Privacy Policy
Version 0.1 (pre-pilot) - effective 12 October 2026
This is a pre-pilot version. Before the ChemResults pilot starts in January 2027, we will publish version 1.0, which adds who runs ChemResults, and ask you to agree to it the next time you sign in.
This policy explains what information ChemResults collects, why, where it is kept, and for how long. We have written it to be read by students, parents and teachers.
Who we are
ChemResults is a chemistry practice website for students preparing for the Cambridge International AS & A Level Chemistry (9701) exam. In this policy, "we" and "us" means ChemResults. We are the "data controller" for your information: we decide how it is used, and we are responsible for protecting it.
If you have a question about this policy or your information, email admin@chemresults.com.
Who can use ChemResults
- You must be 13 or older. ChemResults is not available to children under 13.
- If you are under 18, you need a parent's or guardian's permission to use ChemResults.
- If your school has an agreement with us, your school has agreed to you using ChemResults. You also agree to this policy and our Terms when you create your account.
What we collect
We collect as little as we can. Here is everything.
When you create an account
- Your email address, so you can sign in and so we can send you account emails (for example, to confirm your address or reset your password).
- Your password, if you sign up with email. It is stored in scrambled (hashed) form, so nobody, including us, can read it.
- A username, which we create for you at random. We don't ask for your real name.
- Your country and syllabus, which you choose when you first sign in. We use them to show you the right questions.
- Your role (for example, student).
- Your school, if your school has an agreement with us. We link your account to your school using your school email address.
- The date and time you agreed to this policy and our Terms, and which version you agreed to.
If you sign in with Google or Microsoft
Google or Microsoft sends us your email address, and usually your name and a link to your profile picture. Our sign-in provider (Supabase) stores these. ChemResults itself only uses your email address. It does not show or use your name or picture.
When you use ChemResults
- Assessments you create. If you share an assessment, the people you share it with see your username.
- How many ChemChat messages you send each day. We count them so we can apply a daily limit. We store the count, not the messages.
- Sign-in records. Our sign-in provider keeps a record of sign-ins, including the IP address (the internet address of your device or network) they came from. This helps keep accounts secure.
- Server logs. Our servers record technical events, such as which question page was opened and how long a reply took. These logs include your account ID (a random code, not your name or email). They never include what you type to ChemChat.
- Error reports. Our error-tracking service receives technical details when something goes wrong, along with the server log events described above. These can include your account ID, but never your email address, username or anything you type to ChemChat.
What we don't collect
- We don't ask for your real name, date of birth, phone number or address.
- We don't store your answers to questions or your results.
- We don't store your ChemChat conversations. A conversation exists only in your open browser tab. It is gone when you leave the question or close the tab.
- We don't use advertising, and we don't track you across other websites.
- We don't use analytics or advertising cookies.
- We don't sell your information, and we never will.
Why we are allowed to use your information
UK data protection law (the UK GDPR) says we must have a reason, called a "lawful basis", for each use of your information:
- To provide ChemResults to you (your account, assessments, ChemChat, account emails): because it is necessary to provide the service you signed up for (contract).
- To keep ChemResults secure and working (sign-in records, server logs, error reports, the daily ChemChat limit): because we have a legitimate interest in protecting accounts and fixing problems, and this uses as little information as possible.
We don't use your information for marketing, and we don't make automated decisions about you that have legal or similarly significant effects.
ChemChat, the AI tutor
When you answer a question, the feedback you see first has been written, or reviewed and approved, by teachers. ChemChat, our AI tutor, answers any follow-up questions you have about it. This section explains what happens to your information when you use ChemChat.
- What is sent to the AI model: your messages, the question you are working on, its teacher-written feedback, and the conversation so far on that question. Your email address, username and account ID are not sent.
- Where it is processed: Amazon Web Services (AWS) Bedrock, in the Asia-Pacific region only.
- No AI training: AWS does not use what is sent to Bedrock to train AI models, and does not share it with the companies that make the models.
- Not stored: AWS processes your message to produce a reply. We have turned off AWS's option to store these conversations.
- Safety checks: every message you type, and every reply, is checked by an automatic safety filter before you see the reply. Messages that contain personal details such as a phone number, email address or home address are blocked. Please don't share personal information with ChemChat. You can read more on our Safeguarding page.
Cookies
We use only the cookies ChemResults needs to work:
| Cookie | What it does |
|---|---|
| Sign-in cookies (set by Supabase) | Keep you signed in |
cr_onboarded | Remembers that you have finished setting up your account |
cr_show_welcome | Shows the welcome message once, after you finish setting up |
sidebar_state | Remembers whether you left the sidebar open or closed |
ChemResults also saves your choice of light or dark mode in your browser's local storage (as theme). It stays on your device and is never sent to us.
We don't use analytics, advertising or tracking cookies, so there is nothing to opt out of.
Who processes your information for us
We use these service providers to run ChemResults. Each one only receives what it needs to do its job.
| Provider | What it does for us | Where |
|---|---|---|
| Supabase | Stores your account and assessments; handles sign-in | Singapore |
| Amazon Web Services (AWS) Amplify | Runs the website; keeps server logs | Singapore |
| Amazon Web Services (AWS) Bedrock | Runs the ChemChat AI model | Asia-Pacific region |
| Sentry | Receives error reports and server log events | Germany (European Union) |
| Resend | Sends account emails, such as password resets | Japan |
| Google, Microsoft | Sign you in, if you choose to use them | Their own services |
Information stored outside the UK
Some of our providers store or process information outside the UK: in Singapore, the Asia-Pacific region, Japan and the European Union (see the table above). The UK recognises the European Union and Japan as protecting personal information to UK standards. For other countries, we rely on our providers' data protection terms approved for international transfers (such as the UK International Data Transfer Addendum), which require them to protect your information to the same standard.
How long we keep your information
| Information | How long |
|---|---|
| Your account, profile and assessments | Until you ask us to delete your account |
| Daily ChemChat message counts | Until you ask us to delete your account |
| ChemChat conversations | Not stored. Gone when you leave the question or close the tab |
| Server logs | 90 days, then deleted automatically |
| Error reports and the log events sent with them | Up to 90 days, then deleted automatically |
| Sign-in records (including IP addresses) | Up to 7 days, then deleted automatically |
Your choices and rights
You have the right to see, correct and delete your information, to ask us to limit or stop using it, to object to how we use it, and to get a copy of it to take elsewhere. We reply within one month.
- See your information: your profile page shows your country, syllabus and username. Your account page shows how you sign in. To get a copy of everything we hold about you, email us.
- Correct your information: change your country or syllabus on your profile page. For anything else, email us.
- Delete your account: email us from the address you signed up with. We will delete your account and the information linked to it within 30 days, and confirm by email. Server logs and error reports are deleted on their normal schedule (see the table above).
- Parents and guardians: if you believe your child under 13 has created an account, or you want your child's account deleted, email us and we will delete it.
Schools
If your school has an agreement with us, the school decides whether its students use ChemResults. We use school students' information only to provide ChemResults, as described in this policy and in our agreement with the school.
Keeping your information safe
Your information is sent over encrypted connections. Only you can see your account details. Other people can see an assessment you created only if you share it with them, or share its link. Passwords are stored in scrambled (hashed) form.
Changes to this policy
If we change this policy, we will update the version number and date at the top. If the change is important, we will ask you to agree to the new version the next time you sign in.
Contact
Email admin@chemresults.com with any question about this policy or your information.
If you are unhappy with how we have handled your information, you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint. We would appreciate the chance to put things right first, so please contact us before going to the ICO.