Privacy Policy
Last updated 30 August 2026
This explains what Telos knows about you, why, and how to make us delete it. The short version: we hold your email, the marks you type in, and whether you are subscribed. We never see your card number, we run no advertising or third-party trackers, and we do not sell anything to anyone.
1. Who is responsible for your data
The data controller is Vinujan Sivakumar, a sole trader trading as “Telos”. For anything on this page, including a request to see or delete your data, email tutor.telos@gmail.com.
2. What we collect
| What | Why |
|---|---|
| Your email and username | To identify your account, sign you in, and send password resets and service messages. |
| Your password, stored only as a hash | To sign you in. We cannot read it, and we cannot tell you what it is — only reset it. |
| Your revision data — papers logged, marks per question, topics, notes, times, and your exam date if you set one | This is the service. Without it there is nothing to show you. |
| Files you upload | To store and show them back to you. Private to your account. |
| Subscription status, and identifiers Stripe gives us for your customer and subscription | To know whether you have Pro, and to open your billing portal. |
| Usage events — that a page was viewed or a checkout started, with your account id and a short label | To see which parts of Telos are used and which are broken. Stored in our own database. |
| The IP address a password reset was requested from | Security only — to spot someone attacking accounts. This is the only place we record an IP address. |
| Share cards you choose to create | Only if you create one. It holds the figures shown on the card, and anyone with the link can see it — that is what the link is for. You can delete it. |
We never receive your card details. Payment happens on Stripe's own pages. We are told that a payment succeeded and given an identifier — never a card number.
3. Cookies
Telos sets one cookie: the session cookie that keeps you signed in. It is
marked HttpOnly, Secure and
SameSite=Lax. It is strictly necessary for the service to work,
which is why there is no cookie banner — there is nothing optional to
consent to.
There are no advertising cookies, no third-party analytics, no tracking pixels and no social media trackers anywhere in Telos.
4. Why we are allowed to hold it
- To perform our contract with you — your account, your revision data, your subscription. Without these we cannot provide Telos.
- Our legitimate interests — keeping the service secure (the password-reset IP), and understanding which features are used (usage events). We keep this to the minimum that answers the question.
- Legal obligation — payment and tax records must be kept for six years.
5. Who else touches your data
We do not sell your data and we do not share it for advertising. We use these companies to run Telos, and each only handles what it needs:
| Who | What for | Where |
|---|---|---|
| Neon | The database — everything in section 2 | London, UK |
| Railway | Runs the application and stores uploaded files | EU West |
| Stripe | Takes payments and holds your card details | EU / USA |
| Resend | Sends password reset and service emails | EU / USA |
| Cloudflare | DNS for telosapp.co.uk | Global |
Where a provider handles data outside the UK, that transfer is covered by the UK's approved safeguards — an adequacy decision, or standard contractual clauses with the UK addendum.
We would also disclose data if the law required it, or to protect someone's safety.
6. How long we keep it
- Your account and revision data — while your account exists. Delete the account and it goes.
- Password reset records — 30 days, then removed.
- Usage events — up to 24 months.
- Payment records — six years, because tax law requires it. This is the one thing we cannot delete on request.
7. If you are under 18
Telos is built for students taking A-levels, Highers and Advanced Highers, so we expect many of the people using it to be 16, 17 or 18. We take that seriously:
- You must be at least 13 to have an account.
- If you are under 18, ask a parent or guardian before you subscribe to a paid plan.
- We do not profile you for advertising, and we do not use your data to try to keep you on the service longer.
- We collect the least we can. There is no address, no phone number, no date of birth, no location.
- Nothing you log is public unless you choose to create a share card.
A parent or guardian can email tutor.telos@gmail.com to ask what we hold about their child, or to have it deleted.
8. Your rights
Under UK data protection law you can ask us to:
- show you the data we hold about you;
- correct anything wrong;
- delete your data — see section 6 for the one exception;
- give you a copy in a portable format;
- restrict or object to what we do with it, including anything we do on the basis of legitimate interests.
Email tutor.telos@gmail.com. We will reply within one month, and it is free.
If you are not happy with how we have handled it, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you told us first so we can put it right.
9. How we protect it
- Everything is served over HTTPS.
- Passwords are stored as salted hashes, never as text.
- The session cookie is HttpOnly, Secure and SameSite=Lax.
- Card details never reach our servers.
- Access to the production database is limited to the operator.
No service can promise perfect security. If a breach ever affected your rights, we would tell the ICO within 72 hours and tell you without undue delay.
10. Changes
If we change this policy in a way that materially affects you, we will email you. The date at the top always shows when it last changed.