Privacy

Privacy Policy

Last updated: 6 September 2026

1. Who we are

R0 Pass ("we", "us", "the app") is an independent revision app for the CII Diploma in Regulated Financial Planning (units R01–R06). This policy explains what happens to your information when you use the app, in line with the UK GDPR and the Data Protection Act 2018.

For anything you send us (see the AI feature below) and for handling your requests, the data controller is the publisher of R0 Pass. You can reach us at support@r0pass.com.

2. Our approach: on-device by design

R0 Pass is built to work without collecting your personal data. Everything you do in the app — the questions you answer, your scores and history, your mistake bank and bookmarks, your settings, your exam date, and any reminders — is stored only on your device, using your phone's standard local storage. None of it is sent to us, and we have no account, profile or copy of it on any server.

Because we don't collect or have access to this information, we can't see your progress, and we can't identify you from using the app.

3. What is stored on your device

4. Backups you create yourself

The app lets you export a backup file of your on-device data and restore it later. This is entirely under your control: the backup is a plain file you save or share using your phone's own share sheet (for example to Files, iCloud Drive or another app you choose), and you re-import it with the document picker. We never receive this file. Where it goes after you export it is governed by whatever service you chose to save it to.

5. The optional AI helper ("Explain this")

Some questions offer an AI explanation and, where enabled, an opt-in follow-up thread. This is the only feature that sends anything off your device, and it only happens when you trigger it. Many explanations are pre-written and shown fully offline; those involve no data leaving your phone.

What is sent, and to whom

When you ask the live AI helper a follow-up, the app sends the following to our own proxy service (a Cloudflare Worker we operate), which forwards it to OpenAI to generate the answer:

• the exam question, its answer options, which option is correct, and our own pre-written explanation for it;
• which option you chose (or that you hadn't answered);
• your short typed follow-up question (limited to 300 characters);
• the anonymous random device ID described above, and your device's IP address as seen by the network — used only to enforce the fair-use limit and to protect the service from abuse.

We deliberately do not send your name, email, contact details, location, or your history and scores. The request is sent over an encrypted (HTTPS) connection.

What our proxy does

Our proxy holds the API key (your app never sees it), checks a fair-use daily limit per device and per IP address, and keeps a short cache of answers so that identical questions don't need to be regenerated. Cached answers are keyed to the question content and expire automatically after 30 days. The proxy does not build any profile of you and does not store your device ID or IP beyond the rolling daily/monthly counters needed for rate-limiting, which reset on their own.

OpenAI as our processor

OpenAI processes this text on our behalf to produce the explanation. Under OpenAI's API terms, data sent through the API is not used to train their models, and API inputs and outputs are retained by OpenAI for a limited period (currently up to 30 days) for abuse and misuse monitoring, then deleted, unless a shorter or zero-retention arrangement applies. OpenAI acts as a data processor/sub-processor for this feature. See OpenAI's data usage policy: openai.com/policies/api-data-usage-policies.

Lawful basis

Our lawful basis for this processing is your consent (UK GDPR Article 6(1)(a)): the feature is optional and only runs when you choose to use it. You can withdraw consent at any time simply by not using the AI helper; the live follow-up thread is off by default and must be turned on. The rest of the app keeps working with its offline, pre-written explanations.

The AI answer is generated text and may be wrong. It is study help, not financial, tax or investment advice.

6. Payments

If you buy a unit or the bundle, the purchase is handled entirely by Apple's App Store using Apple's in-app purchase system. We never see or receive your card or payment details. The app only receives confirmation from Apple that a purchase completed, and records the unlock locally on your device. Apple's handling of your payment is covered by Apple's Privacy Policy.

7. What we don't do

• No user accounts, logins or profiles.
• No analytics, advertising or third-party tracking SDKs.
• No tracking in Apple's sense: we do not link your activity across other companies' apps or websites, and we do not share data with data brokers.
• No selling of personal data. Ever.

8. International transfers

The only data that leaves your device is what the optional AI helper sends. Our proxy runs on Cloudflare's global network, and OpenAI may process the request outside the UK (for example in the United States). Where that happens, the transfer relies on the safeguards in our providers' terms (such as standard contractual clauses / an International Data Transfer Addendum). If you don't use the AI helper, no data is transferred.

9. Retention

• On-device data: stays until you delete it — clear it in Settings, or delete the app. We hold no copy.
• AI cache: answer text auto-expires after 30 days on our proxy and is keyed to question content, not to you.
• AI rate-limit counters: per-day and per-month counters that reset automatically; not a history of your questions.
• OpenAI: up to 30 days for abuse monitoring, per their API terms, then deleted.

10. Your rights

Under UK GDPR you have the right to be informed, and to access, rectify, erase, restrict or object to processing of your personal data, and to data portability. Because we hold no personal data about you on any server, most of these are exercised directly on your device: you can view, correct and delete everything from within the app, and export it yourself with the backup feature.

For the AI feature — where consent is the basis — you can withdraw consent at any time by not using it. If you believe we hold personal data about you and want to exercise a right, contact us at support@r0pass.com and we'll respond within one month.

You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, helpline 0303 123 1113.

11. Children

R0 Pass is a professional revision tool aimed at adults studying for the CII financial planning exams. It is not directed at children and we do not knowingly collect data from children. We follow the principles of the ICO's Age Appropriate Design Code.

12. Changes to this policy

If we change how the app handles data, we'll update this page and the "last updated" date above, and — for material changes — flag it in the app.