Privacy Policy

01The short version

You can use the whole free tier — the first lesson of every one of the 29 physics modules, plus every simulation and interactive lab — without an account and without giving a single personal detail. If you do make an account, it needs a username and a password — that is the whole requirement. You may add an email address so that a forgotten password can be reset, but nothing here obliges you to.

• Google Analytics measures visits and site use. GioPhysics does not use advertising, social or session-replay trackers.
• An email address on an account is optional. Its only jobs are confirming the address and resetting a forgotten password.
• One cookie, set when you sign in, so that you stay signed in.
• Card details are typed on Stripe’s pages and never reach GioPhysics.
• Your data is never sold and never shared with advertisers.

02What an account stores

An account exists to remember where you are in the course. It holds:

• Your username, and your password in hashed form.
• One email address, only if you choose to add one, with a normalised copy of it used to check that it is not already on another account, and the time it was confirmed. An account without one works exactly the same.
• Your progress — which sections you have completed, which questions you have solved, and how many you got right.
• Exam results you type in yourself. GioPhysics never receives results from a school or an exam board.
• Your plan and its status, and, if you subscribe, the Stripe customer and subscription identifiers that connect your account to your payment. No card data.
• If you start the free trial, its start and expiry times and whether it has been used. This keeps the 72-hour window accurate and limits the offer to one trial per account. Starting it stores no card or payment details.

An account may be held by someone aged 13 or over, and under-18s should have a parent or guardian’s permission. Where a school holds the licence, the school administers its students’ accounts — see Student Data.

03When an email address is collected

Four places on the site involve an email address. All four are optional, and none of them is part of studying.

• Your account, if you add one. You can register and use everything with a username and a password alone. Adding an address lets you confirm it and, after that, reset a forgotten password. Nothing else reads it: no newsletter, no marketing, no notifications about your progress.
• The free formula sheet on the Trial page. Asking for it stores your email address, which page the request came from, whether you ticked the revision-tips box, and the time. The address is used to send revision tips only if that box was ticked; left unticked, it is stored and used for nothing else.
• The free Physics IQ Test, if you choose to save your interest. The ten answers and diagnostic score stay in the page and are not added to the lead database or sent to Google Analytics. If you explicitly agree and submit an address, GioPhysics stores that address, the Physics IQ Test source, and the time so it can contact you about the diagnostic and relevant free learning resources. You may instead view the result without saving if submission fails.
• The public contact form. It uses the name, email address, subject and message you enter solely to deliver the message to [email protected] and to answer you. The form does not store the message in the GioPhysics D1 database or add the address to a marketing list. If server delivery is unavailable, it prepares a message for your own email app instead.

Those addresses are used to send you what you asked for, to reply to you, and to get you back into your own account. Nothing else.

04Cookies and site analytics

GioPhysics sets __Host-gio_session when you sign in. It carries an opaque session token and nothing else. It is HttpOnly and SameSite=Lax, and it is strictly necessary — without it you could not stay signed in.

Google Analytics is also installed to show which pages are visited and how people move through the site. The Google tag may receive the page address, referrer, browser and device details, approximate location derived from network information, and engagement events. It may set measurement cookies. GioPhysics uses this information to improve lessons and navigation, not to grade learners or sell data. Google processes this measurement data under its own privacy terms. The Physics IQ Test sends anonymous funnel milestones—starting the quiz, completing it, and selecting the trial link—but does not send question answers, scores, curriculum choices, or email addresses. GioAI sends only the selected curriculum, topic, and request outcome as an analytics event; the question, optional context, explanation, diagram, and practice response are never included in analytics. The Parent Physics Plan is generated in your browser from the three choices you enter. GioPhysics does not send or store the learner's current grade, curriculum, exam date, or generated plan. There is no Meta pixel, Hotjar, session replay or social pixel.

05Your IP address

When you create an account, sign in, ask for or open a confirmation or password-reset link, or send one of the forms above, your IP address is checked against a rate limit. That is its only use: stopping brute-force sign-in attempts, link guessing and form abuse. The rate-limit record holds a hash of the address rather than the address itself, and it is never attached to your account. It is not used to profile you, and it is not used for analytics.

06Payments and card details

Subscriptions run through Stripe Checkout. Your card number, expiry date and CVC are entered on Stripe’s own pages and never reach GioPhysics servers or its database.

What comes back is only what is needed to know that you are a paying member: a Stripe customer id, a subscription id, your plan, and its status.

07How your password is protected

Your password is never stored in plain text. What is stored is a hash of it, produced with PBKDF2 using a salt held alongside it and a recorded iteration count.

Sign-in tokens work the same way. The database keeps only a hash of the session token, so the token itself exists nowhere but your browser.

Confirmation and password-reset links follow the same pattern. Each link carries a random token, and only its SHA-256 hash is stored, so the link that reaches your inbox cannot be read back out of the database. A confirmation link lasts 24 hours. A reset link lasts one hour and works once.

Completing a reset signs out every device on that account — if someone else had got in, the reset is what puts them out. Changing your password from inside your account is gentler: the device you are using stays signed in and the others are signed out.

08Where your data is stored

The site runs on Cloudflare. Pages are served from Cloudflare Pages, server-side logic runs in a Cloudflare Worker, and the database is Cloudflare D1. Cloudflare therefore stores and processes this data across its global network.

The site's infrastructure uses these services:

• Cloudflare — hosting, and the database your account lives in. GioAI uses Cloudflare Workers AI to produce its tutor response, so the question and any optional context you submit are processed by Cloudflare for that request. GioPhysics does not add the question or response to its account database.
• Stripe — payments and subscription billing.
• Cloudflare Email Service or Resend — delivery of confirmation, password-reset, and contact-form messages, and only where email delivery is configured. Where it is, the address and content needed for that message are passed over solely for delivery. Where it is not, no server-side mail is sent at all.
• The email provider for the contact inbox — a contact message is delivered to and held in that inbox so that Giovanni can read it and reply.

09How long it is kept, and how deletion works

Your account data is kept for as long as your account is open. You can delete it yourself from the account area, or ask for deletion by emailing [email protected].

Deleting an account removes the account record together with everything attached to it: sessions, progress sections, solved questions, exam attempts, membership and billing rows, and any email address held against it.

You can also remove just the address and keep the account. That deletes the stored address and any confirmation link still waiting to be opened, and the account carries on with a username and a password as before.

An email address given for the formula sheet or Physics IQ Test is separate from all of that, and can be removed the same way — email and ask. A contact-form message is not kept in the GioPhysics database; after delivery it exists in the destination inbox, like an ordinary email.

10Your rights, and what never happens

Email [email protected] and you can:

• Ask what is held about you.
• Correct anything that is wrong.
• Get a copy of your data to keep.
• Have it deleted.

And the things that never happen: your data is not sold, it is not shared with advertisers or data brokers, and it is not passed to anyone beyond the infrastructure providers and recipient inboxes doing the jobs described above.