Mobile App Privacy Policy

Last updated: 3 November 2026

This policy applies to the Apple-platform apps for iPhone, iPad and, where available, Mac: JS Insights Study, Sustainable Prep, BritPath, HanziQuest, HanziLens and JS Insights Life UK Prep. It also applies to Android phone and tablet editions of JS Insights for CFA® Level I (2027), JS Insights Sustainable Prep, Life in the UK Test: JS Prep (called Life in the UK Prep below), HanziQuest and HanziLens, published by JS INSIGHTS LTD. A feature described below applies only when present and enabled in your installed version; this policy does not announce an app release or service availability.

It also applies to the Windows apps JS Insights CFA Level I Prep and JS Insights CFA ESG Prep (shown in the app as JS Insights Sustainable Prep), distributed through the Microsoft Store. Their data practices are described in Windows apps (Microsoft Store). The Windows version of the Life in the UK Test app is covered by the Life UK Test Prep app privacy policy.

It also applies to the Website Editions of JS Insights for CFA® Level I, Sustainable Prep, HanziLens and HanziQuest downloaded from jsinsights.co.uk. Where a Website Edition works differently from the store apps, that section takes precedence over the general statements in this policy: for example, the Windows Website Editions show labelled JS Insights promotions and do not contact the course service or the Microsoft Store. The Website Edition of Life in the UK Test: JS Prep is covered by the Life UK Test Prep app privacy policy.

JS Ink Note: notebooks, handwriting, recordings and optional AI features are covered by the separate JS Ink Note Privacy Statement, including its Apple, Android and Windows editions.

Who is responsible for your data

JS INSIGHTS LTD is responsible for personal data processed through services it operates, including support, purchase verification and course-download access. Device-only learning records are not received by JS Insights. Apple, Google, Microsoft and service providers may have separate responsibilities under their own notices. We are registered in England & Wales (company number 16256838), with registered office at 26 Elm Grove, Birkenhead, United Kingdom, CH42 0LA. For privacy questions, email contact@jsinsights.co.uk.

JS Insights for CFA® Level II — Apple devices

This section covers JS Insights for CFA® Level II on iPhone, iPad and Mac (bundle identifier uk.co.jsinsights.leveliistudy). It describes the Apple release being prepared and does not announce App Store availability. No JS Insights account is required. Lessons, slides, 1,544 recorded explanations and financial calculators are included in the app; no course-download account or JS Insights course service is used.

Study progress, attempts, bookmarks, typed notes, handwriting and annotations are stored on your device. When enabled and signed in, supported notes, annotations, question and lesson progress and bookmarks also sync through your Apple Account's private iCloud database, in a separate Level II container. JS Insights cannot read that database. Your study plan, calendar log, answer history, reading position, reminders and mock exam in progress stay on the device. Turn sync off or remove the iCloud copy in Notes & iCloud; local notes remain. Recently Deleted retains deleted notes for 30 days.

The optional one-time Complete Level II 2027 Practice purchase is processed and verified by Apple StoreKit. It unlocks practice and removes advertising across the Apple devices on which you restore the purchase with the same Apple Account. JS Insights receives no payment-card details; purchase status is not stored in the app's iCloud database.

The free iPhone and iPad version uses Google AdMob banners on Home, Course and Practice landing pages and course section lists. Ads do not interrupt recorded lessons, annotation or question attempts. Google and its advertising partners may process approximate location, device identifiers, ad interactions, diagnostics and related advertising data. Google UMP presents consent choices where required before requesting ads; Ad privacy choices is available when required. Apple's tracking permission is requested separately before tracking-enabled advertising. If permission is not granted, the app requests non-personalized ads. You can change Apple tracking permission in Settings. Your notes and study answers are not sent to Google for advertising.

The Mac app includes no Google advertising SDK and sends no Google ad requests. Its free purchase placement promotes its own practice upgrade. The paid experience removes advertising on every Apple platform. See Google's privacy policy and contact@jsinsights.co.uk for privacy enquiries. Other platform editions have separate release and data practices.

The short version

• No JS Insights account is needed for local study. The current Android release of CFA Level I keeps notes on the device and does not offer cloud sync, Google sign-in or a sync account.
• Learning records, university searches and saved items, handwriting input, favourites and settings are processed or stored locally, except for optional sync and device backups described below. JS Insights does not receive records that remain only on your device.
• On Apple devices, Sustainable Prep offers private iCloud sync that JS Insights cannot read. Android Sustainable Prep has no account, cloud sync or analytics; like Android CFA Level I, it shows Google AdMob ads unless you buy its one-time practice purchase. Android backup is separate.
• BritPath sends a postcode or route destination to the relevant service provider only when you choose to run the corresponding lookup, search or route action.
• Advertising-enabled versions use Google AdMob and Google's User Messaging Platform. Google and its advertising partners may process limited device, advertising, interaction and diagnostic data. On Android, CFA Level I, Sustainable Prep and Life in the UK Prep may also let Google use the Android advertising ID and Android's Topics API where your settings and choices allow; HanziLens and HanziQuest do not.
• To delete your data from an Android app, see Requesting deletion of your data (Android).
• Eligible in-app purchases are processed by Apple on Apple devices or Google Play on Android. JS Insights does not receive or store your payment-card details.
• The apps do not request access to your precise location, contacts, photos, camera or microphone.
• Apple tracking permission depends on the installed app and version. The Life UK Prep notice below explains when that app asks for permission; Android and Windows do not use Apple's tracking permission.
• We do not sell your local learning data or use it to build advertising profiles.
• The Windows apps show no advertising and contain no analytics SDK. Purchases there are processed by Microsoft. To download course files, a Windows app contacts the JS Insights course service, which checks with Microsoft that the app came from the Microsoft Store and keeps no learner profile.

