Privacy policy

Whether the operator is required to register with the Information Commissioner’s Office and pay the data-protection fee, and the registration number if so, is Placeholder, for the operator to supply: the operator’s ICO registration, to be stated here. Whether a data protection officer is required is Placeholder, for the operator to supply: a judgement for the operator.

Everything Lanekind knows about your revision is written into this browser first: every answer, your plan, your bookmarks, your theme. That is not a privacy gesture: it keeps completed work available if a request fails. Loading web pages and new sessions can still require a connection. The mobile app bundles the question and reference bank for offline study.

When the sync service is configured, the rows below are sent under your identity even before you add an email address. Signing into the same linked account on another device makes completed work and your plan available after sync. Unfinished session and mock drafts stay on the device where you started them. The database names below also help identify exported data.

Alongside those, the account itself holds your email address if you gave one, and a record of whether Premium is on: which product, which rail it was bought on, when it expires, and the events the payment processor sent us. That record is written by a webhook, never by your browser, and your browser only ever reads it.

Everything else stays here. The queue of rows waiting to be sent, the bookmark of how far the last sync got, the cached copy of your subscription status and your answer to the cookie question are all local and none of them is ever uploaded. The cookie and local-storage policy lists every key by name and says which side of that line it falls on.

Every analytics property this product is capable of sending is declared in advance, with the exact kind of value it may hold: a number, a true or false, an id, or one string out of a fixed list. Anything arriving at the boundary that does not match the declaration is dropped there, and the rules it is checked against are these:

• An event whose name is not in the catalogue is dropped whole. There is nothing to interpret it as.
• A property nobody declared is removed, and the rest of the event still goes. A funnel missing one dimension is still a funnel; a funnel missing its rows is a hole nobody notices for a quarter.
• Any string containing an @ is dropped. Every legitimate string value is an id or a fixed word, so none of them contains one — and an address is the single most likely personal datum to be pasted into a tracking call by accident.
• Any string longer than 120 characters is dropped. No declared property is a sentence, so anything that long is prose, and prose is a leak.
• A value that should have come from a fixed list and did not is dropped.

The consequence, in plain terms: we cannot send what you typed, because there is nowhere for it to go. A search records how many results came back and not what you searched for. An answered question records its topic and whether you were right, not its wording or the option you touched. The web checkout asks for an email address and the event that fires carries the offering and the package, with no property for the address at all.

On top of the events, 15 facts are kept against you as a person rather than as a moment: which licence you are revising, your minutes a day, your streak, your predicted score, whether Premium is on, and — if an advert brought you here — which campaign it was. There is no name and no email address among them.

Four settings in the analytics client are decisions rather than defaults, and all four follow from the same rule. Automatic click capture is off, because the text of a clicked element in this product is very often a DVSA answer. Session recording is off, for the same reason with pictures. Automatic page-view capture is off, because a URL can carry a search term. And a person profile is only ever created for somebody already identified — by their anonymous account id, which is a random identifier and nothing else.

The analytics are processed in the European Union: the client sends to https://eu.i.posthog.com.

Where the basis is legitimate interests you can object, and we have to stop unless there is a reason that outweighs yours. Where it is consent you can withdraw it at any moment, and withdrawing has to be as easy as giving — which is why it is the same control in the same place, at the same size.

Apple and Google also see a subscription bought inside the mobile apps, under their own terms rather than ours. Whether any of the four above moves data outside the United Kingdom, and on what transfer mechanism, is Placeholder, for the operator to supply: to be confirmed against each provider’s current terms. Nothing is sold, and nothing is shared with an advertising network.

Under UK data protection law you can ask for a copy of what we hold, ask us to correct it, ask us to delete it, ask us to stop or restrict what we do with it, ask for it in a portable form, and object to anything we do on the basis of legitimate interests. Where we rely on consent you can withdraw it without giving a reason and without losing anything you have already done.

Anonymous identities can hold synced records too. Clearing browser data removes the local copy, not necessarily the server copy; use the deletion flow while you can still access that identity. The export screen downloads your current local data as files. Let sync finish first if you want it to include completed work from your other devices. Older results may hold only a summary where no detailed paper was saved.

We answer a request within one month. If you are not happy with how we answer, complain to the Information Commissioner’s Office.

Write to Placeholder, for the operator to supply: the operator’s contact email address about anything on this page. This policy was last written on 2 September 2026; when it changes in a way that affects you, that date changes and the change is announced in the app.