Privacy policy

Flask is an independently operated educational project that provides an interactive A-Level chemistry laboratory. For the personal information described in this policy, Flask is the data controller.

Questions or privacy requests can be sent to Flask support.

Account information

When you create an account, we store a Firebase user identifier, your name, email address, profile photograph URL if supplied by Google, sign-in provider, and account creation and update times.

If you use email and password, your credentials are handled directly by Firebase Authentication. Flask does not receive or store your plaintext password. If you use Google Sign-In, Google provides the basic account details you approve, normally your name, email address, profile photograph, and Google account identifier.

Practical activity

When you use the laboratory, we may save the experiment mode and chemistry, tutorial step, recorded readings, mean titre, completion status, answer result, and update times. A resumable checkpoint can include the current apparatus state and tutorial progress. Submitted assignments may also include the assignment identifier, submitted and expected answers, and submission time. These records sit beneath your private account identifier.

Security and technical information

Firebase Authentication processes information such as IP addresses, browser or device user-agent information, and authentication events to provide sign-in, account security, and abuse prevention. Normal server logs may also contain an IP address, request time, requested page, and browser information.

Information we do not currently collect

Flask does not currently include advertising networks, behavioural advertising, independent analytics SDKs, precise location tracking, contact-list access, or payment processing. Please do not enter sensitive personal information into assignment-answer fields.

• create, authenticate, and secure your Flask account;
• provide the laboratory, assignments, and saved practical history;
• restore your work across supported devices and sessions;
• diagnose errors, prevent misuse, and protect the service;
• respond to support, privacy, and account requests; and
• meet legal obligations and establish or defend legal claims where necessary.

Where UK or European data-protection law applies, our main legal basis is performing the service you request when you create an account. We also rely on legitimate interests in operating, securing, and improving Flask, and on legal obligations where the law requires processing. If we introduce an optional feature that needs consent, we will ask first and consent may be withdrawn.

We use Google Firebase to provide Authentication and Cloud Firestore. Google generally acts as our data processor or service provider for information placed in Firebase. Google may use its own service data under its applicable terms and privacy notices.

If you choose Google Sign-In, Google also processes the sign-in request as your identity provider. We may disclose information where required by law, to protect users or the service, or as part of a future business reorganisation with appropriate safeguards. We do not sell or rent personal information.

When a teacher creates a classroom assignment, verified students who join it are identified to that teacher by name and email. The classroom dashboard shows join status, practical progress, submitted answers, captured titre results, marking outcomes, and submission times for that assignment. Classroom links and codes are shareable assignment identifiers, not secret or cryptographic examination tokens.

Flask's Cloud Firestore database is configured in the Mumbai, India region (asia-south1). Firebase Authentication is operated by Google from United States data centres. Google and its subprocessors may process information in other countries where they maintain facilities.

Where international-transfer rules apply, we rely on Google's contractual data-protection commitments and recognised transfer safeguards, including standard contractual clauses where applicable.

Flask currently uses browser storage required by Firebase Authentication to remember your signed-in session. Google Sign-In may use Google cookies or browser storage as part of the authentication flow. Flask also uses local browser storage to preserve unfinished tutorials, generated practicals, and recent laboratory history on that device. We do not currently set advertising cookies or use standalone analytics cookies.

Blocking essential browser storage may prevent sign-in or session restoration. You can sign out to end the active Flask session on a device.

Account profiles, resumable laboratory sessions, and saved practical attempts are normally kept while your account remains active. An account-deletion request enters a manual administrator queue; this repository does not currently operate an automatic deletion processor or promise a fixed completion deadline. Data remains stored until an administrator verifies and completes the cleanup, except that limited information may need to be retained for security, fraud prevention, legal obligations, or legal claims. Service-provider security logs may follow Google's own retention schedules.

Depending on where you live, you may have rights to request access to, correction of, deletion of, restriction of, or portability of your personal information. You may also have the right to object to certain processing, withdraw consent where it is used, and complain to a data-protection authority.

You can submit an authenticated deletion request from Data and privacy in your account settings, or email Flask support from the address connected to your account. A request does not immediately remove your sign-in or data. It remains pending until an administrator verifies the account owner and completes the Firebase Authentication, saved-history, and classroom-data cleanup. Email support if you need confirmation or a status update. We may need to verify that the account belongs to you before completing another privacy request. UK users may also complain to the Information Commissioner's Office.

Flask is designed primarily for A-Level students and is not directed to children under 13. We do not knowingly collect personal information from a child under 13. If you believe this has happened, contact us and we will investigate and delete the information where appropriate.

A student who is below the age at which they can independently agree to online data processing in their country should use Flask only with the involvement of a parent, guardian, or school. Schools and teachers should provide their own required notices and permissions when directing students to use the service.

We use Firebase Authentication, private per-user Firestore paths, restrictive database rules, HTTPS, and access controls designed to prevent users from reading another user's information. Firebase encrypts Authentication and Firestore data in transit and at rest. No online service can guarantee absolute security, so please use a unique password and protect access to your Google account.

We may update this policy when Flask changes or legal requirements develop. The latest version will remain available on this page and will show its effective date. If a change materially affects how we use existing personal information, we will provide a more prominent notice where reasonably possible.