TheoryXP Privacy Policy

Version: V1.9
Effective date: 24 September 2026
Controller: TheoryXP Limited
Website: theoryxp.app
Privacy and support contact: support@theoryxp.app

1. The short version

TheoryXP is a UK driving-theory revision app. We use a limited amount of account, technical and learning information to provide Practice, Mock Tests, progress tracking, personalised Study Plans, Today’s Tasks, Road Signs learning and optional Recovery features.

We do not currently use in-app advertising, a dedicated third-party analytics/crash SDK or an external AI/LLM to process learner data. TheoryXP does not sell personal information and does not currently use learner data for third-party behavioural advertising or direct marketing.

The Recovery Scanner is designed so that the source image and raw OCR text are processed on your iPhone and are not uploaded to TheoryXP’s backend. Only the learning categories and related information you confirm are kept with your TheoryXP account.

Account-linked learner progress is normally kept while your account is active. If there is no recorded account activity for 12 months, the account may become eligible for automatic deletion. If we have an email address for the account, we send an advance warning and provide at least 30 days before deletion. A Guest account without an email address may not receive that warning.

You can export your account data and delete your account in the app. When an account is deleted, TheoryXP may temporarily retain a minimal pseudonymous deletion record solely to help prevent deleted account data from being unintentionally restored from a backup. You can also contact us at support@theoryxp.app.

2. Who we are and where this policy applies

TheoryXP Limited is the controller of the personal information described in this policy.

TheoryXP is an independent revision product. It is not an official DVSA or DVA app and is not endorsed or approved by either agency. TheoryXP includes DVSA-licensed revision material where identified.

This policy is written for TheoryXP’s UK service, including users in England, Wales, Scotland and Northern Ireland. UK data-protection law, including the UK GDPR and Data Protection Act 2018, applies throughout the UK.

If TheoryXP later deliberately offers or targets the service into additional jurisdictions, including EEA countries, we will review the applicable privacy and representative/transfer requirements before that expansion.

3. Information we use

Account and sign-in information

Depending on how you use TheoryXP, this may include:

  • a TheoryXP/Supabase account identifier;
  • email address if you use an email-linked account;
  • Google identity information needed to complete Google sign-in;
  • an anonymous account identifier if you use Guest mode; and
  • authentication/session and account-security information.

We do not store your plaintext password in TheoryXP learner tables.

Profile and study preferences

This may include:

  • display name;
  • where you are in your learning journey;
  • theory-test date, if you provide one;
  • preferred study duration, study days and schedule preferences;
  • timezone;
  • test jurisdiction where the app needs to distinguish Great Britain and Northern Ireland content; and
  • onboarding/account-preference state.

Learning activity

This may include:

  • Practice, quiz and Mock Test sessions;
  • assigned question identifiers and order;
  • answers you select and whether they are correct;
  • timestamps and session status;
  • hint use;
  • response time and answer-change counts where recorded;
  • questions/signs you flag, save or bookmark;
  • Road Signs and video-case-study learning activity; and
  • Practice/Mock history.

Personalised learning information

TheoryXP calculates learning information from your activity, including:

  • Topic Performance states and supporting evidence;
  • weak/improving/strong/stale or insufficient-evidence status;
  • Study Plan and Today’s Tasks;
  • task outcomes and recommendation history;
  • XP/streak information;
  • readiness/pass-confidence-style summaries; and
  • limited timing/answer-change support signals used to adjust revision priority.

These are educational estimates used to guide revision. They are not official DVSA or DVA assessments and do not guarantee a theory-test result.

Technical, security and diagnostic information

TheoryXP and its infrastructure providers process limited technical information needed to authenticate users, provide the service securely, prevent abuse and diagnose faults. Depending on the service and context, this can include:

  • IP address and request/network metadata processed in Supabase authentication/API/security logs;
  • user-agent or client information associated with requests;
  • authentication, rate-limit and security-event information;
  • app version, device class/model, operating-system version, crash stack information and performance/diagnostic information where Apple makes those reports available to developers under Apple’s systems and user sharing settings; and
  • Apple-generated diagnostic identifiers that may appear in crash reports.