Data stored on your device

The following information is stored on your device. Optional sync and device backups can copy specified records off the device as described below:

• HanziQuest: learning progress, practice results, review and mistake records, search history, app settings, a local cache of the advertising-removal entitlement and, on Apple devices only, a selected age range and counters used to limit how often ads may appear.
• HanziLens: recent searches, bookmarks, practice and review records, writing preferences, language settings, a local cache of the advertising-removal entitlement and, on Apple devices only, counters used to limit how often ads may appear. Handwriting input is matched on the device and is not uploaded by JS Insights.
• JS Insights Life UK Prep / Android Life in the UK Prep: reading progress, practice and mock-test answers and scores, wrong-answer records, favourites, study plan and optional target exam date (Apple devices only), selected language, display settings, and typed and handwritten notes where provided.
• JS Insights Study / Android CFA Level I: course-section reading progress, practice and mock-exam answers and results, mistake and saved-question records, study-plan activity, bookmarks, typed notes, and handwritten drawing data.
• Sustainable Prep: lesson progress, practice and mock-exam answers and results, mistake and saved-question records, study-plan activity, typed notes, handwritten pages, slide annotations, optional exam date, reminders and display settings. On Apple devices only, the limited items listed in the next section can also be copied to your private iCloud database when you turn sync on.
• BritPath: saved courses and programmes, university and course comparison selections, planning tasks, selected language, last-opened section, onboarding state, exchange-rate, scholarship and contingency settings.

You can remove local records using reset, clear or delete controls provided in an app. Deleting an app removes its local data from the device, subject to any device backup managed by Apple, Google or your device provider.

Optional private iCloud sync in Sustainable Prep on Apple devices

Sustainable Prep keeps data on the device by default. If you turn on Sync notes with iCloud, the app uses Apple's CloudKit service and your private iCloud database to keep the following items consistent across your Apple devices:

• typed notes attached to slides, sections and lessons;
• freehand pages and writing placed on slides;
• question progress and bookmarks; and
• lesson progress.

Your study plan, calendar and reminders, detailed answer history, last page read and any mock exam in progress are not included in this sync. The synced records are associated with your Apple Account and are processed by Apple under Apple's Privacy Policy. JS Insights has no server-side access to your private iCloud database and does not receive its contents.

You can turn sync off at any time. The app also provides a control to remove its synced copy from iCloud while keeping the notes stored on the current device. Apple may retain deleted material for a limited period under its own service and backup rules.

No cloud sync in the current Android CFA Level I release

The current Android release of CFA Level I does not offer cloud sync. It has no Google sign-in, Firebase Authentication or Cloud Firestore, and does not create a JS Insights or sync account. Typed notes, handwriting, slide annotations, progress and bookmarks stay on the device, subject to Android backup as described below, and are not sent to JS Insights. If a later release adds optional sync, we will update this policy before it becomes available and describe what is synced and how to delete it.

The CFA Level I deletion page remains available and explains how to delete data held on the device or ask us to delete any data JS Insights holds. See also Requesting deletion of your data (Android).

Android backup and recordings

Subject to your Android and Google backup settings, CFA Level I backs up its learner database, Sustainable Prep backs up its learner files, Life in the UK Prep backs up learner records including typed notes and handwriting, and HanziLens and HanziQuest back up their learning records and settings. Backup is managed by Android and your backup provider, not a JS Insights sync account. Course files, downloaded recordings and purchase confirmations are excluded from these apps' learner backups. Restoring a backup can restore previously saved learning data; manage backup copies through your device or provider settings.

Life in the UK Prep includes English recordings through Play and offers separately downloaded purchased language packs. Its optional system text-to-speech uses the installed Android speech engine, whose processing depends on that engine and its settings. No microphone recording is required.

Course audio downloads in Android CFA Level I and Sustainable Prep

Android CFA Level I and Sustainable Prep do not bundle their recorded explanations. You download them inside the app from the JS Insights Android audio service, which runs on Cloudflare, and they then play locally without a connection. All course audio is free; downloading it does not depend on an in-app purchase or any account, and there is no text-to-speech fallback.

