Privacy
Children’s data assessment
Many people who use Study Hack are under 18. This is our data protection impact assessment: what personal information is involved, what could go wrong, and what we do about it.
About this assessment
The UK GDPR and the ICO’s Age Appropriate Design Code (the Children’s Code) ask any online service likely to be used by children to assess the risks to them before it launches. This is that assessment for Study Hack, the free website and the Lab. It was made by Thomas Alderton, who runs Study Hack, on 2 November 2026.
We review it at least once a year, and before we add anything that would collect information. If that ever happens, this page and the privacy page will say what changed first.
What the service is
A free virtual science lab for GCSE students: the required practicals on a 3D bench, then exam questions on the student’s own results. Students aged about 14 to 16 use it, at home and at school, and so do teachers and parents. There are no accounts, no payments, no adverts and no chat.
What information is involved
- Work saved on the device. Progress, the lab book, papers, answers, settings and any name a student types in are kept in the browser’s own storage on that device. None of it is sent to us and we cannot see it, so we do not hold or process it.
- Technical data at our host. Cloudflare delivers the pages and protects the site from attacks. Like any web host it sees each visitor’s IP address and browser details while doing so. We do not use these to identify anyone, and we do not run analytics on them.
- Emails. If someone emails [email protected], or uses Report a problem (which opens their own email app), we see their email address and what they write. We use it only to read and answer the message, and keep it only as long as that takes.
- Share links. A link to a practical or a paper holds only the practical, or the paper and its settings. It never holds a name, answer or mark.
Why, and why no more
The hosting data is needed to deliver the site and keep it secure, and the emails to reply to people. Our lawful basis for both is legitimate interests: running a safe, working website and answering the people who write to us. Nothing else is collected, so there is nothing else to justify.
The site is built so that it cannot send anything: its security policy only lets a page talk to this website itself, and the Lab has no code that sends your work anywhere. There are no cookies, no analytics and nothing from other companies on the pages.
The risks, and what we do about them
| Risk | What we do about it | Risk now |
|---|---|---|
| Someone else using the same device sees a student’s saved work. | Work is saved only in that browser. The Lab’s Menu has Delete my work on this device, and a private window keeps nothing. | Low |
| A student puts personal details in an email to us. | We ask people not to, use the email only to reply, and do not keep it longer than that. | Low |
| A share link is passed on to people it was not meant for. | It holds only a practical or a paper, never anything about the person who made it or their results. | Low |
| Cloudflare processes IP addresses, sometimes outside the UK. | Cloudflare works for us under its data processing terms, which include the UK’s safeguards for transfers. We do not use the data to identify anyone. | Low |
| A link takes a student to another website (Tes, an exam board). | Links say where they go. Tes links are plain links with nothing attached, never inside a practical or a question. | Low |
| Features that nudge children to stay longer or share more. | There are no streaks, rankings, public profiles, chat, location or prompts to give information. | Low |
The Children’s Code, standard by standard
- Best interests and age-appropriate design: built for GCSE students, with nothing to sign up to.
- Transparency: a short, plain privacy page, and this assessment.
- Detrimental use and nudges: no streaks, rankings or prompts to share.
- Default settings, data minimisation and sharing: the most private setting is the only one, nothing is collected and nothing is shared.
- Profiling: suggestions of what to practise next are worked out on the device from the student’s own results, and never leave it.
- Geolocation, parental monitoring and connected toys: none.
- Online tools: Delete my work on this device, in the Lab’s Menu.
Outcome
The risk to children is low, and no risk is left that is high, so we do not need to consult the ICO before launch. Questions about this assessment go to [email protected]. You can also contact the ICO at ico.org.uk.