Privacy Policy

EyeRevise ("we", "us", "our") provides a revision app (including a web version) for UK optometry students. We are based in the United Kingdom.

For any privacy matter, including data subject requests, please contact us at support@eyerevise.co.uk.

• Account data — the email address and password you register with, and your display name. You sign in with email and password; we do not use third-party social sign-in.
• Profile data — optional details you provide, such as your university and study year.
• Usage and progress data — questions attempted, answers selected, whether they were correct, scores, mock-exam attempts, flagged/bookmarked questions, and your day streak.
• Subscription data — your plan and subscription status, and the Stripe customer/subscription identifiers needed to manage billing. We do not store your payment card details (see §5).
• Communications — emails you send us (for example support or feedback) and our replies.
• Technical/log data — limited technical information generated when the app talks to our servers (for example timestamps and error logs), used to operate and secure the service. Our hosting platform (Lovable) processes runtime error reports on our behalf as essential operational logging.

• To provide and operate the app and your account.
• To save your progress and power your review lists, mock results and progress statistics.
• To provide and manage your subscription and process payments (via Stripe).
• To improve the product (fix bugs, prioritise features), using aggregated, de-identified data where possible.
• To communicate with you about updates and customer support.

• Contract — to provide the service and subscription you signed up for.
• Legitimate interests — to improve, secure and operate the service.
• Consent — for analytics and advertising cookies (Google Analytics 4, Meta Pixel, TikTok Pixel) and any future marketing emails. You can withdraw consent at any time via Cookie choices.
• Legal obligation — to meet our regulatory and tax duties.

We use the following processors to operate EyeRevise:

• Supabase — our backend platform: it provides our database (PostgreSQL), authentication, and serverless (Edge) functions, and hosts your account, profile, usage/progress and subscription data.
• Stripe — our payment processor. Stripe handles subscription checkout and billing (Stripe Checkout, Stripe Billing and the Stripe Customer Portal) and processes your payment card data directly. EyeRevise never receives or stores your full card details.
• Email delivery — authentication emails (such as email verification and password-reset links) are sent on our behalf by our email/SMTP provider.
• Google (Google Analytics 4) — only when you consent to Analytics cookies. Used to measure site usage. Data may be processed outside the UK (see §6).
• Meta Platforms (Meta Pixel) — only when you consent to Advertising cookies. Used to measure marketing campaigns and for retargeting. Visitor data is shared with Meta and may be processed outside the UK (see §6).
• TikTok (TikTok Pixel) — only when you consent to Advertising cookies. Used to measure marketing campaigns and for retargeting. Visitor data is shared with TikTok and may be processed outside the UK (see §6).

We do not sell your personal data and we do not run third-party advertising inside the app itself.

Our backend data is hosted by Supabase in the UK/EU region (eu-west-2, London). Some processors — in particular Stripe — may process or transfer data outside the UK. Where that happens, we rely on the UK International Data Transfer Agreement (IDTA) / Addendum, the EU Standard Contractual Clauses, and/or adequacy decisions to protect your data.

We retain your account and usage data for as long as your account is active. If you delete your account, we permanently delete your personal data within 30 days, except where we must keep limited records for legal, tax or fraud-prevention reasons (for example, transaction records held by Stripe).

Under UK GDPR you have the right to access, correct, delete, or port your personal data, to object to or restrict processing, and to withdraw consent at any time.

To request account & data deletion, email support@eyerevise.co.uk from the address on your account with the subject line "Delete my account". We are also adding the ability to delete your account from within the app's settings.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ico.org.uk).

EyeRevise is intended for university-age users and is not directed at children under 18. We do not knowingly collect data from anyone under 18. If you believe a child has provided us with personal data, please contact us so we can delete it.

On your first visit we show a cookie consent banner with three equally prominent choices: Accept all, Reject all, and Manage preferences (separate toggles for Analytics and Advertising). No analytics or advertising script is loaded, and no non-essential cookie is set, until you consent to that category. You can change or withdraw your choice at any time by clicking Cookie choices in the footer.

Essential (no consent required). We use a small amount of local storage and first-party cookies to keep you signed in and remember preferences such as your theme. These are strictly necessary to provide the service and are not used for advertising.

Analytics (consent required). If you accept Analytics, we load Google Analytics 4, which sets first-party cookies — typically _ga (up to 2 years), _ga_<container-id> (up to 2 years) and short-lived helpers such as _gid (24 hours) — to measure pages viewed, approximate location (country/region), device and referrer. We send anonymised IPs and use Google Consent Mode v2 signals.

Advertising (consent required). If you accept Advertising, we load the Meta Pixel and the TikTok Pixel to measure marketing campaigns and to enable retargeting on Facebook/Instagram and TikTok. These set cookies such as _fbp (Meta, ~3 months) and _ttp (TikTok, ~13 months) and share visitor data — including your IP address, page URL and an event ID — with Meta and TikTok respectively.

Withdrawing consent stops the relevant scripts loading on subsequent page loads and we clear the related first-party cookies where possible. Cookies set on third-party domains can be cleared from your browser's settings.

We may update this policy from time to time. If we make material changes we will let you know via the app or by email. The "last updated" date below shows when this policy was last changed.