Privacy Policy

Last updated: 22 August 2026

This policy explains what personal data we collect, why we collect it, and the rights you have over it. We aim to collect as little as necessary.

1. Who is responsible for your data

Developing Maths Ltd (company number 13700723), registered at Kemp House, 152–160 City Road, London, England, EC1V 2NX, is the data controller for the personal data described in this policy. We trade as IB Maths Help.

For any privacy question or request, contact us at phil@developingmaths.co.uk.

2. What we collect

Free use: you can browse and practise the free questions without creating an account. We do not require your name or email address for this.
Account & profile: when you create an account we collect your email address and the name you enter. You may optionally add your country, choose an account type (pupil or teacher), and select a course.
Study progress: if you mark questions as "Got it" or "To review" while signed in, we store these marks against your account so your progress is saved and synced across devices.
Issue reports: if you report a problem with a question or its mark scheme, we store your message, the question and topic involved, and the page address; if you are signed in we also store your account email and ID, so we can investigate and fix it.
Account & purchase: when you buy full access we keep a record that you have paid (so we can grant and verify your access). Your card details are entered directly with Stripe - we never see or store your full card number.
1-to-1 tuition bookings: if you book a tuition session, we collect your name and email address, the pupil's name (if different from the person booking), the course, and the lesson time you selected. We use this to check calendar availability and create/manage the booking via Google Calendar, and to send you confirmation and reminder emails. Your card details for tuition payments are, as above, entered directly with Stripe.
Usage data (analytics): only if you accept analytics cookies in the cookie banner, we use Google Analytics (GA4) and PostHog to collect data about how visitors use the site - pages visited, time on site, general geographic location (country/city), device type, browser, and which buttons/links you interact with. PostHog also records session replays (a video-like reconstruction of on-page interactions, such as mouse movement and clicks) to help us find and fix usability problems; text you type into form fields is masked by default and is not captured in replays.
Error monitoring: we use Sentry to automatically capture technical error reports (e.g. a broken page or feature) so we can fix bugs quickly. This can include the page you were on, browser/device information, and - if you are signed in - your account ID, but not your typed answers or messages.
Technical data: our hosting provider (Cloudflare) processes limited technical data such as IP address and browser type to deliver and secure the site. This is standard for any website and is handled under Cloudflare's own privacy terms.

3. Cookies & similar technologies

We use the following categories of cookies and local storage on this site. When you first visit, a cookie banner asks whether you accept analytics/error-monitoring cookies - nothing in the "Analytics & monitoring" category below loads until you accept. You can change your choice at any time using the cookie settings control below - this does not sign you out or clear anything else stored in your browser.

Current choice: Loading…

Essential (always active, not covered by the cookie banner)

Authentication tokens - set by Supabase in your browser's local storage to keep you signed in to your account. Without these, login cannot function.
Payment session cookies - set by Stripe during the checkout process to prevent fraud and process your payment securely.
Cookie choice - a small entry in your browser's local storage recording whether you accepted or declined analytics cookies, so we don't ask again every visit.

Analytics & monitoring (only after you accept)

Google Analytics (GA4) - sets cookies including _ga (expires 2 years), _ga_6XR0S2P7GM (expires 2 years), and _gid (expires 24 hours) to distinguish unique visitors and record session information. Data is sent to Google's servers, which may be located outside the UK/EEA (Google applies standard contractual clauses or equivalent safeguards). IP addresses are anonymised before storage.
PostHog - sets cookies/local storage to distinguish visitors, record which features are used, and (see above) capture session replays. Data is processed on PostHog's EU servers.
Sentry - does not set a tracking cookie; it activates alongside the other analytics tools (bundled together under the same consent choice) to capture error reports as described above.

If you accepted analytics cookies but change your mind, or if you want to opt out of Google Analytics specifically even while keeping other analytics enabled, you can also install the Google Analytics Opt-out Browser Add-on. Declining or opting out of analytics cookies will not affect your ability to use any part of the Service.

4. Why we use your data

To provide and maintain the Service, including granting paid access.
To process payments and prevent fraud (via Stripe).
To respond to your enquiries and provide support.
To arrange, confirm and manage 1-to-1 tuition bookings.
To save, sync and display your study progress.
To review and act on problems you report in questions or mark schemes.
To understand how the site is used and improve it (via Google Analytics).
To keep the site secure and functioning properly (via Cloudflare).

Legal bases (UK GDPR / GDPR): we process account and payment data on the basis of contract (providing the Service you purchased); we process security data (Cloudflare) on the basis of our legitimate interests in running a safe, functioning website. Analytics, session replay, and error monitoring (Google Analytics, PostHog, Sentry) run only on the basis of your consent, given via the cookie banner - not legitimate interests - and you can decline them without losing access to the Service.

5. Who we share data with

We share data only with the service providers listed below, who process it on our behalf:

Supabase - authentication and database hosting.
Stripe - payment processing.
Cloudflare - website hosting and security (Cloudflare Pages).
Google - analytics (Google Analytics GA4), only if you accept analytics cookies; and Google Calendar, to check availability and create tuition booking events if you book a 1-to-1 session (this is required to provide the booking and is not tied to cookie consent).
PostHog - product analytics and session replay, only if you accept analytics cookies.
Sentry - error monitoring, only if you accept analytics cookies (bundled with the same consent choice).
Resend - sending emails on our behalf, such as the weekly summary of reported issues.

We do not sell your personal data. We do not share it with any third party for their own marketing purposes.

6. International transfers

Some of our service providers (including Google, PostHog and Cloudflare) may process data outside the UK and EEA. Where this happens, appropriate safeguards are in place - such as UK adequacy decisions, standard contractual clauses, or equivalent mechanisms - to ensure your data is protected to UK GDPR standards.

7. How long we keep your data

We keep your account and access records for as long as your access is active, and in any event until 1 July 2027, plus any further period required to meet legal, accounting or tax obligations. Analytics data is retained by Google in accordance with their data retention settings (default 14 months). After the applicable period, data is deleted or anonymised.

8. Your rights

Under UK and EU data protection law you have the right to:

Access the personal data we hold about you.
Correct inaccurate or incomplete data.
Request deletion of your data ("right to be forgotten") - you can delete your account and its data yourself at any time from My Account → Delete account, or by emailing us as below.
Restrict or object to certain processing.
Receive your data in a portable format.
Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, email us at phil@developingmaths.co.uk. We will respond within one month. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk, or with your local data protection authority.

9. Children

The Service is aimed at students studying for the IB Diploma. If you are under 16, please use the Service with the involvement of a parent, guardian or school. We do not knowingly collect more data than necessary from young people, and we do not use analytics data to profile children. If a parent or guardian books 1-to-1 tuition, we collect the pupil's name as described in section 2 above so the tutor knows who the session is for - this is used only to arrange and run the lesson.

10. Changes to this policy

We may update this policy from time to time. The "last updated" date at the top of this page shows the current version. We will notify registered users of any material changes.