Privacy Policy.

We collect the minimum information we need to plan your revision and send you WhatsApp reminders. We don't sell anything to anyone. We don't run ads. We don't share your data with marketers. The only third parties that touch your data are the ones we depend on to run the service (Google, Anthropic, Meta, Railway) — listed in section 4.

Here's the full list. If we ever add to it, this table is the first thing we update.

We do notcollect your contacts, location, photos, browsing history outside RevisionBot, or anything else from your Google account beyond what's listed above.

The legal basis under UK GDPR is contract — to provide the service you signed up for — and, in a couple of places, legitimate interestfor keeping the service secure and debugging it. We don't rely on consent except where the law specifically requires it (e.g. analytics cookies, which we don't currently use).

• Google— to authenticate you and to put events on your calendar. Google's privacy policy applies to its handling.
• Anthropic — to generate your schedule. We send a snapshot of your subjects and routine; we do not send your name, email, or WhatsApp number. Anthropic does not train on this data.
• Meta WhatsApp Cloud API — to send and receive WhatsApp messages on your behalf.
• Railway & Postgres — where our application and your data are hosted, in the EU/UK region.

We do not use third-party analytics, advertising trackers, or data brokers.

RevisionBot uses the Google Calendar API to create, update and delete calendar events on your behalf — specifically via the https://www.googleapis.com/auth/calendar.events scope.

Specifically, RevisionBot:

• Use.Only uses information received from Google APIs to provide and improve user-facing features that are prominent in the app — writing each revision session to the user's primary Google Calendar, and removing those events when a new plan replaces them.
• Transfer.Does not transfer Google user data to third parties, except as necessary to provide or improve user-facing features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with the user's explicit consent.
• Advertising. Does not use Google user data for serving advertising, including retargeting, personalised or interest-based advertising. RevisionBot displays no ads at all.
• Human access.Does not allow humans to read Google user data, except (a) with the user's explicit affirmative consent for specific messages, (b) when necessary for security purposes (such as investigating abuse), (c) to comply with applicable law, or (d) where the data has been aggregated and used for internal operations in accordance with applicable privacy and other laws.
• Scope of access.RevisionBot only reads, modifies or deletes Google Calendar events that it has itself created — each is tracked by the Google-issued event ID returned at insertion. We never enumerate, read or modify events that already exist on the user's calendar, and we do not access free/busy data, attendees, or any other calendar metadata.

We use one essential cookie to keep you signed in. It is strictly necessary for the service to function, and so does not require a consent banner under UK law. We do not currently use any analytics or marketing cookies. If we ever add analytics, we'll ask you first.

RevisionBot is designed for GCSE students, many of whom are 14 or 15. We ask under-16s to make sure a parent or guardian has agreed before signing up. Parents can write to us at any time to:

• see exactly what data we hold about their child;
• have it corrected;
• have the account deleted in full.

We respond to these requests within five working days, usually faster.

Under UK GDPR you have the right to:

• Access — ask for a copy of everything we hold about you.
• Rectify— fix anything that's wrong.
• Erase — have it all deleted.
• Object — to specific kinds of processing.
• Portability — get a machine-readable export.

Email privacy@revisionbot.co.ukfor any of these. There's no form to fill out.

Everything moves over HTTPS. Refresh tokens for Google are encrypted with AES-256-GCM before they hit the database. Database access is locked to our application servers. We don't email passwords or sensitive data. If a breach ever happens, we'll tell you within 72 hours, as the law requires.

For any privacy question: privacy@revisionbot.co.uk.

If we don't satisfy your request, you have the right to complain to the UK's Information Commissioner's Office (ico.org.uk). We hope it never comes to that.