Privacy notice

This explains what personal data SATs Practice Arena collects, why, and what you can do about it. The service is used by children, so it is written to be readable by the grown-up who set up the account and, in the section marked for them, by the child using it.

Who is responsible for your data

SATs Practice Arena is run from the United Kingdom by a private individual, and is not yet trading — payments are still switched off while the service is being finished. The full details of the data controller, including a name and a postal address, will be published on this page before any payment is ever taken. Until then, every question about data is answered by a person at info@satspracticearena.co.uk, usually within a day or two.

If you have a question about anything on this page, email that address. If you are not satisfied with the answer, you have the right to complain to the Information Commissioner's Office at ico.org.uk, which regulates data protection in the UK.

What we collect, and why

• An email address and a password. The account is set up by a grown-up with their email address. The password is stored only as a cryptographic hash by our authentication provider — it is never visible to us and cannot be recovered, only reset. Without these there is no way to sign in, so this is necessary to provide the service you asked for.
• A display name and an avatar. Whatever the child chooses to be called — usually a first name or a nickname — and an emoji. There is no requirement for this to be a real name, and using just a first name or a nickname is a perfectly good idea.
• Practice results. For each quiz: the subject, whether it was practice, a past paper or a mock, which year and paper, the topic or reading text, how many questions were answered, the marks scored, how long it took, and a breakdown by topic. This is the entire point of the product — it is what produces the progress report.
• Subscription status. Whether the account is free, monthly, yearly or lifetime, when paid access runs to, and an identifier issued by our payment processor so we can match a payment to an account.
• Ordinary technical logs. Our hosting and database providers keep standard server logs, which include IP addresses, for security and to keep the service running.

What we do not collect

We do not collect your child's date of birth, address, school, photograph or voice.

We do not use analytics, advertising, tracking pixels, or social media buttons. There is no Google Analytics on this site and no advertising network of any kind.

We never see or store card details. Payment is handled entirely by Stripe on their own hosted pages — card numbers are typed into Stripe, not into this site, and are never transmitted to us.

We do not sell personal data, share it with data brokers, or use it to train machine learning models ourselves.

Written answers are marked by Google's Gemini service, which receives the question, the mark scheme and what your child wrote — never their name or any way of identifying them. See "Who else processes it" below.

Cookies and local storage

We do not use advertising or analytics cookies, so there is no cookie banner to click through.

We store two things in your browser: a sign-in token, so you are not asked to log in every time, and a cached copy of recent results so the game and the dashboard still show something when the internet drops. Both are strictly necessary for the service to work as described.

Logging out clears both. The one exception is a quiz finished while the device was offline and not yet uploaded — that is kept until it uploads, because deleting it would lose your child's work permanently.

The cached results are stored separately per signed-in account, so a shared family computer will not show one child's results to another.

Our lawful bases

Performance of a contract — the account, the questions, the marking, the results and the progress report. You asked us to provide these; we cannot without the data above.

Legal obligation — records of payments are kept because tax law requires it.

Legitimate interests — keeping the service secure and working, including server logs and preventing abuse. We have considered this against your interests and consider it a low-impact and expected use.

We do not rely on consent for anything at present, because we do not do any of the things consent would be needed for. If that changes, we will ask, and asking will mean a real choice.

Who else processes it

Supabase — our database and authentication provider. Data is held in their EU (Ireland) region.

Stripe — payment processing. They receive what they need to take a payment; we receive back only whether it succeeded and an identifier.

Google — marks written answers. When your child types an answer in their own words, three things are sent to Google's Gemini service: the question, the official mark scheme, and what your child wrote. Nothing else goes — not their name, not their avatar, not their email, not any account identifier. Google is not told who wrote the answer, and short answers with a single right answer are marked on our own servers without Google being involved at all.

Cloudflare — hosting and content delivery for the site and the reading booklets.

jsDelivr — a public code library used by the site is loaded from this content delivery network, which means your browser makes a request to it.

Each of these is a processor acting on our instructions under a contract. Some of them are international companies, so data may be processed outside the UK; where that happens it is covered by the safeguards in UK data protection law, such as the International Data Transfer Agreement or an adequacy decision.

How long we keep it

Account details and practice results are kept for as long as the account exists, because the whole value of a progress report is that it goes back in time.

If you ask us to delete the account, we delete the profile and every practice result attached to it. This is permanent and cannot be undone.

Records required for tax purposes are kept for six years, as UK law requires. These are payment records held by us and by Stripe, not practice results.

Server logs are kept for a short period by our providers under their own retention policies.

Your rights

You can ask for a copy of the personal data we hold, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, or object to processing. You can also ask for it in a portable form.

Two of these you can do immediately without asking anyone: the avatar can be changed in the game at any time, and the full practice record can be exported to a CSV file from the grown-ups' dashboard.

The display name is currently set when the account is created and cannot be changed in the app afterwards. Email us and we will change it.

For anything else, including deleting the account entirely, email info@satspracticearena.co.uk from the address the account was set up with. We will respond within one month, which is the deadline UK GDPR sets.

There is no charge for any of this.

Children

This service is designed for children of about ten and eleven, and we have taken the Information Commissioner's Age Appropriate Design Code into account in building it.

The account is set up by an adult, using an adult's email address. Anything to do with money lives on the grown-ups' dashboard, behind that adult's password — a child using the game never sees a price, an upgrade prompt or a buy button.

We collect the minimum needed to mark answers and show progress. There is no profiling, no behavioural advertising, no nudging towards spending more time on the service, no streak notifications designed to pull a child back, and no public profile or contact between users.

Parents and carers hold the rights above on their child's behalf, and can exercise any of them by email.

For the child using it

Here is what we know about you: the name you chose, the emoji you picked, and how you got on in the quizzes you have done. That is all.

We do not know where you live or what school you go to, and we never show your name to anyone else. Nobody else using this can see you.

When you write an answer in your own words, a computer at Google reads it and works out how many marks it earns. It is shown the question, the mark scheme and what you wrote — it is never told your name. If it marks you wrongly, you or a grown-up can change the mark.

The grown-up who set up your account can see your scores — that is what the dashboard is for, and it is meant to help. If you ever want all of it deleted, ask them and they can email us.

Security

Everything travels over an encrypted connection. Passwords are stored only as hashes. Access to practice results is enforced by database-level rules that check the signed-in account on every single request, not by the app merely choosing what to show.

No system is perfect. If a breach ever occurs that is likely to put anyone at risk, we will tell the Information Commissioner's Office within 72 hours and tell you without undue delay.

Changes to this notice

If we change how data is used, this page changes and the date below changes with it. Material changes will also be notified by email to account holders.

This notice was last updated on 2026-08-07.