TheoryXP does not currently create its own persistent advertising/device identifier, use device fingerprinting for advertising, or collect precise GPS location.

TheoryXP does not need to collect your iPhone model simply to make the interface fit your screen. Responsive layout and compatibility testing can be performed without building a learner device-profile database.

Account-deletion safeguard

When you delete your account, we delete your active account and associated learner data. We may retain a minimal pseudonymous deletion record for a limited period solely to ensure that your data is not unintentionally restored from a backup. This record does not contain your name, email address, learning history or other account content and is deleted once the relevant backup-recovery period has passed.

The deletion record is used only for account-erasure and backup-recovery protection. It is not used for learning personalisation, advertising, analytics or to rebuild a deleted profile.

Recovery Scanner

If you use Recovery Scanner:

  • TheoryXP may request camera access when you choose to photograph feedback;
  • the source image and raw OCR text are processed locally on your iPhone under the current architecture;
  • TheoryXP does not currently upload the source image or raw OCR text to its Supabase backend; and
  • categories, wrong-count/severity information and learning signals you confirm may be saved to your account so TheoryXP can target revision.

Support and privacy requests

If you contact us, we receive the information you choose to include, your contact address and normal email/routing metadata.

Please do not send passwords, one-time codes or unnecessary sensitive information in support/privacy correspondence.

Special-category information

TheoryXP does not ask for or intentionally use special-category personal information as part of its normal revision and personalisation features. This includes information revealing or concerning racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic data, biometric data used for identification, health, sex life or sexual orientation.

A person could nevertheless choose to include sensitive information in a support or privacy message. If this occurs incidentally, we limit its use to what is reasonably necessary to deal with the communication and apply appropriate protections.

TheoryXP does not use response-time or answer-change information to infer health, anxiety, emotion, disability or another special-category characteristic.

TheoryXP also does not ask for or intentionally use criminal-conviction/offence information as part of the normal revision service. If such information is sent incidentally in correspondence, we minimise its use and do not repurpose it for learner profiling.

App Store information

Apple handles App Store payment/card processing. TheoryXP does not need your payment-card details in its learner database.

TheoryXP may receive App Store sales/accounting information and Apple-provided app analytics or crash/diagnostic information where Apple makes this available to developers under its platform controls.

4. Where the information comes from

Most personal information comes directly from you or from your use of TheoryXP.

Other sources can include:

  • Google, if you choose Google sign-in;
  • Apple, for App Store sales/accounting information and Apple-provided diagnostics/analytics made available to developers;
  • Supabase infrastructure logs generated when the app authenticates or communicates with the backend; and
  • information generated by TheoryXP from your learning activity, such as Topic Performance, Study Plans and progress/readiness summaries.

TheoryXP does not obtain an official DVSA or DVA test record through Recovery Scanner. Recovery information comes from the feedback you choose to process and confirm.

5. What you need to provide

You do not have to provide every optional profile field or use every optional feature.

Some information is necessary for a feature you choose. For example, an account identifier is needed to keep server-backed progress, an email address is needed for email-linked sign-in/account notices, and learning answers are needed to calculate progress and recommendations.

If you do not provide optional information, the related feature or level of personalisation may not be available.

6. Why we use your information and our lawful bases

We use personal information for the following purposes:

Purpose
Create and maintain your account, including Guest accounts
Main lawful basis
Contract where applicable; otherwise legitimate interests to provide the requested core service

17. AI Tutor and age assurance — planned processing

Current status

TheoryXP is preparing an optional AI Tutor. At the effective date of this policy version, the external AI Tutor data flow is not yet active in the production app. The existing statement above that TheoryXP does not currently send learner data to an external AI/LLM therefore remains accurate until the feature is enabled.

