Privacy policy

Last updated: 27 October 2026

("we", company number 17534029, registered office 13 Yew Tree Close, Welling, London DA16 3BY) runs . We are the data controller for the personal data described here, and we're registered with the Information Commissioner's Office (ICO registration number ZC282059). Contact: .

What we collect

Account details: your email address and a securely hashed password (we never see or store your actual password), and when you confirmed you're a teacher or education professional aged 18 or over.
Your resources: what you type into the builder and the resources it creates, so they can be saved in your library. Planning packs and home learning sheets you adapt are saved there too. They're made from Lessonsmith's own content and use no pupil data. A logo a school uploads for home learning sheets stays in that teacher's browser and isn't sent to us. If you keep a Revision Forge session in your past sessions, we keep its name, what you ran and how many pupils joined and finished, but never nicknames, tokens or answers. You can rename or delete it at any time.
Billing: if you subscribe, Stripe processes your payment. We receive your subscription status and a customer reference. We never see or store your card details.
Technical data: a login cookie that keeps you signed in, and server logs (such as IP address) kept for security.
Enquiries: if you contact us about a school licence or a partnership, the name, email address, organisation, role and message you send, so we can reply (lawful basis: legitimate interests).

Do not enter pupils' personal data

is for teachers. Please don't type pupils' full names, dates of birth, health or SEND details that identify a child, or any other information that identifies a pupil. For report comments, use first names or initials only.

Why we use your data

To provide the service you signed up for: your account, creating resources, your library and billing (lawful basis: contract).
To keep the service secure and prevent abuse (lawful basis: legitimate interests).
To send account emails such as password resets (lawful basis: contract).

We don't sell your data and we don't use it for advertising.

Signing in with Google or Microsoft, and Google Drive

Sign-in: if you choose "Continue with Google" or "Continue with Microsoft", we receive your email address (and, from Google, whether it is verified). We use it only to create your account and sign you in. We don't receive or store your password, contacts or other account data.
Google Drive: if you choose a file with "Google Drive", we can access only that file, and only when you pick it. We read its text to build your resource, then discard the file; we don't store it or look at any other files in your Drive.
Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We don't sell this data, use it for advertising, or use it to train AI models.

Who processes your data for us

Anthropic runs the AI that creates resources. What you enter in the builder is sent to Anthropic to generate each resource, under its commercial terms.
Google Cloud (Vertex AI) makes AI pictures when a member of staff asks for one. Only the description they type is sent (staff are asked not to include names or personal details, and emails, phone numbers and links are refused) to a Google data centre in the UK or EU. Google doesn't use it to train its models. The pictures are stored by Lessonsmith in the EU and labelled as AI-generated. Pictures in Lessonsmith's ready-made library are made by the Lessonsmith team from descriptions that never include personal data; these may be processed by Google outside the UK and EU. Pupils can't make pictures; they only see pictures the Lessonsmith team has checked.
Stripe handles payments.
Render, our hosting provider, runs the service and stores its database in the EU, in Frankfurt, Germany.
Resend sends account emails such as password resets.
Google and Microsoft sign you in, only if you choose to continue with them.
Fonts: we serve our fonts from our own server, so loading a page shares nothing with a font service.
Synthesia hosts our videos. A video loads only when you press play; Synthesia then receives your IP address and the usual details your browser sends, as with any website.

Your account, resources and school data are stored in the EU, which UK law recognises as giving adequate protection. Some of the providers above (Anthropic, Stripe, Resend, Google and Microsoft) are based in the United States. Those transfers are covered by appropriate safeguards such as the UK International Data Transfer Addendum or the UK–US data bridge.

School licences

If your school gives you a licence, your school's admins can see your email address, whether you have signed up, how many resources you have made and of which type, an estimate of the time saved, and when you were last active. They can't see the content of your resources. If you sign in with Google or Microsoft, we receive only your email address from them. If your school removes you from its licence, or its licence ends, you can keep a free personal account with the resources you made, with your school's permission. Otherwise, or if you or your school ask, we delete them.

