Last updated: 31 October 2026

Who we are

Prepare For Grammar is operated by Prepare For Grammar, 19 Gweal Avenue, Reading RG2 0FP, United Kingdom. For privacy questions contact contact@prepareforgrammar.com.

What we collect, and why

Email address, only if you create an account. Used to send you a one-time sign-in link and to identify your subscription. Legal basis: performing our contract with you.
Sign-in session. When you sign in we set one strictly necessary cookie (gs_session) so you stay signed in until the end of the day (midnight UK time). We store only a hashed copy of its value.
Subscription status. Whether your subscription is active, and when it renews. Payments are handled by our payment processor, Stripe; we never see or store your card details. Stripe's own privacy notice is at stripe.com/gb/privacy.
Creative writing. If a child does a creative writing task, the plan and story they type are saved as plain text with the time taken, their own checklist ticks and, if a parent adds them, a rating and note. Writing is linked to the player’s generated name, is readable only by the parent after the parent check, never appears on leaderboards or to other families, and is deleted when the parent deletes the player. Web links, email addresses and phone numbers are rejected, and children are told not to write real names or contact details. Drafts are also kept in the child’s browser until handed in. Legal basis: performing our contract with you.
Practice scores and settings. Your topic scores and your accessibility choices are stored in your own browser (local storage). They are not sent to us.
Players and results. One family account holds up to four people, each a child or a parent who plays alongside their children. Parents appear only on the family leaderboard, never on the public one. Each has a generated public name (for example “Brave Maple Otter”) that cannot be edited, an avatar, a coin balance, and their practice and challenge results with the time taken on each answer. We do not ask for a child’s real name, age, photo or any free text, apart from creative writing (next item). Results are stored on our servers, linked to the parent account, and shown in the parent’s reports. Players appear on leaderboards by generated name and avatar only, to signed-in families, unless the parent hides them. A parent can delete a player and all their data at any time.
Optional exam details. A parent may tell us a player’s school year group (not their age or date of birth), the year of their 11+ exam, the type of test, and up to three target school names. These are used only to tailor practice and appear only in the parent’s own pages, never to other players or on leaderboards. They are optional, can be changed or removed at any time, and are deleted with the player. Please do not enter a child’s name.
Messages you send us. If you use the contact form we store your message, your email address, your optional name and the question you mention, so we can reply. We keep it until it has been dealt with and then delete it within 12 months. Please do not include a child’s name or private details.
Google Analytics (optional, consent). If you accept analytics, Google Analytics 4 collects anonymous usage data about public pages: pages viewed, time on page, rough location, device and browser. IP addresses are anonymised, Google Signals and advertising personalisation are off, and no user ID or personal details are sent. It is not used on children’s practice sessions, challenges or signed-in family and admin pages. Google acts as our processor, may process data outside the UK under appropriate safeguards, and is asked to keep data for no more than 2 months. Our legal basis is your consent, which you can withdraw at any time on the cookies page.
Counting visits. We count page views with our own system: the page, the site that referred you, a rough device type, a country code when available and a visitor code that changes every day. It uses no cookies, stores no IP addresses and is skipped if your browser sends Do Not Track or Global Privacy Control, or if you opt out on the cookies page. Pages that need sign-in are not counted. See the cookies page.
Reminder emails. If a child has not played the daily challenge, we may email the account address a short reminder. To decide whether to send one, we use the children’s daily-challenge streak and a record of the reminders we sent and whether a challenge followed. Reminders are sent at most once a day, around 8pm UK time, stop by themselves after a week without play, and can be paused or switched off from every email or the account page. Legal basis: our legitimate interest in helping you use the service you signed up for.
Security and service logs. To keep the service safe and working, we record sign-ins, sign-outs, account actions and errors. Each record may include a device type (phone, tablet or computer), a country code if our network provider supplies one, and a “hash” of the network address that changes every day. We do not store IP addresses, and the daily hash cannot be used to follow a person from one day to the next. Our administrator can see these logs, usage totals and parts of email addresses, and can disable an account or sign a person out if there is abuse.
Finding grammar schools. If you search by postcode area, only the first half of a postcode (for example SW1A) is sent to the free postcodes.io service to find the area. It is not stored by us. Choosing a local authority or typing a school name sends nothing anywhere.
Read aloud. The Listen button uses your browser’s speech voices. Voices marked “online” in the Accessibility menu may send the text being read to your browser’s speech service; choose a voice without that label to keep it on your device. The rough working area is drawn on your screen only and is never saved or sent.

We do not use advertising cookies or tracking pixels. Our only cookies are essential ones, plus Google Analytics cookies if, and only if, you accept them (see the cookies page). Fonts are served from our own site.

Children

Accounts are for parents and carers; children do not have their own account or sign-in and play only from a parent's signed-in device. We do not ask children for their names or contact details, there is no chat or messaging, and children cannot upload anything. We will complete a data protection impact assessment against the ICO’s Children’s Code before launch.

Who handles your data

Database hosting: Neon, in a UK (London) region.
Sign-in and account emails: Resend (resend.com), sent from a domain we have verified for this purpose.
Payments: Stripe (stripe.com), a PCI-compliant payment processor. We never see or store your full card details.

How long we keep it

Sign-in links expire after 15 minutes. Sessions end at midnight UK time each day, so you sign in again the next day. Account and subscription records are kept while your account is open and deleted on request, subject to any legal record-keeping duties.

Your rights

Under UK data protection law you can ask to see, correct or delete your data, object to or restrict how we use it, and ask for a copy. Contact us at contact@prepareforgrammar.com. You can also complain to the Information Commissioner’s Office at ico.org.uk.