This section is published in advance so that the intended processing and safeguards are transparent before activation. TheoryXP will re-check the shipping data flow and update this policy again if implementation materially differs from the design below.

What AI Tutor is for

AI Tutor is intended to provide conversational explanations about driving-theory concepts, revision methods, the theory-test process and TheoryXP learning information.

AI Tutor is separate from the deterministic Performance Engine, Topic Performance, Study Plan and Today's Tasks. The underlying performance/revision engines remain rules-based. The external AI does not replace those engines or decide the canonical correctness of licensed TheoryXP questions.

Minimum-age access and Apple's Declared Age Range

The planned V1 AI Tutor is available only to users aged 13 or over.

When a learner first tries to use AI Tutor, TheoryXP may ask Apple for age-range information through Apple's Declared Age Range API. Apple states that the API provides an age range and information about how that range was declared; the data can be declared by the user or a parent/guardian and may in some circumstances have been confirmed by Apple.

TheoryXP does not receive the learner's exact date of birth through the Declared Age Range API.

TheoryXP uses age-related information only for age-appropriate access, safety and privacy controls. We do not use it for advertising, pricing or unrelated learning profiling.

Where technically appropriate, TheoryXP will retain only:

  • an AI Tutor eligibility state (for example, eligible / not eligible / not established);
  • the date the eligibility state was checked; and
  • limited technical information needed to enforce/review that decision.

TheoryXP does not plan to retain the underlying age range after it has been evaluated where it is not needed.

If sufficient eligibility information cannot be established, AI Tutor may remain unavailable. The ordinary TheoryXP revision service does not require a DOB for this purpose.

Information sent when you use AI Tutor

When AI Tutor is enabled and you choose to use it, TheoryXP may send the following through its authenticated backend to OpenAI:

  • the Tutor message you submit;
  • a limited amount of recent conversation context needed to answer a follow-up;
  • TheoryXP's Tutor instructions and approved public/TheoryXP-authored reference material;
  • minimal safety/moderation information; and
  • only if an AI-personalisation option is deliberately used, a minimised learning summary relevant to the request.

An example of minimised learning context could be a TheoryXP category name, broad performance state or number of days until a test. The default Tutor does not need the learner's entire progress history.

Information we do not intentionally send to OpenAI for AI Tutor

TheoryXP's planned V1 controls prohibit intentionally sending:

  • your email address merely to answer a Tutor question;
  • your exact date of birth;
  • your password, authentication token or Supabase credentials;
  • Recovery Scanner source images or raw OCR text;
  • unrelated support/privacy correspondence;
  • licensed DVSA revision-question wording;
  • licensed DVSA answer options;
  • licensed DVSA Knowledge & Understanding/supporting question text; or
  • licensed DVSA media/clips.

TheoryXP will maintain a technical/content-separation control designed to prevent protected DVSA question-bank material being included in external AI prompts or embeddings.

If a message appears substantially to reproduce protected licensed content, TheoryXP may block the message before it is sent externally and instead offer a general topic explanation or direct the learner to the normal TheoryXP review flow.

AI provider and role

TheoryXP plans to use OpenAI to provide model inference and moderation/safety services for AI Tutor.

For TheoryXP-controlled API processing, OpenAI's current business/API terms and Data Processing Addendum describe OpenAI as processing customer data on the customer's behalf for covered services. TheoryXP will retain the DPA/contract terms applicable to its account and keep the provider/subprocessor/transfer position under review.

OpenAI publishes a subprocessor list for its API services. These providers may process customer data in multiple countries. Where a restricted international transfer is made, TheoryXP will rely on an applicable UK-recognised safeguard recorded in its Vendor, Processor & Transfer Register.

OpenAI training and retention

OpenAI states that data sent through its API is not used to train or improve OpenAI models by default, unless the API customer explicitly opts in to data sharing.

Under OpenAI's standard API data controls, abuse-monitoring logs may contain customer content such as prompts and responses and are normally retained for up to 30 days, unless a longer period is required by law or reasonably necessary to protect OpenAI's services or third parties from harm.

