Omniguides
Privacy and security
Your answers, scores and notes never leave your device.
We follow the EU's General Data Protection Regulation (GDPR) as our standard, wherever you live. That is why we keep data processing in-house. The one exception is email delivery: Amazon Web Services (AWS) sends our emails.
Cloudflare delivers the site's pages and handles each request; it never receives your answers, scores or notes.
What never leaves your browser
Answers, scores, response labels, notes, per-question progress and flashcard contents stay on your device. They are not sent to our analytics server. Session replay is turned off in production.
What we count, and why
We count visits so we can see which lessons help and which pages break.
- Pages visited, page-load speed, approximate country from your IP address, device and browser type, and errors. Errors raised by browser extensions are dropped in your browser before anything is sent.
- Page addresses without their query text, such as worksheet titles, selected problems and access tokens. Campaign and referral labels may be kept.
- Teacher-pack activity: signup requests and outcomes, subject confirmations, when the sign-up screen is shown, when a pack or score sheet is opened (with the course and public problem number), the number of rows in a CSV export, and sign-outs.
- Learning-tool use: when a worksheet is shared, printed or presented and how many problems it has; when a flashcard session ends and how many cards it covered; and how many results a search returned, never the search words.
We do not record what you type into forms. Our own checks use made-up test data.
Cookies and storage
Analytics counts visits without cookies or a stored browser ID until you choose Allow. Allow lets analytics keep an ID in this browser's local storage to connect your visits. We store your choice so we can remember it. Change it any time with Privacy choices in the footer.
Learning tools keep their own progress and settings in your browser. Teacher-pack sign-in uses a secure, HTTP-only membership cookie, separate from analytics consent.
Help and feedback chat
The chat loads only when you open it. What you type there is saved as a support conversation so we can answer you. Please leave out student names and other personal details.
If you join a teacher pack
With analytics consent, we connect member visits using a pseudonymous ID derived from your membership record, never your email address. When you confirm a subject list, our server records the confirmation as a first-party service event, even without analytics consent. Signing in without adding a subject does not create that event.
How we protect it
- No password to steal: you sign in with a one-time email link.
- Sign-in links are signed with HMAC-SHA-256 and expire after 72 hours. The token leaves the address bar as soon as you arrive.
- Your session lives in a secure, HTTP-only cookie that page scripts cannot read. It lasts up to 180 days.
- Pack access is checked against your live subscription on every load. Unsubscribe, and access ends on your next visit.
- Student names and scores never reach our servers. The score sheet and CSV export run in your browser.
- Request logs and timing traces record the method, path, status and duration, never request bodies, cookies or access tokens.