Privacy Policy

Smash My Subjects (“we”, “us”) is a personalised online learning platform built for Caribbean secondary-school students, private candidates, and adult learners. This Privacy Policy explains what personal information we collect when you visit our website or use our platform, how we use it, and the rights you have over it.

Information you give us

• Account details: first name, last name, email address, password (hashed), and the role you sign up as (student, parent, instructor).
• Student profile:grade level, subjects you're studying, daily goal target, and optional avatar.
• Parent linking: the 6-character code your child generates to link your account to theirs. Once linked, we store the parent ↔ child relationship.
• Billing information: billing name, country, and the last 4 digits of your card. Full card numbers are never stored on our servers — they are handled directly by our payment processor, Stripe.
• Support communications: any messages you send us via the contact form or email.

Information we collect automatically

• Usage data: lessons started/completed, quiz scores, time on task, XP earned, study streaks, and the AI tutor questions you ask.
• Device data: IP address, browser type, operating system, screen size, and approximate location (country/region only).
• Cookies: see our Cookie Policy for full details.

We use your personal information to:

• Create and maintain your account, and authenticate you when you sign in.
• Deliver the courses, lessons, quizzes, flashcards, practice exams, and AI tutoring you've signed up for.
• Track and display progress, streaks, badges, and XP — for you and (if linked) for your parent.
• Process payments and renewals, and send billing receipts.
• Send essential service emails (password resets, billing notices, security alerts).
• Send notifications you've opted into (study reminders, parent encouragement messages, weekly progress reports).
• Respond to support requests.
• Improve the platform — we look at aggregated, anonymised usage to understand which lessons and features help students most.
• Detect and prevent fraud, abuse, and security incidents.

Our AI tutoring assistant uses OpenAI's language models to generate responses to student questions. When you chat with the AI tutor:

• Your question, the current subject, and a short conversation history are sent to OpenAI's API to produce a response.
• OpenAI's API terms state that data submitted via the API is not used to train OpenAI's models by default.
• We log AI conversations on our servers so you can revisit them and so your parent (if linked) can see what you've been studying. You can delete an AI conversation at any time from your dashboard.
• Don't share sensitive personal information (passwords, full ID numbers, addresses) in AI tutor chats — it will be transmitted to a third-party AI service.

We do not sell your personal information. We share it only with:

• Service providers we rely on to deliver the platform — payment processing (Stripe), email delivery (SMTP provider), AI tutoring (OpenAI), cloud hosting, and crash/error monitoring. These providers process data on our instructions and are bound by contracts protecting your information.
• The parent linked to a student account.If a student generates a link code and a parent uses it to link, that parent can view the student's progress, recent activity, quiz scores, and AI tutor history.
• Law enforcement when required by a valid legal request (court order, subpoena), and only to the extent legally required.
• A successor entity in the event of a merger, acquisition, or asset sale — data would be transferred under equivalent privacy obligations.

Smash My Subjects is built for secondary-school students, many of whom are under 18 (and some under 13). We take children's privacy seriously:

• If you are under 16, you must have a parent or guardian's permission to use the platform.
• If you are under 13, your parent or guardian must create the account on your behalf and provide consent for us to collect your information.
• We never knowingly market or sell to children, and we don't show third-party behavioural advertising on the platform.
• Parents can review, export, or delete their child's data at any time by contacting us.

We use cookies and similar technologies to keep you signed in, remember your preferences, and understand how the platform is used. We do not use third-party advertising or cross-site tracking cookies.

See the Cookie Policy for a full list and instructions to manage cookies in your browser.

• Active accounts: we keep your data for as long as your account is active.
• Cancelled accounts: we keep account data for up to 12 months after cancellation so you can re-activate without losing progress, then anonymise or delete it.
• Billing records: we keep payment receipts and invoices for up to 7 years to meet tax and accounting requirements.
• Support tickets: we keep correspondence for up to 3 years so we have context if you contact us again.

You have the right to:

• Access the personal information we hold about you.
• Correct information that's wrong or incomplete.
• Delete your account and the data associated with it.
• Export a copy of your data in a portable format.
• Object to certain processing (e.g. opt out of non-essential notifications).
• Withdraw consent for any processing that relies on your consent — this won't affect lawful processing already completed.

To exercise any of these rights, email us. We will respond within 30 days.

We take reasonable technical and organisational measures to protect your information:

• HTTPS / TLS encryption for all traffic between your device and our servers.
• Passwords are stored as one-way hashes (bcrypt), never in plain text.
• Card numbers are tokenised by Stripe — they never touch our servers.
• Database access is restricted to a small number of authorised staff and is logged.
• We patch our servers regularly and run automated vulnerability scans.

No online service is 100% secure. If we ever discover a breach affecting you, we will notify you and the relevant authorities as required by law.

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this page. For significant changes, we will also email registered users and post a banner on the site.

If you have questions about this policy or how we handle your data, please get in touch.