Before a download starts, the app asks the service for a one-time challenge, which is valid for 2 minutes, and asks Google Play for a Play Integrity token bound to that challenge. The service sends the token to Google to confirm that the request comes from a genuine copy of the app installed through Google Play, then issues a download session that is valid for 5 minutes. The Integrity token and Google's result are used only for that check; the service does not store them and does not use them to check ownership of a paid product. Downloads use coded file names; the service does not receive your notes, answers, study progress or any account details.

To prevent abuse, the service counts requests. The counters are keyed by a keyed hash (HMAC) of your IP address, or of the first half (/64) of an IPv6 address, never the address itself, and by a keyed hash of each session's random identifier:

• per-minute request and download-volume counters are deleted within about 20 minutes of their last use;
• a record that a challenge has been used is deleted within about 10 minutes of its use;
• a daily count of integrity checks for each hashed IP address is kept until the next midnight (UTC) and then deleted; and
• an app-wide daily total, which contains no personal data, is reset at midnight (UTC).

Cloudflare's per-request invocation logs are switched off. The service records fixed diagnostic labels for failed Google requests or integrity checks, a label identifying an official Google test response, and warnings when an app's daily total reaches 50% or 90% of capacity. These labels and warnings contain no IP address, token, account details or recording identifier; they may include a response status code or a broad failure category. They are kept in Cloudflare Workers Logs for up to 7 days, depending on the Cloudflare plan. As the network provider, Cloudflare processes connection data such as IP addresses to deliver and protect the service under its own terms. For this processing we rely on legitimate interests in delivering the free course audio and protecting it from automated abuse.

In-app purchases

JS Insights apps may offer non-consumable purchases through Apple's StoreKit. Apple processes payment, authentication, purchase history, restoration and refund requests under its own terms. The apps process Apple-verified product, transaction and entitlement status so that they can complete purchases, restore eligible purchases and unlock the purchased feature. JS Insights does not receive or store your payment-card details.

On Apple devices, HanziLens and HanziQuest each offer an optional Remove Ads Forever non-consumable purchase. The entitlement is cached locally on the device. When it is active, the app stops requesting and displaying Google AdMob advertising. Advertising data processed before activation remains subject to this policy and Google's retention policies. Restoring the purchase uses the Apple Account associated with the original eligible purchase.

On Android, HanziLens and HanziQuest offer a separate permanent Remove Ads purchase through Google Play Billing. Google processes payment, authentication, purchase history and refunds; the app receives purchase status and a purchase token to verify and restore the entitlement for the Google Account used to buy it. JS Insights does not receive your payment-card details. An Apple purchase does not transfer to the Android app, or vice versa.

Android CFA Level I, Sustainable Prep and Life in the UK Prep also use Google Play Billing for one-time purchases and restoration. The app processes product identifiers, purchase tokens and purchase/entitlement status. Payment is processed by Google Play, which also handles refunds. Apple and Google Play purchases are separate.

CFA Level I and Sustainable Prep purchase verification: Android CFA Level I (uk.co.jsinsights.levelistudy) offers Complete 2027 Practice and Android Sustainable Prep (uk.co.jsinsights.sustainableinvesting) offers Complete 2026 Practice, one-time purchases that unlock most of the question bank. When you buy or restore one of them, the app sends the app package name, the product ID and the Google Play purchase token to JS Insights' purchase verification service, which runs on Cloudflare (android-verify-cfa.jsinsights.co.uk for CFA Level I and android-verify-esg.jsinsights.co.uk for Sustainable Prep). The service asks the Google Play Developer API to confirm the purchase state, acknowledges the purchase, and returns a signed result that the app stores on your device in app-private storage excluded from backup. No account, learning data or payment-card details are sent to JS Insights, and verification does not require any account.

The verification service processes purchase tokens only in memory while handling the request; it does not write them to storage or application logs, and we do not keep a record of purchase tokens. As the network provider, Cloudflare processes ordinary network data such as your IP address and the time of the request, applies rate limiting to protect the service, and may keep platform logs under Cloudflare's own policies.

Reviewer access codes: the same two apps let you enter an optional access code issued by JS Insights, for example for app review. The app sends the code and the app package name to the same verification service, which returns a signed, time-limited access grant that the app stores on your device. In both apps, an active grant also turns off advertising. Most users will never use this feature.

Life in the UK Prep: to authorise a purchased audio download, the app sends the product/pack identifier, Google Play purchase token and, when configured, a Play Integrity token to JS Insights' separate Android audio service on Cloudflare. The service checks purchase and refund status with Google Play and issues a time-limited download authorisation. It processes request IP addresses and token-derived identifiers for abuse limits, and purchase-revocation information to prevent refunded purchases from authorising downloads. Hosting providers also process technical request information. These checks do not upload your notes, answers or study progress. Downloaded purchased audio is stored in private app storage and is excluded from learner backups. Retention for this service is set out in the Life UK Test Prep app privacy policy.

