Privacy Policy

We only collect what's needed to run the service and improve your experience:

• Account info: Your email address and an encrypted password when you sign up. Optionally, your name and display name.
• Practice data: Your test results, scores, and progress — so you can track how you're improving.
• Community content: Posts and comments you write in the forum.
• Usage data: We use Google Analytics to understand how people use the site — pages visited, time spent, device type. IP addresses are anonymised.

• • Running the service: Managing your account, saving your progress, and providing your test results.
• • Improving things: Using analytics to understand what's working and what isn't.
• • Keeping it free: Showing ads via Google AdSense to help cover costs.
• • Security: Preventing abuse and keeping the platform safe.

Your account data is stored securely by Supabase, our authentication and database provider. Supabase stores data within the EU and is fully GDPR-compliant.

Google (Analytics & AdSense) processes some data in the US, protected by Standard Contractual Clauses and appropriate safeguards as required by UK GDPR.

We don't sell your data to anyone. Ever.

• • All data is encrypted in transit (HTTPS/TLS). Passwords are hashed and never stored in plain text.
• • Access to personal data is strictly limited.
• • Supabase provides enterprise-grade infrastructure security including encryption at rest.
• • In the unlikely event of a data breach, we'll notify affected users and the ICO within 72 hours.

While we take security seriously, no online service can guarantee 100% security. We do our absolute best.

Under UK GDPR, you have the right to:

• • Access — see what data we hold about you
• • Correct — fix any inaccurate information
• • Delete — request removal of your personal data (you can also do this directly from your profile settings)
• • Export — get a copy of your data in a portable format
• • Object — opt out of certain types of processing
• • Withdraw consent — for cookies and personalised ads, at any time

To exercise any of these rights, reach out on the Community Forum or use the contact page. We'll respond within 30 days.

Not happy with our response? You can complain to the Information Commissioner's Office (ICO).

• • Account & practice data: Kept while your account is active. Deleted within 30 days of account deletion.
• • Community posts: May be retained (anonymised) after account deletion for community continuity.
• • Analytics: Google Analytics data is automatically deleted after 26 months.
• • Ad cookies: Follow Google's standard cookie lifespans (max 13 months).

This service is aimed at adults (train driver roles require you to be 18+). We don't knowingly collect data from anyone under 16. If we find we have, we'll delete it promptly.

We may update this policy occasionally. When we do, we'll update the date at the top and let you know about any significant changes. Your continued use after changes means you accept the updated policy.