Training studio

With a whole-school subscription, staff can use the Training studio. Here is who sees what:

Wellbeing check-ins: only you see your own answers. School leaders see totals for the whole school, and only once at least 5 colleagues have checked in in that period, so no one can be identified. Optional comments are shown to leaders without names, also only from 5 check-ins.
Anonymous surveys: leaders never see who answered. Results appear once at least 5 people have responded. Named surveys say so before you answer.
Live training sessions: the presenter sees quiz and poll totals and group answers. Your reflections are private and saved to your own CPD record, unless you choose to share one anonymously with the room.
Shared practice: posts and comments are visible to staff at your school. Please remove or cover pupils' names and faces before sharing work.
Coaching notes: seen by you and the colleague who wrote them. Other leaders see only school-wide themes.

To write activities, discussion guides and summaries, the relevant text is sent to Anthropic, our AI provider, under the same terms as the rest of Lessonsmith. We never send staff names or email addresses with it.

AI Labs (for pupils, in class)

AI Labs is the one part of Lessonsmith that pupils use, in a lesson run by their teacher. For schools, it's off until the school's admin switches it on. Here is what happens to pupils' information, in plain words:

No account, no name: pupils type the class code on their teacher's screen. We give them a random nickname, such as "Clever Otter". We don't ask for a name, email, age, school or anything else about them.
Pictures and sentences stay on the pupil's device: the camera, drawings and sentences are used by the pupil's own browser to train the model. They are never sent to us or to any AI provider.
What we keep, and for how long: the class code, each nickname, how many steps the pupil has finished, their quiz score and the hardest challenge they completed, a random code that keeps them in the session and a basic technical log (such as the time). We delete the nicknames and progress when the session ends, at the latest when the lesson time runs out.
What the teacher sees: nicknames, steps, quiz scores and challenge medals, nothing else. Do now answers, explanations and the rubric stay on the pupil's device.
Accessibility settings (text size, zoom and so on) are saved in the pupil's browser so they stay the same next time. They are never sent to us.
No tracking: no advertising, no profiling and no cookies for pupils. The browser keeps the session code only until the tab is closed.

For schools, we act as the school's processor for AI Labs under Schedule 4 of our Data Processing Agreement. We follow the ICO's Age Appropriate Design Code (the Children's Code): high privacy by default, the minimum data, and nothing shared.

Cyber Range (being tested)

The Cyber Range is being tested in a few lessons run by Lessonsmith. Pupils join with a class code and get a random nickname: no names, emails or accounts. The network, the attacks and everything pupils type happen in a pretend network inside their browser and aren't sent to us. We keep only each nickname's mission, step and how many tasks they've done while the session runs, so the teacher can see progress, and delete the session and everything in it a day after it ends.

Smith Coins (Experiments, Python Pathways and AI Labs)

Smith Coins let pupils carry on where they left off without an account. A coin's code holds only progress (such as missions or steps done, XP and rank). The coin picture can also hold the work typed, such as code or an explanation. Both are made in the pupil's browser and kept by the pupil. Nothing about a coin is sent to us, and pictures from AI Labs are never saved in a coin.

Where progress is kept on the device. While a pupil works in the Experiments, Code Detective or Revision Forge, their progress is kept in that browser tab only. It's cleared when the page is refreshed, reopened later or the tab is closed, so the next person on a shared computer starts with nothing. To carry on, the pupil enters their coin code or coin picture. During a live class lesson, an AI lab or a friends' group, a refresh keeps their place so they don't lose it mid-lesson.

"Remember my coins on this device" (optional, off unless chosen). On a device that's only theirs, a pupil can choose to have their coins remembered so they don't have to enter them each time. Only the coin codes (progress numbers, with no name and nothing typed) and Code Detective's level and solved cases are kept, in that browser's local storage. They're never sent to us, so we don't hold or see them. They're deleted automatically 30 days after they were last used, or straight away when the pupil taps "Forget my coins on this device" or clears the browser's data. The page asks pupils to confirm it's their own device first, and reminds them not to use it on a shared, family or school device. AI Labs coins are never remembered, because they belong to a lesson.

Python Pathways. Pupils learn Python step by step from Key Stage 3 to A level. Their code runs in their own browser and is never sent to us. Their progress (which skills and challenges they've done, and XP) and the code they write are kept in that browser tab, like the Experiments, and in their Smith Coin if they save it. The "Extra support" switch and the accessibility settings are remembered in that browser only. A teacher can set a project by sharing a link: the link holds only which project it is, so nothing about pupils is collected. Read-aloud uses the browser's own speech, on the device.