BritPath postcode, map and route requests

BritPath does not require an account and does not request permission to read your device's precise location. Its postcode and journey tools make a network request only after you choose the relevant action:

• when you submit a full Great Britain postcode for a postcode lookup, the app sends that postcode to postcodes.io to obtain location coordinates; and
• when you choose a campus, address or other destination and request a map search or route, the app passes the selected place or route endpoints to Apple MapKit.

These requests go from your device to the relevant provider. The provider may receive the submitted value, your IP address and technical request information under its own terms. JS Insights does not use the postcode or route request to create a BritPath account or advertising profile. See postcodes.io legal information and Apple's Privacy Policy.

Advertising and data processed by Google

Advertising-enabled versions use Google Mobile Ads (AdMob) to fund free access to the apps. Before requesting ads, the apps use Google's User Messaging Platform where required to obtain or manage privacy choices.

Depending on the app version, your region, device settings and consent choices, Google Mobile Ads SDK disclosures state that Google and its advertising partners may process:

• coarse location, including location inferred from an IP address or other signals;
• device and account identifiers, including Android app set ID and, where available under platform rules and user choices, an advertising identifier;
• advertising data and product interaction, such as ads shown and interactions with ads or the app;
• consent and privacy-choice signals;
• crash data, performance data and other diagnostic data.

This information may be used to deliver and measure ads, limit repeated ads, prevent fraud and abuse, comply with legal requirements, and improve advertising services. Google acts under its own terms and privacy policy. See Google's Privacy Policy and How Google uses information from sites or apps that use its services.

For the advertising-enabled Apple JS Insights Life UK Prep build, the included Google Mobile Ads privacy manifest declares coarse location, device ID, advertising data and product interaction as linked data; crash, performance and other diagnostic data as not linked; and Device ID as used for tracking. Its declared purposes include third-party advertising, developer advertising or marketing, and analytics. The included User Messaging Platform manifest separately declares coarse location, performance data and product interaction as not linked and used for app functionality. See Google's iOS App Store data-disclosure guidance.

Android advertising ID and Topics API. The advertising-enabled Android apps CFA Level I, Sustainable Prep and Life in the UK Prep include Google Mobile Ads, which declares Android's advertising ID permission (AD_ID) and the Android Privacy Sandbox permissions for the advertising ID, attribution reporting and the Topics API (ACCESS_ADSERVICES_AD_ID, ACCESS_ADSERVICES_ATTRIBUTION, ACCESS_ADSERVICES_TOPICS). Where your device, region, consent choices and Google's settings allow, Google may read the advertising ID and use these Android APIs to select, limit and measure ads. The Topics API lets Android share a small number of broad interest topics, inferred on the device from app use, without sharing the apps you used; attribution reporting measures whether an ad led to an action. You can reset or delete the advertising ID and manage ad topics and other ad privacy settings in Android's settings (the exact menu names vary by device). JS Insights does not itself read the advertising ID or your topics, and does not combine them with your learning records.

The Android versions of HanziLens and HanziQuest do not request Android's advertising ID or these Privacy Sandbox permissions, but in those two apps Google Mobile Ads and User Messaging Platform may still process an IP address to infer approximate location, app set ID and other applicable device or account identifiers, app or ad interactions, consent choices and diagnostic information. See Google's Android data-disclosure guidance for the SDK's current disclosures.

JS Insights does not send your character searches, handwriting strokes, answers, scores, review lists or study plan to advertising services. We use service providers whose published terms and contractual commitments require protection of personal data consistent with applicable law and this policy.

How advertising differs by app

• HanziQuest and HanziLens on Android: both apps are available to all ages and show only non-personalised, G-rated banners in selected content areas. Every ad request is marked for child-directed and under-age-of-consent treatment. They do not show app-open or interstitial ads and do not use Android's advertising ID. Once the app has confirmed an active Remove Ads purchase with Google Play, it stops advertising requests and display; on a new installation or device, the consent form or a banner may appear briefly before that confirmation arrives.
• HanziQuest on Apple devices, version 1.1 and later: users under 13 see no ads. Users aged 13 to 17 may see limited banner ads but no interstitial ads. Adults may see banners and a low-frequency interstitial after meaningful practice. HanziQuest requests non-personalised ad treatment, disables Google's publisher first-party identifier, and does not request access to IDFA. A valid Remove Ads Forever entitlement stops advertising requests and display.
• HanziLens on Apple devices: advertising-enabled versions may show banners on selected reference screens and an infrequent app-open ad after repeated use. HanziLens does not request precise location or Apple's cross-app tracking permission. A valid Remove Ads Forever entitlement stops advertising requests and display.
• JS Insights Life UK Prep on Apple devices, 1.1 and later: advertising-enabled versions may show banners at selected section boundaries and summary screens. Ads are not placed between individual practice questions.
• JS Insights Study on Apple devices: the free experience may show a banner in selected learning-hub areas. Ads are not placed inside course-slide pages or between individual practice questions. Buying Remove Ads or the Complete Course disables advertising in the app.
• Sustainable Prep on Apple devices: the free iPhone and iPad experience may show a banner in selected hub areas. Ads are not placed on course slides or between individual practice questions. The Mac version shows a first-party message about the complete practice purchase instead of requesting Google advertising. Buying Complete 2026 Practice disables advertising and that placement.
• BritPath: the university directory may show one inline adaptive banner immediately after the fourth university result. BritPath requests non-personalised ad treatment, disables Google's publisher first-party identifier, applies Google's Teen age treatment to every ad request, limits creative content to the Teen rating, and does not request Apple's App Tracking Transparency permission in this release.

