Privacy

The short version

• One account covers the bookstore, A-Practice and the Library, and this policy covers all three.
• We collect what it takes to deliver your books, run your practice and protect the library's books.
• We do not sell your information, use it for advertising, or send you marketing email.
• Ask us and we will show you what we hold, correct it, or delete it.

Who we are

Score A* publishes Cambridge-aligned books and learning resources, and runs three sites: this bookstore; A-Practice, the learning platform for students, teachers and parents; and the Library, where readers open the books granted to them. They share one account, so this is the privacy policy for all three. Where one of them does something the others do not, the section below says which.

“Score A*”, “we” and “us” mean the team that runs them. To reach us about anything here, see Contact us at the end.

Your account

An account on any of the three sites holds:

• your email address and name;
• your password, which is held by Google's Firebase sign-in service and never stored or seen by us, or, if you sign in with Google, the name, email address and profile picture Google shares with us;
• your phone number and the city you live in, asked once, the first time you sign in anywhere;
• when the account was created and last changed.

We only let you sign in once your email address is verified, because the bookstore matches your order history to it.

Orders

Placing an order, whether signed in or as a guest, records:

• your name, email address and phone number;
• the delivery address: city, area, street, building, apartment, and any notes you add;
• what you ordered, what it cost, how you chose to pay, and the order's progress to delivery.

Cash is paid to the courier. Instapay is a transfer from your own bank app, so we never see your bank or card details, only whether the money arrived and how much. The screenshot we ask for reaches us on WhatsApp, described below.

The store keeps a list of the books your account owns, worked out from your paid orders, so the extras that come with a book open for you. It is rebuilt from the orders themselves, so a cancelled order drops out of it. A guest order is kept under the email address it was placed with, and appears in your order history if you later create an account with that address.

If you buy from us over WhatsApp or social media, our team records the sale against the phone number you gave. It unlocks the same extras for the account with that phone number, or for the first account to add it.

WhatsApp

When you message the store's WhatsApp number, we keep the conversation, including the photos, voice notes and files you send and our replies, so anyone on our team can pick it up. What you send is copied into our own storage, because WhatsApp keeps it only for a limited time. We show your orders beside the conversation by matching your WhatsApp number to the phone number on them.

A message about an order may carry Confirm and Cancel buttons. Tapping one acts on that order only if it comes from the phone number the order was placed with.

A-Practice

The learning platform keeps what it needs to set up your dashboard and follow your progress:

• your role: student, teacher or parent;
• your gender and, for a student, date of birth, school and school year, or for a teacher, position and years of experience;
• the quizzes you create and take, your answers and your scores;
• your scores in the games;
• which parts of the platform you open and when, so we can see which features are used.

Some of it is seen by other people:

• In Battle Royale and on the Math Rush leaderboard, other players see your name and score.
• A parent can ask to link to a student's account by entering the student's email address. The student is emailed and decides. Only if they approve does the parent see their quizzes, scores and progress.

The Library

The Library is built to keep its books from being copied, and part of that is personal:

• the books you have been given, and which member of our team invited you;
• your agreement to the library's terms: when you agreed, which version of the wording, your IP address and your browser's identification string;
• the one device your account is bound to: a key created in your browser whose private half never leaves it, a label such as “Chrome on Windows”, and a record of each time a device was bound or released;
• a mark on every page you open that identifies your account. It carries neither your name nor your email address, but it tells us which account opened a page, and we will use it if a page appears somewhere it should not.

A marked copy of each page is made the first time it is opened for you and kept for your account. The Library does not log when or how often you read, and it does not try to detect screenshots.

Analytics and cookies

The bookstore uses Google Analytics to count visits and see which pages are used. A-Practice counts visits itself, as described above. The Library runs no analytics at all. Opening a link someone shared with you sets a cookie that lets us tell the person who shared it how often it was opened.

The cookie policy lists every cookie in full, including what the shared-link cookie records.

Email

We email you about your account and what you have asked for, and nothing else: confirming your email address, resetting your password, your orders, an invitation to the Library, and a parent's request to link to your A-Practice account. There are no newsletters and no marketing email.

How we use it

• to sign you in and keep your account secure;
• to deliver your orders and tell you where they are;
• to open the extras and library books you are entitled to;
• to answer your messages;
• to run A-Practice, and show a linked parent what a student has agreed to share;
• to protect the Library's books and trace a page that leaks;
• to see, in aggregate, which parts of our sites are used, so we know what to improve.

We do not sell or rent your information, use it for advertising, or pass it to anyone to market to you.

Who else handles it

We rely on a few services to run the sites. Each handles your information for us, only to do its job:

• Google Firebase: accounts, sign-in, and the database everything above is kept in.
• Cloudflare R2: file storage for books, marked library pages and WhatsApp media.
• Google Analytics: visit counts on the bookstore.
• Meta, through the WhatsApp Business Platform: every message to and from our WhatsApp number.
• Gmail: sending our emails.
• Our courier, currently Speedaf: your name, phone number and delivery address, which it needs to reach you.
• Our hosting providers: they run the sites, so every request passes through them.

Beyond them, we share information only when the law requires it, or to protect our customers, our books or ourselves from fraud and misuse. These services operate internationally, so your information may be stored and processed outside Egypt.

How long we keep it

Your account, and what it holds, stays for as long as the account does. Orders are kept as the record of a sale, which we need for our own accounts, even after an account is deleted. Some things expire sooner: an invitation to the Library works for seven days, a parent's link request for one day, and the shared-link cookie lasts a year.

Your choices

You can ask us at any time to:

• tell you what we hold about you, and give you a copy;
• correct anything that is wrong;
• delete your account and what it holds, apart from the order records described above;
• stop using your information for a purpose you object to.

Write to us from the email address on your account, so we know the request is yours. You can also block or clear cookies in your browser, and turn Google Analytics off with Google's opt-out add-on.

Children

Many of the students who use our books and A-Practice are children, so we collect from them nothing beyond what this page describes. We encourage parents to set up and supervise their children's accounts, and a parent can link to their child's A-Practice account to follow their progress. If you are a parent and want to see, correct or delete what we hold about your child, contact us.

Keeping it safe

• Your session is a cookie that page scripts cannot read, and it is sent only over encrypted connections to our own sites. Signing out of one site signs you out of all three.
• Passwords are held by Firebase, never by us.
• Files are kept in private storage, not at public web addresses.
• Only approved members of our team can sign in to the console where orders and messages are handled.

No system is perfectly secure, but these are the protections we rely on.

Changes to this policy

When we change what we collect or how we use it, we update this page and the date at the top. If a change is significant, we will also say so on the site.