Verified coins (optional). If a pupil presses "Get my coin verified", their browser sends us the Turtle Range missions they've done and the programs that solved them, never their name or anything else about them. We check the programs, sign a certificate that goes into their coin picture, and keep nothing. When someone checks a coin picture, only its certificate is sent to us, and we keep nothing.

Coins verified by a teacher (AI Labs and Code Detective). In a live session, the teacher can confirm the work they saw. We then sign a certificate of that pupil's progress in the lab (steps, quiz score, challenge and year group, under their random nickname), which their page picks up and keeps in their coin. It's deleted from our server with the rest of the session.

Organisations licensed to use Smith Coins. We list the name, website, type of licence and start date of organisations that agree to be shown on our Partner page, and anyone can check a licence by its reference.

Pupil coins from a school

A school (or a teacher with a paid plan) can give each pupil a coin, so their work saves as they go and they carry on where they left off on any device. The school is the controller; we process coins for the school under our Data Processing Agreement.

What we keep for each coin: a random code (like COIN-7KQ2-M9TX), a random nickname, the class or year group (for example "Year 7"), the work and progress saved to it, and when it was last used. No names, no dates of birth, no photos.
Coins by year group: a school admin, or Lessonsmith for the school, can make a number of coins for each year from Year 4 to Year 13 without sending us anything about any pupil. The school hands out the coin cards and is the only one who knows whose coin is whose.
Card numbers and class codes: each coin has a serial number (No. 0001, 0002 …) and may belong to a class named with a code the school chooses (for example 7-ABC). Neither says who a pupil is: only the school's own spreadsheet matches numbers to names, and that spreadsheet is made and kept on the school's computer.
Class lists stay with the school. If a teacher makes coins from a class list, the list is read on their own computer and never sent to us. The spreadsheet that matches names to coins is saved on their computer only.
School sign-in turns into a coin. If the school has switched on pupil sign-in, a pupil can open their coin by signing in with their school Google or Microsoft account. We turn the email address into a one-way fingerprint (a keyed hash that can't be turned back into the address) and throw the address away. The fingerprint is all we keep, and it's used only to find that pupil's coin. The first time, the pupil chooses their year and picks up the next free coin; while they choose, we hold the fingerprint for up to 15 minutes.
QR codes on coin cards open the coin page with the code after a "#", the part of a link that browsers don't send to us. The page uses it, then removes it from the address bar.
Remembering: a coin stays open for 12 hours on a device, or for 30 days if the pupil ticks "Remember me on this device", which is off unless chosen and meant only for the pupil's own device. "Sign out" ends it straight away. Pupils can also download their coin picture, which holds the code, to open the coin again later.
How long: coins work while the school's licence does. A school can free a coin (wiping its work) or delete a group at any time. Coins that nobody has used for over a year are deleted.

Revision Forge (GCSE revision)

Revision Forge works with no account. In plain words:

Revising on your own: nothing is sent to us. Your exam board, answers, brain dumps, plans and code are kept in your browser until the page is refreshed or closed, and in your Smith Coin if you save it. Python runs on your device.
In a class session: your teacher (who has a Lessonsmith account) starts it. You join with a class code and get a random nickname. Your page sends us only the activity, your step number, your quiz score and your token (your Smith Coin code, which holds progress, never a name). What you type is never sent.
Your token, your choice: at the end you choose to keep your token or delete it. If you delete it, it's removed from your teacher's list. Your teacher can download the class's nicknames, tokens and scores, so they can give a token back to anyone who loses theirs.
Deleted after 24 hours: sessions, nicknames, steps, scores and tokens are deleted from our server 24 hours after the session ends.
Sending a coin to a teacher: pupils send their coin themselves, the way their school already uses (for example school email). Teachers open it on their own computer: it isn't sent to us. When a teacher downloads a mark scheme, only the question numbers are sent.
Exam practice answers stay on the pupil's device and in their coin picture. They're never sent to us.
Tasks from the teacher: a teacher can set an exam-style paper for the pupils in their session, or for a class's tokens. The questions are text, shown on the pupil's page as text. What the pupil writes stays on their device. We keep only whether they finished, how many questions they answered and, if they mark their own work against the mark scheme, those marks, next to their nickname. Session tasks are deleted with the session (24 hours after it ends); class tasks close within 30 days and are deleted 30 days after that. A pupil's code or token only ever opens their own session's or class's tasks.
Joining at the /join page: pupils can type their class code at one short address (/join, or a link like /join/ABC123). The page only looks the code up and sends the pupil to their teacher's live Revision Forge or AI Labs session, where they join as before. Nothing is stored when a code is looked up, codes only work while the session is live, and lookups are rate-limited so codes can't be guessed. Pupils' own friends' groups can't be reached from /join.
For schools: we act as a processor for the teacher's school, the minimum data is used, nothing is shared or used for advertising, and it follows the ICO's Children's Code (high privacy by default).

