How we look after your family's data

Honest Mocks is used by parents and the children they are helping prepare for exams, so we collect as little as we can, keep it in the UK where we can, and let you download or delete it yourself. This page says exactly what that means.

Last updated: 6 October 2026

Who we are

Honest Mocks (honestmocks.co.uk) runs this site. We are the controller of the personal data described here.

Questions about this policy or your data: use our contact form.

What we collect, and why

About you, the adult with the account

Your name and email address, and a sign-in method: an emailed code, a password, or your Google or Apple account. If you sign in with Google or Apple, we receive your name and email address from them (Apple lets you hide your real address). We use these to run your account.
Your family: the family name you choose, the other adults you invite (their email address and role, such as parent or tutor), and a log of changes made to the family and its children (who changed what, and when). Only parents in the family can see the log.

About your child

A child never has an account of their own and never gives us an email address. Everything about a child is entered by, and belongs to, the family's account.

A first name (any name you like) and birth month and year, never a full date of birth. We use the age to compare a score with what is expected at that age.
An exam date, if you add one, for the countdown.
Their practice: every paper they sit, each answer they choose or write, how long they spend on each question, how often they change an answer, and any marks you award for written answers. This is what the progress reports are made from.
Child sign-in, if you turn it on: a four-digit PIN (stored only in scrambled, hashed form) and a record of which devices are signed in, so you can sign them out.

From visitors who don't have an account

The Trap Pack: if you ask for it, your email address, which challenge you tried and whether you answered it correctly. We use this to send you the pack.
The contact form: your email address, your name if you give it, and your message. We use this to reply.
A paper sat before signing in is linked to a random identifier in a cookie on that browser, so it can be moved into your account when you sign up.

What we never do

We never sell personal data or share it with advertisers.
We have no advertising and no advertising or tracking cookies.
We never show a child's results to anyone outside their family: no leaderboards, no public profiles.
We never send a child's data to AI services. Some of our practice questions are written with the help of AI, but that happens separately, with no personal data involved.

Our legal basis

To provide the service you asked for (a contract with you): your account, your family, your children's practice and reports.
Legitimate interests: keeping the service secure, fixing problems, understanding which pages are used (in aggregate only), and checking that our questions are fair, for example by seeing how often a question is answered correctly across all children.
Consent: sending you the Trap Pack. You can ask us to stop at any time.

You give us your child's details as their parent or carer, to help them practise. We follow the ICO's Age Appropriate Design Code (the Children's Code): a child's settings are private by default, a child's own sign-in can only reach their own practice and results, and we do not use their data for anything they or you would not expect.

Who else handles the data

We use a small number of service providers. Each handles data only on our instructions, under a contract that requires them to keep it secure.

Neon hosts our database in London (UK). This is where the information above is kept.
Vercel hosts the website. Our server code runs in the United States (Washington DC). Vercel Web Analytics counts page visits without cookies and without identifying you.
Clerk runs sign-in for adult accounts and holds your name, email address and sign-in details.
Apple, if you choose to sign in with Apple.
Google, if you choose to sign in with Google. Our pages also load fonts from Google Fonts, which means your browser's IP address is sent to Google when you visit.

Vercel and Clerk are based in the United States, and some of their processing happens there. Where data leaves the UK, it is protected by the UK's adequacy regulations (including the UK extension to the EU-US Data Privacy Framework) or by the UK's international data transfer agreement.

We would only share data otherwise if the law required it, or to protect a child's safety.

Cookies and storage on your device

We use only cookies that are needed for the site to work, so we don't ask for cookie consent:

Sign-in cookies from Clerk, which keep an adult signed in.
ep_child: keeps a child signed in on their own device.
ep_family: remembers which family you were looking at, if you are in more than one.
ep_session: links a paper sat before signing in to this browser.

Your browser also stores answers in progress (so a paper survives a dropped connection), the last exam you looked at, and whether the timer chime is on. These stay on your device.

How long we keep it

Account and children's data: until you delete it. You can delete a child, all of your children, or your whole account at any time.
Trap Pack and contact messages: until we have dealt with them and for no longer than we need to, or until you ask us to delete them. Deleting your account deletes them too.
The family activity log: kept while the family exists, so that parents can see what changed. If you leave a family that other people still use, earlier entries keep your name.

Your rights, and how to use them

You can do these yourself, straight away, when signed in:

Download a child's full history from their progress page.
Correct a child's details from their progress page, and your own from your family account.
Delete one child, all of your children, or your whole account including your sign-in, from your family account.

You also have the right to ask for a copy of everything we hold about you, to object to or restrict how we use it, and to have it deleted without signing in. Use the contact form. We will reply within one month.

If you are unhappy with how we have handled your data, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk.

Keeping it secure

All traffic is encrypted. Children's PINs and sign-in tokens are stored only in hashed form. Access to each child's data is checked on every request, so one family can never see another's.

Changes to this policy

If we change what we collect or how we use it, we will update this page and the date at the top. If a change matters, we will tell account holders before it takes effect.