Privacy Policy

asterisk revision is a study application built for students. If you have questions about this policy or your data, you can reach us at hello@asterisk.app.

We collect data you give us directly, and data generated as you use the app:

• Account data — your name, email address, and a hashed password (if you create an account). Guests don't need an account.
• Profile data — your education system, target grades, study hours per week, your age band, and onboarding answers (what you struggle with, when you study best, how you feel about exams).
• Study data — subjects, topics, past papers and attempts, wrong questions, flashcards and decks, notes, timer sessions, tasks, habits, and analytics derived from these.
• AI conversations — every message you send the assistant and every reply, stored against your account (see “AI features”).
• Safety records — when the safety filter fires, a record of that it fired, where, and which kind — never the words you wrote (see “Safety”).
• Settings — your theme, accessibility preferences (font scale, reduced motion, high contrast), and pomodoro configuration.

We count how the product is used in our own database — which features get used and how quickly pages load — never what you write. We do not install third-party analytics trackers or use advertising cookies, and nothing about your use is sent to an analytics company.

If you create an account, your data is stored in a PostgreSQL database hosted by Neon in the London, UK region. The application itself is hosted on Vercel. Both are reputable cloud providers with their own security and compliance programmes.

If you use asterisk revision without an account (as a guest), your study data stays in your browser's localStorage and IndexedDB and is deleted if you clear your browser data. Two things about a guest do reach our servers: the text of any AI message you send (it has to, for the AI to answer), and a count of how many AI messages your connection has used, kept against a hashed version of your IP address for 30 days.

asterisk revision includes AI features: an assistant, flashcard generation, and practice test generation. When you use these, the text you enter is sent over an encrypted connection to Anthropic, whose Claude models generate the response. Anthropic processes that text on our behalf.

• Assistant conversations are stored. Every message you send and every reply is saved to your account so the conversation is there when you come back. They are deleted 365 days after they were written, or when your account is deleted, whichever comes first.
• Flashcard and practice-test prompts are not stored by those two features; the cards and questions they produce become part of your study data.
• We don't use your study data to train AI models. Whether Anthropic uses API inputs for training is governed by its own terms, which we have not yet had a lawyer confirm — the DPIA says so plainly.
• AI-generated content may be inaccurate. Always verify against your exam specification and teacher guidance.

Every message sent to an AI feature is checked twice before anything answers it: first against a list of phrases about self-harm, suicide, abuse and eating disorders, then by a small AI safety classifier (also at Anthropic) that reads the message and returns only a risk level. If either check fires, the chat stops — no AI reply at all — and you are shown helplines for your country (in the UK: Childline 0800 1111, Samaritans 116 123, 999 in an emergency). The phrase list has only been verified in English.

Text you publish to the Library is checked the same way before other students can see it. Your own notes, cards, tasks and imports are not checked.

When a check fires we record that it fired: the time, which feature, which kind of concern, and either your account id or — if you are a guest — a hash of your connection. We never record what you wrote in that record. A high-risk flag is emailed to a named safeguarding contact, again without your words, and a person reviews it. The message itself is only ever read by that person, deliberately, and that reading is logged.

asterisk revision is designed for students, including those studying for GCSEs and A-Levels — who may be under 16. During onboarding we ask which age band you are in. If you tell us you are under 13, the assistant only answers study questions and redirects anything else to a trusted adult or Childline. We do not ask a parent or guardian to confirm a 13 to 17 year old's account, and this policy does not claim that we do.

If you're a parent or guardian and believe your child has provided data without permission, contact us at hello@asterisk.app and we'll delete it.

• Your account and study data — for as long as your account is active.
• Assistant conversations — 365 days from the date of each message.
• Guest AI usage counts — 30 days from the last message.
• Safety records — kept, without your words, so that the filter can be counted and reviewed. When you delete your account the record stops pointing at you.
• Deleted notes, decks, papers and tasks — kept in the bin for 30 days so you can restore them, then permanently deleted.
• A record that something was deleted — the kind and id of a deleted record, never its content, for 90 days, so a device that was offline cannot bring it back.
• Usage counts — which features were used, without what you wrote, for 365 days; the cost of each AI request for 400 days.
• After you delete your account — the account is closed immediately and signed out on every device. For 30 days you can reopen it by logging in with your password; after that a scheduled job permanently deletes it and everything in it.

Guest study data remains in your browser until you clear it.

Depending on where you live, you may have the following rights regarding your personal data:

• Access — request a copy of the data we hold about you. Settings → Your data → Export downloads everything, including your conversations and safety records.
• Rectification — ask us to correct inaccurate data.
• Erasure — ask us to delete your data (or do it yourself via the Account page).
• Portability — receive your data in a machine-readable format.
• Objection — object to certain processing of your data.
• Withdrawal of consent — withdraw consent at any time (for consent-based processing).

To exercise any of these rights, use the in-app tools (Account → Delete account) or email us at hello@asterisk.app. We respond within 30 days.

We don't sell your data. We don't share it with third parties for advertising. We share data only with the providers that run the service: Neon (database hosting), Vercel (application hosting), Anthropic (AI responses and the safety classifier), Resend (sending account emails), and Stripe (payments, if you subscribe). These providers process data on our behalf and under our instructions.

We may disclose data if legally required (e.g. by court order) or to protect the rights, property, or safety of our users.

We take reasonable measures to protect your data: passwords are hashed with bcrypt, the database is access-controlled, and all traffic is encrypted with HTTPS. No system is perfectly secure, but we do our best. If a breach occurs that affects your data, we'll notify you.

We may update this policy as asterisk revision evolves. When we do, we'll update the “Last updated” date at the top. If we make material changes, we'll notify you in the app or by email (if you have an account).

Questions about this policy? Email us at hello@asterisk.app.