← Back to ChemLab · Terms of Service
Privacy Policy
Last updated: 27 October 2026
ChemLab ("we") is an A-level chemistry study tool at chemlab.study. This policy explains what data we hold about you, why, and the rights you have over it under the EU/UK General Data Protection Regulation (GDPR).
What we collect, and why
| Data | Why | Legal basis |
|---|---|---|
| Email address + password (stored only as a bcrypt hash — we cannot read it) | Your account and sign-in | Contract (Art. 6(1)(b)) |
| Study progress (topics mastered, quiz scores, practical checklists, game bests) | Syncing your progress across devices | Contract |
| Your Ranked record: Research Points, streak, rank history, shield skins, which questions, papers and lab steps have earned points and when, and your time zone (as your device reports it, e.g. "Europe/London") | Scoring Ranked fairly on our server — each question pays once a day, daily limits, check-ins at your own midnight — and the leaderboard | Contract |
| AI examiner usage: how many papers it marked for you each month, and how much text that took (a token count — never your answers) | The monthly marking allowance and a fair-use limit | Contract |
| Premium status and a Stripe customer reference | Knowing what you've paid for | Contract |
| Your sign-in email address (once confirmed) | Occasional emails about ChemLab itself, such as a price change or a major new feature. Every one has a one-click unsubscribe link, and unsubscribing never affects emails about your own account | Legitimate interests (Art. 6(1)(f)); you can object at any time by unsubscribing |
| Anonymous usage statistics: which pages and features are used (e.g. "a simulation was opened", "a quiz question was answered correctly"), page-load speed, error messages, the link or ad that brought a visit, and coarse context derived from the request (country and city, device type, operating system, browser, language, screen width) | Understanding which features help students, fixing bugs, and measuring which campaigns work | Legitimate interests (Art. 6(1)(f)) |
That is the complete list. We do not collect names, run third-party analytics or advertising trackers, sell data, or profile you.
How the usage statistics stay anonymous. They are recorded by ChemLab itself (first-party) and are not linked to your account, email or any user ID. Your IP address is never stored: to count unique visitors, we combine it with your browser's user-agent and a secret that changes every day, keep only a short one-way hash, and throw the IP away — so the hash cannot identify you and cannot connect your visits across days. To stop anyone flooding these statistics, a second daily-changing one-way hash of your network address (without the user-agent) counts how many events one network sent that day; it is not stored with the events and is deleted after two days. No cookies are used for any of this. The browser storage we use holds only your sign-in session, your own study progress, and the link that first brought you to ChemLab (for example an ad or a friend's referral link) — no tracking cookies, so no cookie banner is required. Usage statistics are kept for up to 24 months.
Payments
Card details are entered on and processed entirely by Stripe. Your card number never reaches ChemLab's servers; we store only Stripe's anonymous customer reference, your subscription's status and, during a free trial, its start and end dates.
Regional prices: to offer lower prices in some countries we use the country of your network (from our hosting provider's edge, never your IP address) to pick the price, keep that two-letter country code with the subscription at Stripe, and check the issuing country of the card that pays (a regional price is only for cards from those countries).
Free trials: to allow one free trial per person, we keep Stripe's card fingerprint — an opaque identifier Stripe derives from the card, not the card number — and keyed one-way hashes of the account's email address and, for Apple Pay / Google Pay cards, of the card's brand, last four digits, country and type, with and without the cardholder name, together with the account that used them. These cannot be turned back into your email or card details. They are kept for 3 years, including after an account is deleted, only to stop repeat free trials (legal basis: legitimate interests in preventing trial abuse). A match on the version without the name never refuses a trial by itself; it only flags the trial for a person at ChemLab to check. To limit free trials per network, we also keep, for 30 days, a keyed one-way hash of the network a trial was started from (the first three numbers of an IPv4 address, or the first three groups of an IPv6 address — never the address itself) with the account that started it; until the trial has started, that hash — and the keyed hash of the email address the trial was offered to, so the trial only starts for that same address — is also attached to the trial's subscription at Stripe. To keep free trials away from throwaway inboxes and forwarding addresses, we look up which mail servers receive email for your address's domain (a public DNS lookup; nothing is stored). A trial needs a confirmed email address: if you choose one before confirming, a note of the plan you picked is kept with your account so the trial can continue once you confirm; it is removed when the trial checkout opens and ignored after 3 days. We send two emails during a trial (a progress note and a reminder 2 days before the first charge) to the account's email and the payer's email, through our email provider Resend.
Bot protection
The sign-up, sign-in and password-reset forms use Cloudflare Turnstile to tell people from automated scripts. Turnstile looks at technical signals from your browser and connection (such as your IP address and browser type) only for that check; it sets no cookies and doesn't see what you type. Our sign-in provider Supabase verifies the result (legal basis: legitimate interests in keeping accounts and payments safe from automated abuse).
Where your data lives, and how it's protected
- Stored with Supabase in Frankfurt, Germany (EU) — encrypted at rest with AES-256.
- All traffic is encrypted in transit with TLS.
- Passwords are hashed with bcrypt; database access is restricted by row-level security so each account can only ever read its own row.
Who processes it
| Processor | Role | Location |
|---|---|---|
| Supabase | Database and authentication | EU (Frankfurt) |
| Vercel | Website hosting | Global CDN |
| Stripe | Payment processing | EU/US (EU-approved safeguards) |
| Resend | Account, free-trial and ChemLab news emails | EU (Ireland) |
| Anthropic | AI examiner: marks the written answers you submit (no name or email is sent) | US (EU-approved safeguards) |
| Cloudflare | Bot check on sign-up, sign-in and password reset (Turnstile) | Global network (EU-approved safeguards) |
How long we keep it
For as long as your account exists. Delete your account and everything above is erased immediately and permanently; any active subscription is cancelled at the same time. Two exceptions, both kept only to stop abuse (legal basis: legitimate interests): the free-trial identifiers described above, and — if you joined with a friend's referral link — the record of that referral (which account referred you, and a normalised form of your email address, so the same person can't be referred twice). Once the referral has paid out, that record also holds your Stripe customer reference for 180 days, so that a refund or chargeback of the payment can still take the extra days back; it is removed after that, or within a day once the referral has been taken back.
News emails: if you unsubscribe, we keep a keyed one-way hash of your email address (not the address itself) so that you never get these emails again — even if you delete your account and sign up again (legal basis: legitimate interests in respecting your choice). For 12 months after each news email we also keep a record that it went to that hashed address, so nobody gets the same email twice.
Your rights
- Access & portability — Account → "Download my data" gives you everything we hold, as JSON, instantly.
- Erasure — Account → "Delete my account". Immediate and irreversible.
- Rectification — contact us to correct anything.
- Complaint — you may complain to your national data protection authority.
Age
ChemLab is a study tool for A-level students. If you are below the age of digital consent in your country (13–16 depending on the country), please ask a parent or guardian before creating an account.
Contact
Data controller: ChemLab — radudinescu@chemlab.study
Changes
If this policy changes materially we will note it here with a new date.