Privacy policy

Send privacy questions or requests to contact-us@lanekind.co.uk. You can also complain to the Information Commissioner’s Office in the United Kingdom, or to the data-protection authority where you live.

Everything Lanekind knows about your revision is written into this browser first: every answer, your plan, your bookmarks, your theme. That is not a privacy gesture: it keeps completed work available if a request fails. Loading web pages and new sessions can still require a connection. The mobile app bundles the question and reference bank for offline study.

When the sync service is configured, the rows below are sent under your identity even before you add an email address. Signing into the same linked account on another device makes completed work and your plan available after sync. Unfinished session and mock drafts stay on the device where you started them. The database names below also help identify exported data.

Alongside those, the account itself holds your email address if you gave one, and a record of whether Premium is on: which product, which rail it was bought on, when it expires, and the events the payment processor sent us. That record is written by a webhook, never by your browser, and your browser only ever reads it.

The sync queue itself, the bookmark of how far the last sync got and the cached copy of your subscription status stay local. Your web analytics choice is kept in the browser and, for your current account, its choice and time are also sent to record whether web subscription events may be used for analytics. A pending update is stored separately for each account and retried until acknowledged. Optional experiment assignments are also cached separately for each account. The cookie and local-storage policy describes these records and how to change your choice.

Every client event property in the analytics catalogue is declared in advance, with the exact kind of value it may hold: a number, a true or false, an id, or one string out of a fixed list. Anything arriving at the boundary that does not match the declaration is dropped there, and the rules it is checked against are these:

• An event whose name is not in the catalogue is dropped whole. There is nothing to interpret it as.
• A property nobody declared is removed, and the rest of the event still goes. A funnel missing one dimension is still a funnel; a funnel missing its rows is a hole nobody notices for a quarter.
• Any string containing an @ is dropped. Every legitimate string value is an id or a fixed word, so none of them contains one — and an address is the single most likely personal datum to be pasted into a tracking call by accident.
• Any string longer than 120 characters is dropped. No declared property is a sentence, so anything that long is prose, and prose is a leak.
• A value that should have come from a fixed list and did not is dropped.

The consequence, in plain terms: we cannot send what you typed, because there is nowhere for it to go. A search records how many results came back and not what you searched for. An answered question records its topic and whether you were right, not its wording or the option you touched. Checkout events have fields for the offering and package, with no field for an email address. New web checkout is currently disabled.

When the relevant analytics policy allows it, the server also sends verified subscription events from RevenueCat or Dodo Payments. These cover trials, payments and renewals, refunds, cancellations, resumed or expired subscriptions, billing issues and product changes. They can include product, offering and experiment identifiers, transaction identifiers, dates, amounts and currency. They do not include card or bank details. Joining these events to the same account id lets us compare designs and pricing experiments by conversion, subscription retention, revenue and active app use.

On this website, your analytics choice controls client events and whether your current account’s web subscription events may be forwarded. Changing that choice stops client collection immediately; the server choice is updated when the request succeeds, with retries if you are offline. It does not change payment processing or access to your subscription.

On top of the events, 15 facts are kept against you as a person rather than as a moment: which licence you are revising, your minutes a day, your streak, your predicted score, whether Premium is on, and — if an advert brought you here — which campaign it was. There is no name and no email address among them.

Four settings in the analytics client are decisions rather than defaults, and all four follow from the same rule. Automatic click capture by the analytics SDK is off, because the text of a clicked element in this product is very often a DVSA answer. Our interaction events use fixed action and route identifiers instead of reading that text. Session recording is off, for the same reason with pictures. Automatic page-view capture is off, because a URL can carry a search term. And a person profile is only ever created for somebody already identified — by their anonymous account id, which is a random identifier and nothing else.

Our PostHog project is hosted in the European Union: the client sends to https://eu.i.posthog.com. IP-address storage is disabled in that project. Service providers still receive network requests to deliver their services; this does not mean that all infrastructure logs are absent.

Where the basis is legitimate interests you can object, and we have to stop unless there is a reason that outweighs yours. Where it is consent you can withdraw it at any moment, and withdrawing has to be as easy as giving — which is why it is the same control in the same place, at the same size.

Apple and Google process mobile purchases under their own terms. Payment providers may keep records for their own legal, tax and fraud-prevention duties. We do not sell your personal data or share it with advertising networks.

Data can be processed outside the UK, including in the EU, the United States and by our team in Moldova. A hosting region is not a promise that every support or subprocessor operation stays in that region. Providers describe their international-transfer arrangements in their policies and data-processing terms, including the Supabase DPA, PostHog DPA and RevenueCat DPA. Contact us for information about the safeguards relevant to your data.

Under UK data protection law you can ask for a copy of what we hold, ask us to correct it, ask us to delete it, ask us to stop or restrict what we do with it, ask for it in a portable form, and object to anything we do on the basis of legitimate interests. Where we rely on consent you can withdraw it without giving a reason and without losing anything you have already done.

Anonymous identities can hold synced records too. Clearing browser data removes the local copy, not necessarily the server copy; use the deletion flow while you can still access that identity. The export screen downloads your current local data as files. Let sync finish first if you want it to include completed work from your other devices. Older results may hold only a summary where no detailed paper was saved.

We normally respond within one month, subject to identity checks and any extension allowed by law. If you are not happy with how we answer, complain to the Information Commissioner’s Office.

Write to contact-us@lanekind.co.uk about anything on this page. This policy was last updated on 16 September 2026. We publish changes here with a new date and give any additional notice required by law.