TheoryXP's V1 design is to:

  • use API storage controls such as store: false where supported;
  • avoid OpenAI conversation objects that persist until deletion for ordinary Tutor use;
  • avoid permanent TheoryXP server-side Tutor chat history;
  • keep only the minimum recent context needed for the active session; and
  • review whether stronger provider retention controls, including Zero Data Retention where available/appropriate, should be enabled.

Under-18 safeguards

TheoryXP is likely to be used by people under 18. The same high-privacy AI Tutor defaults apply to all eligible users.

The planned controls include:

  • excluding users identified as under 13 from AI Tutor V1;
  • age-appropriate first-use information;
  • input and output safety checks;
  • limits on message length and usage;
  • safeguards against unsafe or unlawful driving instructions;
  • no advertising use of Tutor conversations;
  • no public posting of Tutor conversations;
  • a route to report a problem through support@theoryxp.app; and
  • red-team testing before production activation.

OpenAI's current API guidance requires additional safeguards for applications serving minors and states that personal data of children under 13 or the applicable age of digital consent should not be processed through OpenAI services without first implementing Zero Data Retention. TheoryXP's V1 design therefore prevents under-13 users from sending Tutor data to OpenAI.

Optional AI personalisation

If TheoryXP later provides a setting to let AI Tutor use limited TheoryXP progress to personalise an answer, that setting will be separate from the ordinary deterministic learning system and will be explained at the point it is activated.

For younger learners, the default should minimise or disable sharing of account-linked performance context with the external AI unless TheoryXP can demonstrate a compelling educational reason and appropriate safeguards. Any enabled context must be limited to what is necessary for the requested response.

AI-related retention and deletion

The V1 design does not include permanent server-side AI chat history.

If TheoryXP stores an AI eligibility record, safety event or other account-linked AI record, it follows the documented account/data lifecycle unless a shorter retention period applies. Account deletion must remove account-linked AI records from active TheoryXP systems, subject to lawful records and provider backup/retention handling.

OpenAI's own temporary API security/abuse-monitoring retention is controlled by OpenAI under the applicable API service configuration and DPA. TheoryXP cannot promise deletion from a provider security log sooner than the provider's applicable retention control.

AI data rights and age-result challenges

AI-related personal information held by TheoryXP is covered by the rights described in section 11.

If an age-eligibility result appears incorrect, a learner can contact support@theoryxp.app. TheoryXP will use proportionate verification and will not ask for a passport, driving licence or exact DOB by default merely because a learner challenges an AI-access decision.

Lawful bases

For the user-requested AI Tutor service, TheoryXP's planned basis is contract where objectively necessary and appropriate, with legitimate interests as the fallback for requested educational processing where contract is not suitable, including where the learner is not the App Store purchaser. Before production activation, TheoryXP will complete/sign an AI-specific legitimate-interests assessment covering younger learners and external-AI processing.

For AI age-eligibility processing, TheoryXP plans to rely on legitimate interests in providing age-appropriate access, meeting applicable child-safety/privacy expectations and enforcing the AI provider's under-18 requirements. The processing is minimised to avoid collecting DOB and unrelated identity information.

If the final technical design requires a different lawful basis for a specific processing operation, TheoryXP will update this policy before that processing begins.

No sale or advertising use

TheoryXP does not sell AI Tutor messages or age-eligibility data and does not use them for third-party behavioural advertising.

18. AI Tutor pre-activation control

Before AI Tutor is enabled for production users, TheoryXP must reconcile the final implementation against this policy, the DPIA, ROPA, Data & Privacy Map, Vendor/Processor/Transfer Register, App Store privacy answers and the exact network requests made by the release candidate.

If the implemented data flow is materially broader than described here, the public wording must be updated before activation.

