Privacy Policy
Last updated: October 8, 2026
1. Introduction
IGCSEMate is an AI-powered tutoring platform for Cambridge IGCSE students, covering Biology, Chemistry, Physics, Mathematics, Additional Mathematics, English, Economics and Computer Science. Anyone can sign up directly, with no school, institution, or government program required.
2. Accounts and Authentication
You sign in with any email address (a one-time code, no password to remember) or with Google, via Microsoft Entra External ID. We never see or store a password. Microsoft handles authentication and hands us back a verified identity. For account security, only one device can be actively signed in at a time; signing in elsewhere signs you out of the other session, and you can sign out of all devices from Settings.
3. Information We Collect
Account Information:
- Email address and display name
- Sign-in identifiers issued by Microsoft Entra External ID
We do NOT store passwords. Microsoft handles all authentication.
Learning Data:
- Your questions, uploaded images/files, and the AI tutor's responses
- Chat history and conversation threads, by subject
- Quiz attempts, scores, and flashcard decks (including spaced-repetition progress)
- Study activity, streaks, and progress shown on your dashboard
Subscription and Billing Data:
- Your plan, token balance, and subscription status
- Payment and billing records: your card details are handled directly by Stripe and never touch our servers
- Referral code usage, if you refer or were referred by another user
Session Data:
- Active login session, for the single-device security described above
- Device/browser information and last-activity timestamps
4. How We Use Your Data
- Provide AI tutoring, quiz marking, and flashcard generation in your chats
- Save and show your learning progress, streaks, and weak topics on the dashboard
- Track and enforce your subscription's token balance
- Process payments and apply referral rewards
- Provide customer support and respond to your requests
- Improve the product and the quality of AI responses
5. Data Sharing
We do not sell your data. We share it only with the service providers that run the product (listed in Section 7 below); each processes data solely to provide their service to us, under their own security and privacy commitments.
Teachers, only if you join their class. If you join a class with a code from a teacher, that teacher can see your progress in that class’s subject: the topics you have practised, your accuracy on them, the mistakes you keep making, when you were last active, and your answers and marks on quizzes they set the class. They never see your conversations with the tutor, and never anything from your other subjects. To show a teacher what the class as a whole is asking about, IGCSEMate writes anonymous summaries of common questions (for example, “Why do enzymes stop working when it gets too hot?”), only for questions at least two students asked, never in your words and never with your name. You can leave a class at any time in Settings, and they stop seeing anything from then on.
A parent, only if you ask them to pay. If you send a parent a link to pay for your plan and choose to show your progress, the page they open shows your subjects, the topics you are working on and what you have done, never your conversations.
We will NEVER share:
- Your individual chat conversations or questions, with anyone outside those service providers (teachers and parents included)
- Your personal information for third-party marketing purposes
- Data with any other unauthorized third party
6. Data Storage and Security
Your data is stored in Microsoft Azure Cosmos DB:
- Encrypted data transmission (HTTPS/TLS)
- Authentication via Microsoft Entra External ID: we never store passwords
- Access controls around who and what can read your data
- Session records automatically expire after 30 days
7. Third-Party Services
Microsoft:
- Entra External ID (sign-in / authentication)
- Azure Cosmos DB (data storage)
- Azure OpenAI Service (AI tutoring responses)
Stripe:
- Subscription billing and payment processing
Resend:
- Transactional email (receipts, sign-in codes, notifications)
Vercel:
- Website hosting and deployment
8. Your Rights
You have the right to:
- Delete individual chat threads or history from within the app, anytime
- Request deletion of your account and all associated data
- Request a copy of your data
- Correct inaccurate account information
- Ask questions about how your data is used
To exercise these rights, contact us at support@coregenai.com
9. Data Retention
- Chat and learning history: stored until you delete it or close your account
- Session data: automatically cleared after 30 days
- Account information: retained while your account is active
- Deleted data: removed within 30 days of a deletion request
10. Users Under 18
Many IGCSE students are under 18. IGCSEMate is not directed at children under 13, and sign-up does not currently involve a separate parental-consent step. If you are a parent or guardian and believe your child has created an account, contact us at support@coregenai.com and we will help you review, manage, or delete it.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Significant changes will be communicated by email.
12. Contact Us
Questions about privacy or data protection?
