1. Who we are
QuestionsByTopic is a free physics revision platform for GCSE, AS and A-Level students. For any privacy-related queries, please contact us at james@qbtphysics.com.
2. What data we collect
When you create an account, we collect:
- Email address (required)
- Name (optional)
- Avatar selection (emoji)
- Education level (GCSE, AS, or A2)
As you use the service, we collect:
- Quiz performance: answers submitted, correctness, hints used, time spent
- Progress data: questions attempted per topic, success rates, streaks
- Session data: device type, session duration, topics covered
- Bookmarked questions
- Friend connections (if you use the friends feature)
- Mock paper results
If you submit feedback, we collect:
- Feedback type, message, and optionally your name and email
Guest users (no account):
If you use QuestionsByTopic without an account, we only store your score data locally in your browser (localStorage). No personal data is sent to our servers for guest users.
3. How we use your data
- To provide the revision service and track your learning progress
- To select appropriate questions based on your education level
- To display leaderboards and friend comparisons (name and avatar only)
- To send transactional emails (email verification, password reset)
- To improve the service through analytics (only with your consent)
4. Lawful basis for processing
Under UK GDPR, we process your data on the following bases:
- Consent — You consent to data processing when you create an account
- Contract — Processing necessary to provide the service you signed up for
- Legitimate interest — Analytics cookies (only with your explicit consent via our cookie banner)
5. Cookies
Essential cookies (always active):
- NextAuth session cookie — keeps you logged in
- CSRF token — protects against cross-site request forgery
Analytics cookies (consent required):
- Vercel Analytics — helps us understand how the site is used
You can manage your cookie preferences at any time via the cookie banner, the "Cookie Settings" link in the footer, or in your account Settings page.
6. Third-party services
We use the following third-party services to operate QuestionsByTopic:
- Vercel — Hosting and analytics (USA, with EU data processing)
- Resend — Transactional email delivery (email verification, password reset)
- Supabase / Railway — Database hosting (PostgreSQL)
We do not sell your data to any third parties. We do not use your data for advertising.
7. Data sharing
If you use the friends and leaderboard features, your name, avatar, and quiz statistics (total questions, correct answers, success rate) are visible to your accepted friends. Your email address is never shared with other users.
8. Data retention
- Account data is retained until you delete your account
- Password reset tokens expire after 1 hour
- Email verification tokens expire after 24 hours
- You can delete your account and all associated data at any time from the Settings page
9. Children's privacy
QuestionsByTopic is designed for students aged 13 and over. We do not knowingly collect personal data from children under 13. Users must confirm they are at least 13 years old when creating an account.
If you believe a child under 13 has created an account, please contact us at james@qbtphysics.com and we will delete the account promptly.
10. Security
We take reasonable measures to protect your data:
- Passwords are hashed using bcrypt (never stored in plain text)
- Rate limiting on authentication and sensitive endpoints
- Email verification required for new accounts
- HTTPS encryption for all data in transit
11. Your rights
Under UK GDPR, you have the right to:
- Access — Request a copy of the personal data we hold about you
- Rectification — Ask us to correct inaccurate data
- Erasure — Delete your account and all associated data (available in Settings)
- Portability — Request your data in a portable format
- Object — Object to processing based on legitimate interest
- Withdraw consent — Withdraw consent at any time (e.g. analytics cookies)
To exercise any of these rights, contact us at james@qbtphysics.com. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).
12. Changes to this policy
We may update this privacy policy from time to time. The "Last updated" date at the top of this page will be revised accordingly. We encourage you to review this policy periodically.
13. Contact
If you have any questions about this privacy policy or how we handle your data, please contact us at james@qbtphysics.com.