email address, amount and reference Stripe sends us when you pay. Card numbers are entered on Stripe’s own page and never reach us.

Photographs are deleted after 7 days

A photograph of your working is deleted automatically 7 days after you take it. This is not a promise someone has to remember to keep — the database deletes it on a timer.

The typed-up reading of that photograph is kept, along with the marks it earned. That is what lets you look back at a question weeks later and see what your working showed. It is text, not an image of your handwriting.

Nothing is used to train models

We do not train, tune or build any model on your work, and we never will without asking you first, in plain words, for that specific purpose.

Being straight about how the marking works: to read your handwriting and check your working against the mark scheme, the photograph and your typed answers are sent to our AI provider (OpenAI) to be read, and the result comes straight back to us. That is the only reason anything is sent, and it is deleted here on the timer above. What OpenAI does with API requests is governed by their own terms rather than ours, so we point you at them rather than making a promise on their behalf.

Who else sees anything

Two companies, each for one job:

• OpenAI — reads photographs of your working and checks it against the mark scheme.
• Resend — sends our emails to you: password resets, and notices about your access and refunds. It receives your email address and the email itself, nothing else.

Stripe handles payment on its own page and tells us that an address has paid. Our app runs on Vercel and our database is MongoDB Atlas, so both hold the data in the ordinary course of hosting it.

We do not sell your data, and we do not share it for advertising. There is no advertising on ExtraLesson and no tracking pixels in it.

Deleting your account

Email us from the address on your account and say you want it deleted. We remove your account, your answers, your marks and any readings of your working, and we confirm when it is done. There is no button for this yet — it is done by hand, by a person, which is also why we ask you to email from the address we can check.

If you only want to stop, you can simply stop; nothing is charged again unless you buy access again.

Students under 18, and their parents

This is a product for people sitting CSEC, so most of the students using it are between 14 and 18. We would rather say that plainly than write a policy that steps around it.

A parent or guardian can email us to ask what we hold on their child, to see it, or to have the account and everything in it deleted. We will ask enough to be satisfied the account is your child’s before we do any of those — which is the same care we would want taken over our own.

Nothing a student does here is shown to another student. There is no parent login — a parent reaches us by email, as above — and no account can see any other account’s work.