Your information, explained clearly.

What Aymro collects

• Account details: your chosen account name, email address, email-verification status and the sign-in method you use.
• Age confirmation: whether you confirmed that you are 13 or over. Aymro does not ask for or store your date of birth.
• Your course: AQA exam board, Combined or Separate Sciences, Foundation or Higher tier, and your exam year.
• Your learner profile: the name you want Aymro to use and, if you choose to provide it, your school selection.
• Your revision activity: study sessions, card reviews, recall ratings, scheduler records, progress, favourites, Collections, Needs Attention and related settings.
• Service records: session, device-sync and security information needed to keep an account working and protect progress.

Why it is used

Account information is used to sign you in, verify your email, recover access and connect revision progress to the correct account. Course choices decide which curriculum cards you normally see. Revision activity powers your schedule, sessions and progress views. Security and sync records help prevent the wrong account or device data from overwriting your work.

An optional school choice helps Aymro understand where the service is being used. A school-level statistic may be produced only when at least 10 learners are in the group. Data for fewer than 10 learners is not turned into a school statistic. Individual access is restricted to legitimate support or operational work.

Where information is stored

Aymro is local-first. Revision information is first stored in IndexedDB in your browser. When you use an account, supported learner records can also be stored on the server and synchronised between the two. Sync can pause if the device and account data do not safely match.

Authentication uses secure, HTTP-only cookies for signed-in sessions. These are needed for the service to recognise your account and are not advertising cookies. Local storage is also used for limited preferences such as theme and an unfinished onboarding draft.

Sign-in and service providers

You may use email and password or a configured Google, Microsoft or Apple sign-in option. The chosen provider handles its own sign-in process. Aymro requests identity information needed for the account and is designed not to retain provider access, refresh or ID tokens after authentication.

The service also relies on technical suppliers for hosting, database storage and transactional email. The production supplier list and final processing terms must be confirmed before private beta. Aymro does not currently install a third-party advertising tracker or behavioural analytics service. Your revision activity is still used inside Aymro to calculate your own schedule and progress.

Keeping and deleting information

No fixed deletion timetable has yet been approved. Account and revision information is kept while it is needed to provide the service, protect progress, resolve support or security issues, and meet applicable obligations. This retention approach requires specialist review before private beta.

The current product does not yet include a self-service account-deletion button. You can request access, correction or deletion through the privacy contact below. Removing cached data from one device is separate from deleting the server account.

Your choices and rights

You can correct course and profile choices in the product. You may also ask what personal information is held, request a correction or deletion, object to or restrict some uses, or raise a privacy complaint. These rights depend on the circumstances and applicable UK law.

Contact Aymro’s public contact route or email privacy@aymro.co.uk. The mailbox is intended for privacy requests but its live monitoring is still awaiting external confirmation. You may also have the right to complain to the UK Information Commissioner’s Office; specialist review is required before final launch wording is approved.

Security has limits

Aymro uses measures such as secure production cookies, rate limits, verified email flows, isolated local account storage and fail-closed sync checks. No online service can promise absolute security. Never send a password or verification code by email.