Advertising never determines BritPath university rankings, evidence positions, search order, distance results, cost calculations or comparison results. Advertisers cannot pay for a university to receive a higher rank or stronger evidence label.

Android CFA Level I: advertising-enabled builds may show AdMob banners on Home and Practice and occasional interstitials after a completed practice session. Ads are not shown during reading, audio, note-taking, drawing or mock exams. Complete 2027 Practice, or an active access grant described under purchase verification, disables advertising. UMP provides consent and privacy choices where required, including in the UK, the EEA and Switzerland, and the app shows More > Ad privacy choices where Google requires it. The app asks for consent and starts Google Mobile Ads only after its welcome screen and after Google Play confirms that your Google account does not own Complete 2027 Practice; if you own it, while a purchase is still being confirmed, or if Google Play is unavailable, it does not contact UMP or AdMob. Advertising-enabled builds may process the Android advertising identifier and Topics API signals as described above.

Android Sustainable Prep: advertising-enabled builds may show AdMob banners on Home and Practice and occasional interstitials after a completed practice session. Ads are not shown during reading, audio, note-taking, drawing or mock exams, and ad content is limited to Google's G rating. Complete 2026 Practice, or an active access grant described under purchase verification, disables advertising. UMP provides consent and privacy choices where required, including in the UK, the EEA and Switzerland, and the app shows More > Ad privacy choices where Google requires it. The app asks for consent and starts Google Mobile Ads only after its welcome screen and after Google Play confirms that your Google account does not own Complete 2026 Practice; if you own it, while a purchase is still being confirmed, or if Google Play is unavailable, it does not contact UMP or AdMob. Advertising-enabled builds may process the Android advertising identifier and Topics API signals as described above, and Google Mobile Ads may process app set ID, IP-derived approximate location, device information, ad interactions and diagnostics under Google's policies. The Apple advertising arrangements above do not apply to this Android app.

Android Life in the UK Prep: AdMob banners and UMP are used only in builds with advertising configured. Without that configuration the release app does not initialise the advertising SDK or request ads. Configured builds may process the Android advertising identifier, Topics API signals, approximate location, ad interactions and diagnostics as described above. Ads do not appear during practice questions or mock tests. An active Remove ads purchase stops ad requests; privacy choices are under My > Ad privacy choices where required.

Consent and privacy choices

Where Google indicates that a privacy-options entry point is required, the app shows an Ad Privacy Choices or similar control in its Settings, Me, More or Legal area. You may use that control to review or change available choices. You may also change relevant privacy settings on your Apple or Android device. Withdrawing consent does not affect processing that was lawful before withdrawal.

Children and age information

HanziQuest on Apple devices uses a neutral age-range screen so that advertising can be restricted appropriately. It stores only a selected range, not a birth date, and does not show ads to users who select under 13. HanziLens on Apple devices is a general-audience reference tool; JS Insights Life UK Prep is intended for people preparing for the Life in the UK Test, JS Insights Study and Sustainable Prep are intended for finance exam candidates and adult learners, and BritPath is intended for prospective higher-education applicants and their supporters. These Apple-platform apps are not specifically directed at children under 13. A parent or guardian should supervise use by a child where required.

The Android versions of HanziQuest and HanziLens have no age gate. Because children may use them, all Android ad requests receive child-directed treatment and the apps show only G-rated, non-personalised banners. The Apple-platform age selection and advertising behaviour described above do not apply to Android.

Windows apps (Microsoft Store)

This section applies to JS Insights CFA Level I Prep and JS Insights CFA ESG Prep for Windows. Neither app requires an account, sign-up or login, and neither shows advertising or contains an analytics, advertising or crash-reporting SDK.

Data stored on your PC

Depending on the app, the following are stored in the app's private data folder in your Windows user account and are not sent to JS Insights:

• reading and lesson progress, and the page you last read;
• practice and mock-exam answers and results, bookmarks, saved questions and your mistake queue;
• typed notes, handwriting, freehand pages and marks drawn on slides, and notes in Recently deleted for 30 days;
• your study plan, daily targets, study activity and optional exam date;
• where you left each recording;
• appearance, text size and other preferences, and the window's size and position.

