This policy explains what personal data the Zee Theory Center app collects, why, and your rights. We collect as little as possible: the app works without an account, and an account holds only what is needed to sell you a licence and let you use it on your devices.
Who we are
ZEE Dazzle Ltd, 60 Becher Street, Derby, DE23 8NN, United Kingdom is the data controller. Contact: support@zeetheorycenter.co.uk. ICO registration number: [ICO NUMBER].
What we collect
| Data | Why | Kept until |
|---|---|---|
| Email address | Your login, verifying the account, password resets and support | You delete your account |
| Password | Login. It is handled by Google Firebase Authentication and stored only as a secure hash — we never see it | You delete your account |
| A random account ID | Links your purchase to your account | You delete your account |
| Device records: a random ID created by the app, the device model (e.g. "Pixel 8"), platform, and when it was added and last used | Enforcing the licence limit of 2 devices, and letting you sign devices out | You sign the device out, it is unused for 180 days, or you delete your account |
| Purchase status: which store, product, date, and whether it is active or refunded | Unlocking the full version and handling refunds | You delete your account |
| Progress backup (only if you turn on cloud sync): your answers, flagged questions, mock scores, streak and test date | Keeping your progress the same on your devices | You turn sync off or delete your account |
| Question reports (only if you use “Report a problem”): the question number, the problem you chose, anything you write, the app version, the platform and a random ID used only for reports and stories (not the one in your device list) — not linked to your account | Fixing mistakes in questions, and the random ID stops one phone sending too many reports | Until the problem is dealt with, and no longer than 12 months |
| Your pass story (only if you choose “Share your story” and give permission): what you write, the name or initials you give (optional), the app version, the platform and the same random ID used for reports — not linked to your account | With your permission, sharing it on our website, app store pages and social media to encourage other learners | Until you withdraw it in the app (it’s deleted straight away), or we stop using it |
| Technical security data: IP address and an App Check device-integrity token, processed by Google Cloud when the app contacts our server | Protecting the service from abuse and fraud | Short-lived security logs |
We do not collect your name, date of birth, address, phone number, location, contacts or photos. There are no adverts, no advertising IDs, no analytics and no tracking. Voice answering uses your device's own speech recogniser; audio is not stored or sent to us. The Daily Challenge reminder and the home-screen widget work entirely on your phone; nothing is sent to us to set them up. Payment card details go to Apple or Google, never to us.
Progress on your phone. With cloud sync off, your progress is not sent to us. It is saved in the app on your phone. On iPhone and iPad, the system's own iCloud or computer backups may include it, as they do for most apps; those backups are controlled by you and Apple, not by us. The app's sign-in and licence details are kept in the secure Keychain set to "this device only", so they are not restored onto a different device. On Android the app opts out of system backups.
The web version. If you use the app in a web browser, your progress and settings are saved in that browser on that computer (its local storage), and the browser counts as one of your devices. Clearing your browser's site data removes them. To show emoji and some symbols, the browser downloads fonts from Google Fonts when a screen needs them, which means Google receives your IP address. The web version also uses Google's reCAPTCHA Enterprise, which checks signals from your browser to confirm requests come from the genuine app, to protect our server from abuse.
Our lawful bases
- Contract — your account, licence, device list and purchase status are needed to provide what you bought.
- Consent — the progress backup. Turn cloud sync off at any time; this deletes the backup.
- Legitimate interests — security data and device limits that protect the service and stop licence sharing.
Where your data is stored and who processes it
- Google Firebase / Google Cloud (account, devices, purchase status, progress backup) — stored in London, UK (europe-west2).
- RevenueCat, Inc. (USA) — checks your App Store or Google Play receipt and tells us whether you own the app. It receives your random account ID and purchase details, but not your email. Transfers are protected by the UK International Data Transfer Addendum / UK Extension to the EU-US Data Privacy Framework.
- Apple and Google process your payment as independent controllers under their own privacy policies.
- Google (web version only) — Google Fonts and reCAPTCHA Enterprise, as described above. reCAPTCHA is covered by the Google Privacy Policy and Terms of Service.
We never sell your data or share it for marketing.
Your rights
You can, at any time:
- See your data — in the app: More → Account → Download my data.
- Delete your account and data — in the app: More → Account → Delete my account, or see how to delete your account.
- Ask us to correct, restrict or stop using your data, or to give you a copy to take elsewhere.
- Withdraw consent to the progress backup by turning cloud sync off.
Email support@zeetheorycenter.co.uk for anything else; we reply within one month. You can also complain to the Information Commissioner's Office at ico.org.uk or 0303 123 1113.
Young people
Learner drivers can be under 18, so the app follows the ICO's Age Appropriate Design Code: privacy-protective defaults, no profiling for marketing, no location data and no sharing. You must be at least 13 to create an account; if you are under 18, ask a parent or guardian before buying.
How we protect your data
All connections are encrypted (HTTPS). Data is encrypted at rest by Google Cloud. The app cannot read or change the database directly — every request goes through our server, which checks who you are. Login tokens are kept in your device's secure storage (iOS Keychain / Android Keystore). If a breach ever put you at risk, we would tell you and report it to the ICO within 72 hours.
This website
This website has no accounts, no analytics and no tracking, sets no cookies of its own, and loads nothing from other companies. It is hosted by Cloudflare, which records basic logs (such as IP address and the page requested) to keep the site secure and working; these are kept for a short time only. Cloudflare may also set a strictly necessary security cookie to protect the site from automated attacks. Emails to our support address pass through Cloudflare's email forwarding to our mailbox. If you email us, we use your message only to reply to you.
Launch emails
If you give us your email address on this website to hear when the app launches:
- What we keep: your email address, when you signed up and the wording you agreed to. We don’t ask for your name or anything else.
- What it’s for: one email to tell you the app is available. We don’t use it for anything else, don’t add you to any other list and never share or sell it.
- Why we’re allowed to: your consent, which you give by signing up.
- Where it’s kept: on our server in the UK (London), the same place as app accounts.
- How long: we delete it once the launch email has been sent, or straight away if you use the unsubscribe link in that email or ask us at support@zeetheorycenter.co.uk.
To stop sign-ups from being abused, the server also keeps a scrambled (hashed) version of your connection’s IP address for one day, so one connection can’t sign up more than a few times a day. It can’t be turned back into your IP address.
Changes
If we change this policy we will update the date above and, for significant changes, tell you in the app.