Privacy Policy

simplytk ("we", "us") operates this website at simplytk.com and is the data controller for the personal data described here. For anything privacy related, including questions, complaints or requests about your data, email simplytk.business@gmail.com.

Account details. Your email address and password (stored by our authentication provider, never readable by us) when you create an account. If you verify a university affiliation, the university email address you verify with and the inferred university name.

Leaderboard profile. The username you choose and your game scores. Usernames and scores appear on public leaderboards; your email address never does.

Documents you upload. CVs you upload for the CV tools and personal statements you draft or submit for review. These usually contain significant personal information, and we treat them accordingly: they are stored privately, never shown to other users, and only processed to provide the feature you used them with.

AI tool inputs. What you send to the AI features (CV rater, personal statement builder, interview prep, practice, study coach, health coach) and the responses, so the tools work and you can revisit results.

Health coach conversations. If you use the health coach, the messages you exchange with it. Health information is sensitive, so this feature is opt-in by nature: nothing is collected unless you choose to use it, and you can ask us to delete its history at any time.

Training log. If you use the training log, the sets you record: exercise, weight, reps, how hard it felt and the date. This is health data, so it gets the strictest handling we apply to anything: stored against your account alone, never shown to another user, never put on a leaderboard, and deletable in full from the log page itself without asking us.

Strength board entries. If you choose to publish to the strength board, the six numbers you enter there plus your username and, when verified, your university. This one is public by design and that is the point of it, so it is deliberately kept apart from your training log: nothing you log is ever read to build the board, publishing is its own decision, and withdrawing removes the entry outright.

Application tracking. The internships you save, application stages you record, study marks you log and deadline alerts you sign up for.

Reviews you leave. If you leave a review, the words you write, the name and context you sign it with, and optionally an email address. The review, the name and the context are public by design and go on the home page; your email address is only so we can reply, and never appears on the site. Ask us and we will take a review down.

Openings you submit. If you send us an internship or opening for the tracker, the details of the role and, if you give one, an email address so we can come back to you about it. The role goes on the tracker; you are not named next to it.

Free editions and downloads. Some resources, such as the free edition of the Spring Week Playbook, are unlocked with an email address and, if you give one, a first name. We keep them so we can send you the link back to what you unlocked, and so we can tell you once about the full version. Every such email carries a one-click unsubscribe.

Payments. Payments are handled by Stripe. Your card details go directly to Stripe and never touch our servers; we receive confirmation of the payment and what it was for. We keep a record of what was bought and when, because tax law requires us to hold sales records for six years. That record survives deleting your account, and it is the one thing here we cannot erase on request.

Usage analytics. First party product events such as pages viewed, games played and tools used, stored in our own database. We do not use third party advertising or tracking networks.

To provide the features you use (contract), to keep the service secure, rate limited and cheat free on the leaderboards, and to understand which features are worth improving (legitimate interests), and to send you emails you asked for such as deadline alerts and verification codes (consent, withdrawable any time via the unsubscribe link in every email). We do not sell your data, and we do not use it for advertising.

Only the processors needed to run the service: Supabase (database, authentication and file storage), Stripe (payments), our email delivery provider (transactional emails and alerts, sent from notify.simplytk.com), and AI model providers (currently Google and OpenAI models) that process the text you submit to AI features in order to generate a response.

We never post your data publicly except the leaderboard username and scores you chose to compete with, and your university's name in aggregated university rankings.

Where it goes. Some of those providers are based outside the UK, mainly in the US and the EU, so your data is transferred there when they process it. Where a country has no UK adequacy decision, the transfer runs on the UK approved standard contractual clauses in our contract with that provider. Ask us and we will tell you which provider handles what.

We do not use anything you send to the AI features to train AI models, and we reach those providers through their APIs, whose terms say they do not train on what is sent through them either.

We use browser local storage to keep you signed in and remember preferences. These are strictly necessary for the site to function. We do not use third party advertising cookies or cross site trackers, which is why there is no cookie banner.

Data is held in Supabase with row level security, so a signed in account can only read its own rows. Documents live in private storage buckets reached through short lived signed links, traffic is encrypted in transit, and access to the production database is limited to the people who run the site. No system is perfect, so if a breach ever puts your data at risk we will report it to the ICO within 72 hours of finding out, and tell you directly if it is likely to be a high risk to you.

For as long as you have an account, so your scores, documents and tracking history stay available to you. Delete your account, or email us asking us to, and we delete the personal data associated with it. Two things outlast that: aggregated statistics that identify nobody (like total games played), and the sales records tax law makes us keep for six years.

Under UK GDPR you can ask us for a copy of your data, ask us to correct it, delete it, restrict or object to how we use it, or export it in a portable format. Email simplytk.business@gmail.com and we will respond within a month. Some data you can delete yourself without waiting on us: the training log has a delete-everything button on its own page, and the strength board has a withdraw button next to your entry. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk.

simplytk is designed for students aged 16 and over preparing for university and early careers. We do not knowingly collect data from anyone under 16.

If this policy changes in a way that matters, we will update this page and the date at the top. Significant changes will be flagged on the site.