V1.9 change note — 24 September 2026

This update preserves the existing V1.8 Privacy Policy and adds advance transparency for the planned AI Tutor, OpenAI processing, age-range eligibility, under-18 safeguards, provider retention, DVSA-content separation and AI-related rights.

Purpose
Provide Practice, Mock Tests, Road Signs, video-case-study and other learning features
Main lawful basis
Contract where applicable; otherwise legitimate interests to provide the requested core service
Purpose
Save progress and produce Topic Performance
Main lawful basis
Contract where applicable; otherwise legitimate interests to provide the requested core educational service
Purpose
Personalise Study Plans, Today’s Tasks and revision recommendations
Main lawful basis
Contract where applicable; otherwise legitimate interests for core educational personalisation, subject to child-user safeguards
Purpose
Operate optional Recovery Scanner category-based personalisation
Main lawful basis
Contract where applicable and the feature is requested; otherwise legitimate interests for the requested educational feature
Purpose
Keep saved/flagged/bookmarked learning items
Main lawful basis
Contract where applicable; otherwise legitimate interests to provide the requested feature
Purpose
Provide XP, streaks and learner-facing progress summaries
Main lawful basis
Contract where applicable; otherwise legitimate interests to provide the requested learning experience
Purpose
Use limited response-time/answer-change signals as secondary personalisation inputs
Main lawful basis
Legitimate interests, subject to a documented balancing assessment and child-user safeguards
Purpose
Protect accounts, licensed content and service reliability; prevent abuse/rate-limit misuse
Main lawful basis
Legitimate interests
Purpose
Use Apple-provided analytics/diagnostics to assess app quality and faults where available
Main lawful basis
Legitimate interests
Purpose
Answer ordinary support requests
Main lawful basis
Contract and/or legitimate interests depending on the request
Purpose
Handle statutory data-rights requests, data-protection complaints and required records
Main lawful basis
Legal obligation where applicable; legitimate interests for related administration
Purpose
Maintain the 12-month inactivity-retention process and send account-service warnings
Main lawful basis
Contract where applicable and legitimate interests/storage-limitation purposes
Purpose
Maintain accounting, tax, corporate and licensing records
Main lawful basis
Legal obligation and legitimate interests where applicable

Core service and younger learners

For core learning features, TheoryXP relies on contract where that basis is appropriate and on legitimate interests where needed to provide the requested learning service. When a learner is under 18, we take their rights and interests into account and apply the child-user safeguards described in our internal Children’s Code and data-protection assessments.

Where we rely on legitimate interests, our interests include providing the learning service, protecting users and licensed content, maintaining reliability, and delivering proportionate learning personalisation.

We do not rely on consent as a blanket basis for the core learning service. If we introduce optional processing that legally requires consent, you will be given a genuine choice.

7. Personalisation and profiling

TheoryXP uses deterministic learning rules to analyse revision evidence and decide what to show or recommend next.

The system may consider correctness, recency, evidence coverage, repeated errors, hint use, Recovery signals, study preferences and limited behavioural signals such as response time or answer changes.

Response time and answer changes are secondary supporting signals. They may slightly influence revision priority, but they cannot by themselves classify a learner as Weak. TheoryXP uses minimum-evidence thresholds and relative patterns rather than treating one slow answer as proof that a learner is struggling.

TheoryXP does not use these signals to infer emotion, anxiety, mental state or health.

TheoryXP does not currently use the learner profile for behavioural advertising, pricing, access eligibility or unrelated commercial decisions.

The current learning recommendations do not make decisions that have legal or similarly significant effects on you.

8. Who receives information

We use service providers and platform services where needed to run TheoryXP:

  • Supabase — authentication, database, private storage, backend infrastructure and request/security logging;
  • GitHub — a private recovery ledger containing only minimal pseudonymous account-deletion records used to help prevent deleted accounts from being unintentionally restored from a database backup;
  • Google — if you choose Google Sign-In, and for Google-hosted services used by TheoryXP where applicable;
  • Cloudflare Email Routing — receives mail sent to support@theoryxp.app and forwards it to TheoryXP’s support mailbox;
  • Resend — transactional account-service email such as inactivity-deletion warnings; and
  • Apple — App Store distribution/purchases and Apple-provided app analytics/diagnostics under Apple’s systems.