The Windows apps do not sync with the Apple apps or with any cloud service. If you export notes or save a backup file, the file is saved only where you choose. You can delete your learning data in the app's settings. Uninstalling the app removes its data folder from the PC. If you turn on a daily study reminder, it is scheduled on your PC through Windows notifications.

Course files and the JS Insights course service

The course text, slides and recorded explanations are not included in the Windows installer. They are downloaded from the JS Insights course service, which runs on Cloudflare:

• the course text, the first time you open the app;
• slides and recordings, when you open them; and
• whole modules or subjects, when you choose to download them for offline study.

To start a download session, the app asks the Microsoft Store for a temporary customer key (a "Microsoft Store ID key"). The key is issued only for JS Insights and does not contain your name or email address. The app sends it to the course service. The service asks Microsoft whether that customer obtained the app from the Microsoft Store and, if Microsoft confirms it, issues a session that lasts a few minutes. For this, the course service processes:

• your device's IP address and the time of each request;
• the Microsoft Store ID key;
• the app's package name; and
• which course files are requested, identified by coded file names.

We use this only to deliver the course and to protect it from unauthorised copying. The course service does not store the Store ID key, does not link any of this to your name or email address and keeps no learner profile. Your study data, notes and answers are never sent. Cloudflare processes connection data such as IP addresses to run and secure the service and may keep short-lived security logs under its own terms.

Downloaded course files are stored on your PC encrypted, with a key protected by Windows for your Windows user account, in a folder that is not roamed or backed up. They then work offline. You can remove them in the app's offline downloads settings; they are also removed when you uninstall the app.

Purchases

The optional in-app purchases (Complete 2027 Practice in JS Insights CFA Level I Prep and Complete 2026 Practice in JS Insights CFA ESG Prep) are processed by the Microsoft Store. The app asks the Microsoft Store whether the Microsoft account signed in to the Store owns the purchase, and keeps that answer on your PC so that practice also works offline. JS Insights does not receive your name, email address or payment details. Purchases made in the App Store or on Google Play are separate and do not unlock anything on Windows. Microsoft's use of data for Store transactions is covered by the Microsoft Privacy Statement.

Diagnostics

If something goes wrong, the app may write a short technical note to a log file in its local data folder. The log contains no notes or study content and is never sent to JS Insights. Windows and the Microsoft Store may collect diagnostic data under your Windows settings and Microsoft's own privacy statement.

Website Editions downloaded from jsinsights.co.uk

This section applies to the Website Editions of JS Insights for CFA® Level I and Sustainable Prep (for Mac, Windows and Android) and of HanziLens and HanziQuest (for Android), which you download from our website rather than from an app store. The Website Edition of Life in the UK Test: JS Prep is described in the Life UK Test Prep app privacy policy. Each Website Edition is free, contains adverts and has no in-app purchases. It is a separate app with its own data: on Android and Mac its identifier ends in .website (for example uk.co.jsinsights.levelistudy.website); on Windows it is not installed through the Microsoft Store, runs from the folder you extract and keeps its data in its own folder. On Android the apps appear as CFA® Prep Website, Sustainable Prep Website, HanziLens Website and HanziQuest Website. Where this section says nothing different, the rest of this policy for the same app on the same platform applies.

