This policy explains what personal data Sigma collects when a student uses the platform, why it is collected, who it is shared with, and how long it is kept. It is written to be read by students, parents and school IT staff.
Sigma is operated by Spike Strang, acting as the data controller. The platform is built and run by one person; there is no company behind it and no staff other than the operator.
Questions, requests or complaints: spikeasstrang@gmail.com
| Data | Why we collect it |
|---|---|
| Email address | To create your account, sign you in, and identify your work as yours. |
| Photographs of handwritten working | To generate feedback on your method and identify where you went wrong. |
| Which questions you attempted, and whether you got them right | To build your gradebook and track skill progress over time. |
| Messages you send to the AI tutor | To provide hints and answer follow-up questions. |
| Feedback the AI generated about your work | So you can review it, and so marking quality can be checked. |
| Any objection you raise to a mark | So the operator can review the AI's judgement. |
We do not collect your name, date of birth, postal address or phone number.
You can sign in with a Google account, including a school Google account. Signing in redirects you to Google's own sign-in page and then back to Sigma. Sigma never sees, receives or stores your Google password — Google performs the authentication, and all Sigma receives back is your email address. That address is what allows school accounts to be recognised by the school's own domain.
You can instead create an account with an email address and password. The password is stored only in scrambled (hashed) form by Supabase, our sign-in provider, and cannot be read back by anyone, including the operator.
Sigma uses Google Analytics to understand how students find the site and use it: for example, which pages are visited, whether a visitor came from a Google search or a Sigma advert, and whether they went on to create an account or unlock a unit. It uses cookies to recognise a returning browser. It records no names or email addresses, and never your answers, photographs or chat messages.
Sigma advertises on Google Search. When you arrive from one of those adverts, Google Analytics notes that you came from an advert, so the operator can see which adverts lead to sign-ups. Your data is never used to show you personalised adverts, and Google's advertising-personalisation features are switched off.
If you are in the UK or Europe, Sigma asks before using analytics, and nothing is loaded until you accept. Elsewhere it is on by default. Either way, you can change your choice for this browser here:
Sigma keeps a copy of your gradebook, and any work still waiting to be saved, in your browser's local storage, so the app keeps working if your connection drops. Your sign-in session is held the same way, along with your analytics choice. None of it is used for advertising or analytics, and clearing your browser data removes it.
Feedback, hints and worked solutions are generated using Claude, an AI service provided by Anthropic PBC.
The question text, the mark scheme, your chat messages, and the photograph of your working.
Your name, your email address, and your account identifier. These are stripped before the request leaves Sigma's server, so your submission reaches the AI service without anything attached that identifies you.
Your device never contacts the AI service directly. Requests are made server-to-server by Sigma's own server, so your school network and your IP address are not exposed to it.
Under Anthropic's commercial terms, data submitted through their API is not used to train their models. Schools wishing to verify this independently should consult Anthropic's published Privacy Policy, Commercial Terms of Service and Trust Center rather than relying on this summary.
| Service | Role | What it handles |
|---|---|---|
| Supabase | Database, sign-in and image storage | Email address, gradebook, feedback records, work photographs |
| Sign-in | Authenticates you and returns your email address to Sigma. Sigma never receives your Google password. | |
| Google Analytics | Site analytics and advert measurement | Pages visited, the advert or search you arrived from, sign-ups and purchases, device and approximate location. No email address, answers or photographs. |
| Vercel | Website hosting and server functions | Serves the site; processes requests in transit |
| Anthropic PBC | AI feedback generation | Question text, mark scheme, chat messages, work photographs — no identifiers |
| Stripe | Payment processing | Card details, for individual subscribers only. Students on a school account never reach this step, and Sigma never sees card numbers. |
| Formspree | In-app feedback form | The message you type and which question you were on. No email address or account identifier. |
| Google Fonts, jsDelivr | Typefaces and maths styling | Your IP address, as with any website that loads external fonts |
The database and the image store are hosted in Supabase's Stockholm region, so student records and work photographs are held within the European Union. Some other processors are based in the United States, so data may be transferred outside your country under those providers' standard contractual protections.
| Data | Retention |
|---|---|
| Photographs of handwritten working | 90 days, then permanently deleted by an automated daily job |
| Feedback text, correctness, skill assessments, objections | Kept while your account exists, without the photograph |
| Gradebook and progress | Kept while your account exists |
| Email address | Deleted when your account is deleted |
Deleting your account removes your gradebook and clears your email address from all feedback records.
Where the UK/EU GDPR applies, we rely on legitimate interests to provide tutoring and maintain your progress record, and on contract where you have taken a paid subscription. Analytics cookies are used in the UK and EU only with your consent, which you can withdraw at any time in section 2.
Sigma is not operated on behalf of any school. Where students of a school use it, the operator remains the sole data controller: the school does not control or process the data held here, and no school staff have access to it. Requests about this data, including access and deletion, come directly to the operator at spikeasstrang@gmail.com.
Sigma is built for A-Level students, typically aged 16 to 18. If you are under 16 and in the UK or EU, a parent, guardian or your school must consent on your behalf before you create an account.
Sigma runs entirely in the browser. There is nothing for students to install, and no inbound access to the school network is required. For sign-in to complete, outbound HTTPS access is needed to three domains:
| Domain | Why it is needed |
|---|---|
www.sigma-maths-revision.com | The site itself. |
accounts.google.com | Google sign-in. The student is redirected here and back again; if it is blocked, the redirect does not complete and sign-in fails. |
mxjqmwslwidqimihroka.supabase.co | Sign-in and the gradebook database. |
Two further domains affect appearance only, and the site remains usable without them: fonts.googleapis.com with fonts.gstatic.com (typefaces), and cdn.jsdelivr.net (maths styling). Analytics uses www.googletagmanager.com and www.google-analytics.com; blocking them has no effect on the site.
No connection to the AI provider is made from student devices. Those requests are made server-to-server from Sigma's own hosting, so no Anthropic domain needs to be allowed on the school network.
You can ask us to give you a copy of your data, correct it, delete it, or stop processing it. Write to spikeasstrang@gmail.com and we will respond within one month. If you are in the UK or EU and are unhappy with the response, you may complain to your national data protection authority.
Material changes will be announced in the app before they take effect. The date at the top of this page shows the current version.