Support/privacy emails sent to support@theoryxp.app are currently routed through Cloudflare Email Routing to a Google-hosted support mailbox. Email providers necessarily receive message content, sender information and routing metadata needed to deliver and store the correspondence.

Where a provider processes personal information on TheoryXP’s behalf, we use appropriate written processing/contractual safeguards, assess its data-protection and security arrangements, and limit the processing to the service purpose. Where a provider acts as a separate controller for its own platform activity, its own privacy notice and legal responsibilities also apply. Apple and Google are examples of providers that have independent responsibilities for parts of their platform/account services.

TheoryXP requires third parties receiving user data through our chosen service arrangements to provide protections consistent with applicable law and, where Apple’s App Review rules apply, the same or equal protection described for the relevant user data in this policy.

We do not currently send learner data to an advertising network or external AI/LLM provider. We do not sell personal information.

We may disclose information where required by law or where reasonably necessary and proportionate to protect rights, users, licensed content or service security.

Corporate transactions

A “corporate transaction” means a legitimate business change such as a merger, acquisition, financing, reorganisation, sale of all or part of the business/assets, or transfer to a successor operator. If such a transaction requires personal information to be disclosed or transferred, we limit the information to what is reasonably necessary, use appropriate confidentiality/data-protection safeguards, and provide any notice required by law. A successor that becomes controller remains responsible for complying with applicable data-protection law.

9. Where information is processed and international transfers

TheoryXP’s live Supabase project is hosted in the London (eu-west-2) region.

Some suppliers operate internationally. Depending on the provider and service, information may therefore be processed outside the UK.

Where TheoryXP makes a restricted transfer of personal information, we use an applicable UK-recognised safeguard or lawful transfer mechanism, such as:

  • an adequacy regulation/recognised adequacy arrangement;
  • an applicable UK International Data Transfer Agreement/Addendum or other approved contractual safeguard; or
  • another lawful mechanism available under UK data-protection law.

Current provider arrangements are tracked internally. For example, Supabase, GitHub, Resend and Cloudflare publish privacy, data-processing and/or international-transfer information relevant to their services. Google and Apple also publish their own privacy and international-transfer information for their independent services.

10. How long we keep information

Our current retention approach is:

  • Active account and learner progress: kept while needed to provide your active account/service.
  • 12-month inactivity rule: if there is no recorded account activity for 12 months, your account may become eligible for automatic deletion.
  • Email-linked accounts: we send an advance inactivity warning and provide at least 30 days before deletion.
  • Guest/no-email accounts: we may be unable to send an email warning. A Guest account that remains inactive for 12 months may therefore be deleted without an email warning.
  • Returning before deletion: refreshes the inactivity period and cancels pending inactivity deletion.
  • Uninstalling: deleting the app from your device does not itself delete your server-side account.
  • Delete Account: when you delete your account, we delete your active account and associated learner data from active TheoryXP systems, subject to information that must lawfully be retained. We may retain a minimal pseudonymous deletion record for a limited period solely to ensure that your data is not unintentionally restored from a backup. This record does not contain your name, email address, learning history or other account content and is deleted once the relevant backup-recovery period has passed. Under TheoryXP’s current Supabase Pro plan, deleted database data may remain within the provider’s normal daily-backup rotation for up to 7 days before the relevant backup expires.
  • Response-time and answer-change evidence: retained as part of the existing learner attempt history while that account history is retained. TheoryXP does not maintain a separate raw psychological/emotion profile. Derived timing/answer-change data follows the account-linked learning-data lifecycle.
  • Recovery source image/raw OCR: not retained by TheoryXP’s server under the current architecture.
  • Rate-limit/security events: matching TheoryXP rate-limit records are currently cleaned after approximately two days. Supabase’s current Pro API & Database log retention is 7 days.
  • Apple-provided analytics/diagnostics: controlled principally through Apple’s reporting systems and retention windows; TheoryXP does not currently operate a separate third-party analytics database.
  • Support/privacy correspondence: normally kept for up to 12 months after the matter is closed, unless longer retention is reasonably needed for a dispute, security investigation, regulatory matter or legal obligation.
  • Business/accounting/licensing records: kept separately for the periods required or justified for the relevant legal/business purpose.