Keeping what pupils see safe

Pupils in a session only ever see Lessonsmith's own content (written and checked by us), plus any questions, titles and comments their teacher writes. Only adults who confirm they work in education can make an account, and pupil-style email addresses are refused. To protect pupils (in line with Keeping Children Safe in Education):

Teachers' own words are checked. Anything a teacher writes for pupils (their own questions, paper titles, mark scheme notes and marking comments) is checked before it can reach a pupil. Web links, email addresses, phone numbers, messaging and social media apps, requests to meet, keep secrets or send pictures, and unsuitable language are refused. When something is refused we log that it happened and why (for example "a web link"), not the text itself. The school's safeguarding log shows it for staff at a school.
Teachers without a school use our questions only. Teachers who aren't linked to a school (whose staff are checked by that school) can set Lessonsmith's own questions for pupils, word for word, but not their own or edited ones. They can still print papers with their own questions.
Pupils can report a task. A "🚩 Something in this task worries me" button is always on screen during a task. The pupil chooses a reason (they don't type anything), the task is hidden from every pupil straight away, and Lessonsmith reviews it. The report appears in the school's log so its designated safeguarding lead can follow it up. Pupils are also pointed to a trusted adult, Childline (0800 1111) and 999.
Teachers control who's in the room. A teacher sees every nickname in their session, can remove anyone they don't expect (their access stops at once), and can lock joining so nobody else can join, even with the code. Codes stop working when the session ends.
No contact between people. There's no chat or messaging, pupils get random nicknames, and no one can see anyone else's work.
The owner's pause. Lessonsmith can pause all pupil joining and tasks at once, and suspend any account, if something goes wrong.

Pupils can use our free learning resources without logging in. Signing in with a school login needs authorisation: unless their school has authorised pupil sign-in on a whole-school licence, pupil logins are blocked. A school can let its pupils sign in to Revision Forge with their school Google or Microsoft account. It's off unless the school's admin switches it on for the school's own pupil email domains. When a pupil signs in, Google or Microsoft tells us their email address so we can check it's on their school's domain; we don't store it, or their name, and we don't create an account. We keep only a pupil session: a random key (stored as a hash), which school it's for, and when it ends (after 8 hours). It opens the subjects their school has. Their progress stays in their Smith Coin, as before. The school is the controller; this is covered by Schedule 8 of our Data Processing Agreement.

Class rewards (only if a school turns them on)

A school can let teachers offer small rewards to the whole group in a live Revision Forge session, for reaching a Smith Coin level. We keep the reward wording with the session (deleted with it, 24 hours after it ends) and each nickname's coin level, a number from 0 to 4, so the teacher can see who has reached a level. We never handle payments, gift cards or delivery, and we don't record who receives a reward: the teacher checks the pupil's coin and gives the reward in class. This is covered by Schedule 9 of our Data Processing Agreement.

Saved exam papers (teachers)

Teachers can save the papers they build to their account. A saved paper holds its title, the date, the course (subject, level and board), the topics, the questions and mark scheme, and a summary of its marks and skill range. It holds no pupil information, and teachers are asked not to put pupils' names or personal details in their own questions (which are checked in the same way as tasks). Only the teacher who saved a paper can see it. Papers are kept until the teacher deletes them, or deleted with their account.

Revision Forge Plus and class tokens

Revision Forge Plus adds subjects beyond Computer Science. Schools and teachers with Plus can give each pupil a class token (like RFT-XXXXX-XXXXX). It unlocks every subject and keeps the pupil's progress so they can carry on at school or at home, still with no pupil account.