• Data on your device. Your learning records, and in CFA Level I and Sustainable Prep your notes and handwriting, stay in the Website Edition’s own storage on your device. It does not read a store edition’s data, and a store edition does not read its data. There is no account and no cloud sync. On Windows you can save a backup file and restore it on this or another PC. On Mac and Android, CFA Level I and Sustainable Prep can export notes as a PDF, which cannot be imported back into an app. HanziLens and HanziQuest have no export.
• Android. Android backup may copy these records to your Google Account backup, as described in Android backup and recordings. To remove the data from your device, uninstall the Website Edition or clear its storage under Settings > Apps (the wording can vary by device); backup copies are managed in your device or Google Account backup settings.
• Mac. The CFA Level I and Sustainable Prep Website Editions keep their data in their own sandbox containers, ~/Library/Containers/uk.co.jsinsights.levelistudy.website and ~/Library/Containers/uk.co.jsinsights.sustainableinvesting.website. Moving the app to the Bin does not remove its container; delete that folder as well if you want your data removed.
• Windows. The Windows Website Editions of CFA Level I (JSInsightsLevelIWebsite.exe) and Sustainable Prep (SustainablePrepWebsite.exe) include the course text, slides and recordings in the download. They do not contact the JS Insights course service or the Microsoft Store, so the course-service, Microsoft Store ID key and purchase parts of Windows apps (Microsoft Store) do not apply to them, and unlike the Microsoft Store apps they show the labelled promotions described below. Your data is kept in %LOCALAPPDATA%\JS Insights\Level I Website or %LOCALAPPDATA%\JS Insights\Sustainable Prep Website. There is no uninstaller, and deleting the extracted app folder does not remove this data folder: use the app’s option to delete your learning data; to remove everything, including backup copies and the log, delete that folder as well.
• No purchases. The Website Editions make no purchases and contact no purchase or verification service. They make no purchase, restore or licence requests to the App Store, Google Play or the Microsoft Store, send nothing to our purchase-verification services, do not accept reviewer access codes and, on Android, do not use Google Play Integrity. The Android editions do not include the Google Play Billing library; on Mac, the App Store purchase code shared with the store edition is present but never used. Store purchases do not apply to them.
• Adverts on Android. The Android Website Editions show Google AdMob adverts in the same places as the Google Play editions, with their own advertising configuration, and Google may process the data described in Advertising and data processed by Google and Android advertising ID and Topics API. There is nothing to buy, so they do not check Google Play first, and no purchase or access code turns adverts off. Google’s User Messaging Platform asks for your consent where it is required (for example in the UK, the EEA and Switzerland), and adverts start as soon as it allows, which elsewhere can be straight away; CFA Level I and Sustainable Prep do this after their welcome screen. When no Google advert is shown, CFA Level I and Sustainable Prep show a labelled JS Insights promotion instead: it is part of the app, makes no network request and uses no identifier, and selecting it opens our website in your browser. HanziLens and HanziQuest receive only child-directed, G-rated, non-personalised adverts and do not use the Android advertising ID.
• Promotions on Mac and Windows. The Mac and Windows Website Editions contain no advertising network. A space labelled “Advertisement” shows JS Insights’ own courses and apps from content bundled with the app; showing it involves no identifier and no network request. Selecting a promotion opens our website in your browser.
• No analytics. The Website Editions contain no analytics or crash-reporting SDK. The Android CFA Level I Website Edition still includes Google Firebase libraries from the store app’s optional sync code, but Firebase is not configured or started in this edition, so it makes no Firebase requests.
• Downloading the app. The app files (ZIP files for Mac and Windows, and an APK for Android) are served by GitHub Releases (github.com). Like any download, the host receives your IP address, browser and device details, the time and the file requested, and keeps logs under its own terms to run and secure its service.
• Recordings on Android. CFA Level I and Sustainable Prep download their free recordings, one file per subject or module, from GitHub Releases (github.com). Each request names only the file and, when a download is resumed, a byte range. The app sends no account, purchase token, Play Integrity token or device identifier, and these downloads do not use the Android audio service described in Course audio downloads. Like any download, the host receives your IP address, the time and your device’s standard user agent (Android version and device model). We use this only to deliver the files and protect them from abuse, relying on our legitimate interests; the hosting provider may keep short-lived security logs under its own terms.

Support emails and contact

If you contact us, we receive the information you choose to send, such as your email address, name, message, screenshots, attachments, and device or app details. We use it to answer you, investigate problems, correct content and keep reasonable support records. Our email and hosting providers process this information under their own terms.

Support correspondence is normally kept for no longer than 24 months after the last relevant contact, unless a longer period is reasonably needed for an unresolved issue, legal claim, fraud prevention, accounting or another legal obligation. Please do not send sensitive information unless it is necessary.

Legal bases and international processing

Where UK or European data protection law applies, we rely on consent where required for advertising, device access or privacy choices; legitimate interests for app security, fraud prevention and proportionate service improvement; steps taken at your request when responding to support; and legal obligations where applicable. The legal basis used by Google for its processing is described in Google's own notices and may depend on your region and choices. For the Windows course service, we rely on legitimate interests in delivering the course you installed and protecting it from unauthorised copying. Google, Apple, Microsoft, Cloudflare and email providers may process information outside the United Kingdom. Their published terms describe the safeguards they use for international transfers.

Retention and deletion

Local app data, including a locally cached purchase entitlement, remains until you clear it or delete the app. A valid purchase may be restored through Apple, Google Play or the Microsoft Store, as applicable. Course files downloaded by a Windows app stay encrypted on the PC until you remove them or uninstall the app; the course service keeps no learner profile. Sustainable Prep data that you choose to sync on Apple devices remains in your private iCloud account until it is removed through the app, your Apple Account controls or Apple's retention processes. Advertising and consent data is retained by Google under Google's policies and your available privacy choices. Postcode and route providers retain request data under their own policies. Support correspondence is handled as described above. To request access, correction, restriction, objection or deletion of personal data held directly by JS Insights, email contact@jsinsights.co.uk. Because JS Insights cannot access local learning records, BritPath saved items or a user's private CloudKit database, we cannot retrieve those records for you.

The current Android release of CFA Level I has no cloud sync, so it keeps no synced records; see Requesting deletion of your data (Android) for the deletion steps for Android CFA Level I and Sustainable Prep. Android CFA Level I, Sustainable Prep and Life in the UK Prep have Recently deleted notes; those notes may remain recoverable for 30 days before app cleanup. Purchase verification and audio-download services process transaction/security information for entitlement checks and abuse prevention; Google Play retains purchase records under its own policies. The Android CFA Level I and Sustainable Prep purchase verification service does not keep a record of purchase tokens or access codes; the signed result or access grant it returns stays on your device until you clear the app's data or uninstall it, as described in purchase verification. The Android CFA Level I and Sustainable Prep audio service keeps hashed per-minute counters for up to about 20 minutes and hashed daily counters until the next midnight (UTC), and its diagnostic labels and capacity warnings, which contain no personal data, for up to 7 days, as described in Course audio downloads. Life in the UK Prep's purchase and refund records are described in its app privacy policy. Contact us about data held by JS Insights, including verification-service records.