Hide History is not the same as deleting learning data. It hides older Practice history from that view while underlying learning evidence may remain for the learning engine.

11. Your data rights

Depending on the circumstances and lawful basis, you may have rights to:

  • be informed about how your information is used;
  • access your personal information;
  • correct inaccurate information;
  • ask for deletion;
  • restrict processing;
  • object to processing based on legitimate interests;
  • receive certain information in a portable format; and
  • withdraw consent where a particular processing activity genuinely relies on consent.

You can use Export My Data and Delete Account in TheoryXP. You can also contact support@theoryxp.app. You do not need to use legal terminology or a particular form to exercise a data-protection right.

Valid data-protection rights requests are handled without undue delay and within the time limits required by law.

Your right to object: if we rely on legitimate interests for a particular use of your information, you can object by contacting support@theoryxp.app. We will consider the objection under the applicable legal test.

Data protection complaints

If you have a complaint about how TheoryXP handles your personal information, email support@theoryxp.app. You can also complain to the UK Information Commissioner’s Office (ICO): https://ico.org.uk/make-a-complaint/.

12. Children and younger learners

TheoryXP may be used by learners under 18. We therefore aim to keep privacy information clear and age-appropriate and to use privacy-protective defaults.

TheoryXP does not use a learner’s weaknesses for behavioural advertising, public ranking, pricing or unrelated commercial profiling.

A shorter Privacy at a Glance summary is available alongside this policy, and feature-specific privacy information may be shown where a use of personal information may not be obvious.

13. Security

TheoryXP uses controls including authenticated accounts, ownership checks, row-level/data-access controls, private content storage and server-only administrative operations.

We also maintain internal security/access-control requirements covering least privilege, credential/secret handling, production access, account security, release security testing and incident response.

No online service can promise absolute security. If we become aware of a personal-data incident, we will assess and contain it where appropriate, keep the required internal record, and make any notifications required by applicable law.

14. Storage/access technologies on devices and websites

TheoryXP’s iOS app uses device-side technologies needed for functions such as authentication/session handling, local app state, Google Sign-In where chosen, and on-device Recovery processing.

TheoryXP does not currently use a third-party advertising tracker or dedicated third-party analytics SDK.

UK rules on storage/access technologies can apply to mobile apps as well as websites. Where a technology requires prior consent, it will not be enabled before the required information and choice are provided. Technologies that fall within a legal exception may be used without consent where the exception applies, while still being described where data-protection transparency requires it.

The public website must likewise be assessed against the technologies actually deployed. Non-essential cookies/local storage/tracking will not be introduced silently.

15. Changes to this policy

We review this policy when our data practices materially change and at appropriate release/compliance reviews.

If we plan to use personal information for a materially new purpose, we will update the relevant privacy information and bring that change to affected users’ attention before the new processing starts where required.

In particular, a fresh review is required before introducing advertising, a dedicated analytics/crash SDK, external AI/LLM learner-data processing, precise geolocation, social/user-to-user features, a new class of sensitive information, materially different profiling or expansion into additional target jurisdictions.

We keep versioned copies so that material changes and effective dates can be identified.

16. Contact

TheoryXP Limited
Company number: 17320394
Registered office: 167-169 Great Portland Street, 5th Floor, London, London, United Kingdom, W1W 5PF
Registered in: England and Wales
Website: theoryxp.app
Privacy, support and data-protection complaints: support@theoryxp.app