No pupil names reach us. When a teacher adds a class list, the names are read and matched to tokens on the teacher's own computer, and only go into the teacher's own download. We're sent the class label (such as "10B Science") and how many tokens to make. Teachers are told not to put names in class labels, and labels with email addresses are refused.
What we keep for each token: the token, a random nickname, the class label, the date it was last used, and for each subject the pupil's Smith Coin code (progress only) with a few numbers: activities done, mastered and XP. Nothing a pupil types is sent.
Who can see it: the teacher who made the class, and their school's Lessonsmith admins. A teacher can match nicknames to names on their own computer by opening their own file; that matching never comes to us.
How long: a teacher or school admin can delete a class's tokens at any time, which deletes the progress with them. Tokens nobody has used for over a year are deleted automatically, as are a school's tokens if it leaves Lessonsmith (within 30 days).
Pupils can still use their own coin. A token is a convenience: pupils can always save their Smith Coin instead.
For schools: the school is the controller and we're its processor (Schedule 5 of our Data Processing Agreement). The data is pseudonymised: on its own, it doesn't identify anyone. Schools should mention Revision Forge in their privacy notice to pupils and parents and in their DPIA, as they would any learning platform.

All revision questions and activities are written by Lessonsmith; they aren't copied from exam boards' papers or mark schemes.

Practice tests (answers handed in for the teacher to mark)

In a live session, a teacher can set a practice test. Pupils type, write by hand or draw their answers and hand them in for their teacher to mark. It's built so that Lessonsmith can't read pupils' work:

Sealed on the pupil's device. Before anything leaves the pupil's browser, their answers are encrypted with a key that only exists in their teacher's browser (end-to-end encryption: ECDH P-256 with AES-256-GCM). We pass on an envelope we can't open.
Collected, then deleted. The teacher's browser collects the sealed answers, opens them, and we delete our copy straight away. Anything not collected is deleted with the session, 24 hours after it ends.
Marked in the teacher's browser. Marking (pen marks, symbols, marks and comments) is kept in that browser on the teacher's device, not on our servers. Teachers can save a password-protected marking file to their school's storage, and delete everything from the device at any time.
Handed back with a return code. When a pupil hands in, they get a random return code that's saved in their Smith Coin. The marked paper is sealed with that code and left in the teacher's next live session, under a fingerprint of the code that we can't turn back into it. Only the pupil holding the code can collect it, and we delete it as soon as they do (or with the session, 24 hours after it ends).
What we can see: that a sealed envelope was handed in by a session nickname, its size and when. Teachers see nicknames, never names, and pupils are asked not to write their names in their answers.
On the pupil's side: marks and comments go into the pupil's Smith Coin. Green-pen corrections they type are kept in their coin; handwritten corrections stay on their device for that visit, and in the marked paper if they download it.
AI suggestions (optional): a teacher can ask AI to suggest a mark, or a full-marks answer with exam tips. Only when they ask, only where the school has switched it on (teachers without a school confirm their school allows it), and only the question, its mark scheme and that one answer are sent to Anthropic, our AI provider, under its commercial terms (it doesn't keep or train on the content). Nicknames are never sent. Suggestions are always labelled, the teacher checks and confirms every mark, and pupils see when AI helped.
For schools: practice tests are covered by Schedule 5 of our Data Processing Agreement. Schools can switch practice tests, and AI suggestions, on or off in their safety settings.

A level, hints and model answers

Revision Forge also covers A level in ten subjects. A-level students are usually 16 to 18, so they are still children under UK data protection law and we treat them exactly as we treat GCSE pupils, in line with the ICO's Age Appropriate Design Code:

Nothing new is collected. A-level subjects use the same Smith Coins, class tokens and live sessions as GCSE, with no accounts, names or emails. A-level progress is held in the same way, as a coin code and a few counts.
Hints stay on the device. Hints come one at a time and never give the answer straight away. Which hints a pupil opened is kept only in their browser and their coin, not sent to us.
Model answers. After a pupil has written and checked their own answer, they can ask for a marked model answer. The request contains only the question's ID (and the class token or session key the page already uses to check access). Their own answer is never sent, and we keep no record of who looked at which model answer.
Explainer reels are short animations built into the page from text and icons: no video is streamed, no third-party player is used, and nothing is tracked. They wait for a press of play and show every frame at once for anyone who prefers reduced motion.
For schools: the A-level add-on is covered by the same Schedule 5 of our Data Processing Agreement, with the same data, the same retention and the same deletion rules. Nothing about the processing changes; only which subjects open.