Requesting deletion of your data (Android)

This section explains how to delete your data from two Android apps published on Google Play by JS INSIGHTS LTD, and how to ask us to delete any data we hold about you:

• JS Insights for CFA® Level I (package uk.co.jsinsights.levelistudy); and
• JS Insights Sustainable Prep (package uk.co.jsinsights.sustainableinvesting).

Neither app has a user account: there is no sign-up, no JS Insights login and, in the current releases, no cloud sync. Your learning data is kept on your device, so you can delete it yourself.

How to delete your data

1. Delete learning data in the app. Open More > Delete learning data and confirm. This permanently deletes from that device your typed notes (including notes in Recently deleted), handwriting, drawings and slide annotations, unsaved handwriting drafts, progress, study plan, question history, bookmarks and any saved mock exam, and cancels study reminders. It keeps your display preferences, downloaded recordings and the saved purchase confirmation or access grant, so a purchase stays restorable. Repeat this on each device where you use the app.
2. Uninstall the app. Uninstalling removes all of the app's private data from the device, including learning data, downloaded recordings, the saved purchase confirmation or access grant, and the ad-consent choices stored by Google's consent tools in the app. Copies in an Android backup are managed in your device or Google Account backup settings, not by JS Insights.
3. Email us for any other request. Email contact@jsinsights.co.uk from the email address you use with Google Play, name the app, and say what you would like deleted. You do not need to have the app installed. We may ask for proportionate information to confirm the request is yours. Never send a password, payment-card details or a purchase token. We aim to act on a request we can verify within 30 days and will confirm the outcome by email.

What JS Insights holds, and for how long

• No accounts or learning data. JS Insights has no account for you and does not receive your notes, handwriting, answers or progress, so there is nothing of that kind for us to delete on our side.
• Purchase verification: the service processes purchase tokens and access codes only in memory while handling a request and keeps no record of them, as described in purchase verification.
• Course audio downloads: the audio service does not store Play Integrity tokens or IP addresses. It keeps only short-lived hashed security counters (per-minute counters for up to about 20 minutes and daily counters until the next midnight UTC) and diagnostic labels and capacity warnings with no personal data for up to 7 days, as described in Course audio downloads. These expire automatically.
• Support emails: if you email us, including with a deletion request, we keep the correspondence and our reply for no longer than 24 months after the last relevant contact, unless a longer period is needed for an unresolved issue or a legal obligation.

What Google holds under its own policies

• Google Play keeps your purchase and refund history and processes Play Integrity checks. Deleting app data or uninstalling does not cancel, refund or delete a Google Play purchase. Manage your Google data in your Google Account data and privacy settings.
• Google AdMob and the User Messaging Platform (for learners who have not bought the one-time practice purchase and have no active access grant) process advertising, consent and diagnostic data as described in Android advertising ID and Topics API. You can change consent in the app under More > Ad privacy choices where shown, reset or delete your advertising ID and manage ad topics in Android's settings, and review ad personalisation in My Ad Center. Google retains this data under Google's Privacy Policy and its data retention practices; JS Insights cannot delete it for you.
• Android backup copies are held by your backup provider under your device and Google Account settings.

External links, speech and bundled content

The apps may open third-party websites in your browser, including university, programme, ranking and evidence-source links in BritPath and published reference links in the study apps. Those sites apply their own privacy policies. Some apps use Apple's on-device system speech features where available; HanziLens and HanziQuest on Android use the text-to-speech engine installed on your device, which receives the text being read and, for some engines or voices, may use the internet under the engine provider's policies; on Apple devices, Sustainable Prep plays recordings bundled with the app. Bundled course slides, recordings, practice content, translations, character data and BritPath directory content do not require a JS Insights account and are not sent to JS Insights merely because you view or play them. The Windows apps download course files as described in Windows apps (Microsoft Store).

Your rights and complaints

Depending on where you live, you may have rights to access, correct, erase, restrict or object to processing of your personal data, and to withdraw consent. Contact contact@jsinsights.co.uk to exercise a right. In the UK, you may also complain to the Information Commissioner's Office at ico.org.uk.

Changes to this policy

We will update this page when an app's data practices materially change and will revise the date above. App Store privacy labels, Google Play Data safety declarations and Microsoft Store listings describe the data practices of the version made available through each store and should be read together with this policy.

Contact

JS INSIGHTS LTD
26 Elm Grove, Birkenhead, United Kingdom, CH42 0LA
contact@jsinsights.co.uk
jsinsights.co.uk/contact/