Last updated: 29 September 2026

This policy explains what personal information Gwistix collects when you use the Gwistix app or the website at gwistix.com, why we collect it, who we share it with, and what your rights are.

Who we are

Gwistix is run by James Stephen Tierney, trading as Seabridge Systems, a sole trader based in the United Kingdom. We are the "controller" of your personal information under UK data protection law.

You can contact us about privacy at info@gwistix.com.

What we collect, and why

Your account. When you create an account we collect your name and email address and, if you choose an email sign-in, a password (we store it in a scrambled form, never as text). Signing in with Apple or Google is not currently offered. If you used it earlier, your account is still yours, and we keep only the reference Apple or Google gave us for it, so it can be recognised if the option returns; we no longer keep anything else they sent. If you choose "Skip", we create a temporary account with a generated username and a placeholder email address, and no details from you. We use this to run your account and let you sign in.

Your learning. As you use the app we store the course and level you chose, your answers and scores, your progress, the revision lists and notes you create, your streak, experience points and coins, and your app settings. We use this to provide the service: to show your progress, choose what to practise next, and focus on the words you find hard.

Server logs. Like most services, our servers keep standard technical logs of the requests they receive, which include your IP address and the time. We do not store your IP address against your account. We use the logs to keep the service secure and to find faults. We keep them for about two weeks, then they are deleted automatically.

Your country. When you sign up, sign in or open the app, we work out which country you are in from your IP address, using a database on our own servers, and keep just the country (for example "United Kingdom") with your account. We do not keep the IP address, a town, or coordinates, and the address is not sent to anyone else to look up. We use this to understand where in the world the service is used. This product includes GeoLite Data created by MaxMind, available from https://www.maxmind.com.

Messages you send us. If you use the contact form, the deletion-request form, the register-interest form or in-app feedback, we collect what you type, including your name and email address. We use this to reply to you and act on your request.

Crash and error reports. The app sends crash and error reports to Bugsnag. A report includes technical information about your device (model, operating system, app version) and what the app was doing, and it is labelled with your account ID (a number), not your name or email address, so we can look into a problem without those details appearing in the report. When our own servers hit an error, a similar report is sent, which can also include the address the request came from and the web address it asked for. We use this to find and fix faults.

On the website.

• With your consent only, Google Analytics records how the site is used (pages visited, and information about your browser and device) using cookies (_ga, _ga_*). Analytics is not loaded until you click "Allow cookies", and if you do not, it never loads.
• The contact and deletion forms use Google reCAPTCHA Enterprise to tell people from automated spam. It receives information about your browser and how you interact with the page.
• Some icons and scripts are loaded from cdnjs, a content delivery network run by Cloudflare, which means Cloudflare can see your IP address.
• A cookie records that you have answered the cookie banner, and the site uses essential cookies for security and forms.

What we do not collect. We do not use advertising, we do not collect your precise location (for example from GPS), contacts, photos or microphone, and we do not sell your information. The app reads words aloud using your device's own speech feature. We do not use any artificial intelligence service to process your information.

Our lawful bases

• Contract: your account and learning data, so that we can provide the service you asked for.
• Legitimate interests: keeping the service secure, preventing spam, finding faults through crash reports, keeping backups, and understanding which countries the service is used in. We have considered these and do not think they override your rights.
• Consent: analytics cookies on the website. You can withdraw this at any time (see "Your rights").

Who we share it with

We use these providers to run the service. They handle information for us and are not allowed to use it for their own purposes, except where their own terms say otherwise:

• Google - reCAPTCHA and Analytics (with consent), as described above.
• Bugsnag (SmartBear) - crash and error reports, as described above.
• Cloudflare (cdnjs) - delivering some icons and scripts on the website. They receive your IP address.
• Expo - delivering app updates. They receive technical details such as the app version and your IP address.
• Amazon Web Services (AWS) - hosts the app's servers and this website, in London, and sends the email that the app and website send. It holds the information above.
• Yahoo - provides the mailbox that messages from our website forms arrive in. It sees your name, email address and the contents of your message.

We may also disclose information if the law requires it.

Transfers outside the UK

Our servers are in London (AWS region eu-west-2), so your account and learning data are stored in the UK. Some of the other providers above are based in, or process information in, the United States or elsewhere outside the UK. Where that happens we rely on a safeguard the law accepts, such as the UK-US data bridge or standard contractual clauses.

How long we keep it

• Your account and learning data: for as long as your account exists.
• Temporary ("skip") accounts: deleted automatically after 30 days if you have not used them.
• Temporary accounts you choose to delete: if you skip sign-up and later choose to delete the temporary account instead of completing it, we switch it off straight away and erase it 10 days later.
• When you delete your account (in the app, or by asking us): we switch it off straight away, so it can no longer be used, and 10 days later we permanently delete it and the information linked to it - your name, email address, learning data, notes, revision lists, feedback, and the sign-in records that keep you logged in. During those 10 days we can put it back if you contact us. After that it cannot be undone. We keep one thing: a record of coin transactions, with no link to you.
• Backups: we keep database backups for a limited time, up to two years. Information you have deleted may remain in those backups until they expire. We do not restore from them except to recover from a serious fault.
• A record of deletions: so that restoring a backup can never bring back an account that has been deleted, we keep a record of each deletion, separately from the backups, for up to three years. It holds your account number and a scrambled form of your email address that cannot be turned back into it, and the date. It does not hold your name or your email address.
• Messages you send us through the website forms are emailed to us and kept only while we deal with them, then deleted, normally within 12 months.
• Crash reports: kept by Bugsnag for 7 days.

Your rights

Under data protection law you have the right to:

• be told what we hold about you, and ask for a copy (access);
• correct anything that is wrong or incomplete;
• erasure, in some circumstances;
• restrict how we use it, in some circumstances;
• object to processing based on legitimate interests;
• data portability, in some circumstances;
• withdraw consent at any time, for anything we use consent for. To withdraw cookie consent, clear the site's cookies in your browser, and the banner will ask again.

You can delete your account yourself in the app (Account → Delete account), which switches it off at once and erases it 10 days later. You can also email us, or use the request-deletion page. There is normally no fee, and we will reply within one calendar month.

Children

Gwistix is not aimed at children under 13, and you should be 13 or over to have an account. Much of the content is suitable for younger learners, but some articles are written for a more mature audience. If you believe a child under 13 has given us their information, tell us and we will delete it.

If you are under 18, this is how we look after your information: we collect only what we need to run your account; we show no advertising and do not collect your precise location; nothing you do in the app is visible to other users, and other users cannot contact you through it; we do not sell your information; crash reports carry only your account ID; and you can delete your account at any time.

Changes

We will update this page when what we do changes, and change the date at the top. If a change matters to you, for example a new use of your information, we will tell you in the app.

How to complain

If you are unhappy with how we have used your information, please contact us first. You can also complain to the Information Commissioner's Office:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline: 0303 123 1113
Website: https://www.ico.org.uk/make-a-complaint