Revise with friends (pupil groups)

A pupil can start a small group on Revision Forge and share a 5-letter code with up to 4 friends, with no accounts. It's kept small and simple on purpose:

What we keep: the group's code and topic, and for each person a random nickname and how many steps they've done. No names, scores, Smith Coin codes, chat or anything typed.
Who sees it: only the people in the group, who see each other's nicknames and steps.
How long: a group lasts up to an hour. Someone leaving is removed straight away, and the whole group is deleted an hour after it ends.
Groups can only use free topics. Teachers run whole classes from their own teacher page instead.

Primary SATs and 11+ (teachers only)

Primary SATs and 11+ revision is only for signed-in teachers. It doesn't use or store any pupil information: teachers teach the units and print sheets for pupils to write on by hand. We only check whether the teacher has Revision Forge Plus.

The parent and carer guide

The parent and carer guide needs no account and stores nothing about you or your child:

The exam countdown is worked out on your device.
The home practice card is made on your device. A child's first name, if you type one, is only printed or shown on your screen: it's never sent to us.
The progress check reads your child's Smith Coin code on your device. The code holds only progress numbers, not who your child is, and isn't sent to us.
We never contact children, and children don't need an account to use our free tools.

SEND Suite trials (research and development)

The SEND Suite is an experimental tool for special schools, opened only with trial coins we issue. In plain words:

When you request a trial, we keep your name, role, organisation, work email, the number of staff and weeks, and your message, so we can verify you and run the trial. We delete these details 30 days after the trial ends or the request is declined.
ID checks: you email us a photo of your school or employee ID card. We use it only to check who you are, and delete it as soon as we have.
Coins: we keep only a scrambled (hashed) version of each coin code, and the date it was last used.
Pupil records are never sent to us. They're kept in your browser while you work and saved inside your coin picture, encrypted with the trial's key. We hold that key only while the trial runs, and delete it when the trial ends, so the records can't be opened again by anyone.
Use pupil codes or initials, never names. Your school remains the controller of anything you record, under your own data protection policy.

How long we keep it

We keep your account and resources while your account is open. You can delete individual resources at any time. If you ask us to close your account, we delete your data within 30 days, except billing records we must keep for tax purposes (usually 6 years).

Your rights

You can ask to access, correct, delete or export your data, or object to how we use it. Email . If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ico.org.uk).

Two-step sign-in and the security log

If you turn on two-step sign-in, we store your authenticator app's secret encrypted and your recovery codes hashed. We record security events (such as two-step sign-in being turned on, a recovery code being used, or a school setting changed) with the account's email address, for 400 days, to protect accounts and investigate problems. School admins see their own school's events. The log never contains pupil data or resource content.

Attacks and incidents. When the site notices an attack (for example repeated wrong two-step codes on an account), it opens an incident with the account's email address, the date and time of each attempt and what was done about it. Visitors are shown as a short code, never an IP address. Only the Lessonsmith owner sees incidents. Small ones close themselves after a quiet day; resolved ones are shown for 30 days. The owner can export the security log to keep it safely offline, and whatever is exported is then deleted from our servers. Anything not exported is deleted on the usual schedule (security events after 400 days, activity counts after 30 days).

Cookies

We use one essential cookie to keep you logged in, and, while you type your two-step sign-in code, a second essential cookie that lasts 5 minutes. We don't use advertising or tracking cookies.

Pupils using a school coin get an essential cookie that keeps their coin open (12 hours, or 30 days if they choose "Remember me on this device"), and, just after their first school sign-in, one that lasts 15 minutes while they choose their year (see pupil coins from a school).

Our pages also use the browser's own storage for things you ask them to do: keeping your work in the current tab, your accessibility settings, and, only if you turn it on, remembering your Smith Coins on your own device (see where progress is kept). None of it is used for advertising or tracking, and none of it is sent to us.

Back to home