Privacy Policy

Last updated: August 2026

Mark Buddy is operated by MARKFORYOU PRIVATE LIMITED (“we”, “us”), a Singapore-incorporated company committed to protecting the privacy of parents and students who use our exam-marking service. This policy explains what we collect, how we use it, and your rights under Singapore’s Personal Data Protection Act 2012 (PDPA). Mark Buddy is designed for Singapore primary-school students (Primary 4 – 6, typically ages 10 to 12).

1. Information we collect

Parent accounts. Email address, optional display name, password (hashed at rest where supported by our auth layer), IP address at sign-in, and timestamps of activity.

Student accounts. Username chosen by the parent, optional display name, primary-school level, password, and activity logs (papers attempted, scores, last-login time). We do not request any other personal information from children.

Submitted school work. Photos of handwritten exam papers and compositions, typed compositions and quiz answers, drawings on our digital quiz canvases, and AI-generated coaching summaries (such as cross-essay “Lumi’s advice”) which may include short verbatim excerpts of the student’s own writing. These are stored to provide AI marking, progress reports, and writing coaching back to the family.

Voice recordings and audio. Two kinds: (a) short audio notes recorded when a parent flags a question for review, and (b) student voice recordings from our Oral Coach features (Reading Aloud and Stimulus-Based Conversation, in English and Chinese). Oral Coach recordings are streamed in real time to a speech-AI provider to produce transcript and examiner-style feedback, and the recording plus the transcript are stored so the family can replay the session. Oral practice is opt-in — a session begins only when the student taps “Start”.

Payment metadata. When a parent subscribes via our website we store a Stripe customer ID and subscription status. When a parent subscribes via the iOS app we store an Apple original-transaction ID and renewal expiry. We do not see or store credit-card details — those are handled by Stripe and Apple respectively.

Device and usage data. Standard server logs (URL, user agent, response time) and a session cookie used to keep parents signed in. We do not use third-party advertising or behavioural-tracking SDKs.

2. How we use it

• Provide AI-powered marking, progress reports, writing coaching, and revision tools.
• Authenticate sign-ins, recover accounts, and respond to support requests.
• Bill subscriptions, recognise renewals, and process refunds.
• Detect abuse, protect against fraud, and maintain service availability.
• Improve our marking accuracy by reviewing flagged questions.
• Improve our platform service — for example, refining our question-selection algorithm, difficulty calibration, and weakness-detection models — using aggregated and anonymised marking data. Anonymised here means no student name, username, parent identity, or free-text writing is used; only numerical fields such as question ID, attempt sequence, correctness, and topic tags are analysed in aggregate across many students. This use falls within the “Business Improvement” exception under PDPA Schedule 1 Part 5 Division 1.
• Send transactional emails (welcome, progress updates, Lumi tips, billing receipts). These are part of the service. You can disable progress emails from your account settings at any time.

We do not sell, rent, or trade personal data, and we do not use identifiable student work to train external AI models.

3. Third-party services and data location

Our application servers and primary database are hosted on Railway in their Singapore region, so the bulk of personal data — accounts, exam papers, drawings, audio notes — is stored within Singapore. A small number of carefully-chosen processors are used for specific tasks, some of which are based overseas. Each is bound by their own privacy commitments and processes only the minimum data needed:

• Railway (Singapore) — application hosting, database, and file storage for uploaded papers and audio notes.
• Cloudflare (global edge) — content delivery network and R2 object storage for static images (such as avatars and stickers). Cloudflare proxies HTTP requests in transit; it does not retain personal data from those requests.
• Various AI models (including OpenAI, Google Gemini, and Anthropic) — AI marking, explanation, and writing coaching. Excerpts of student work are sent to these models at request time to generate marks and coaching feedback. We use API tiers that do not retain prompts or completions for training, and outputs are stored only on our Railway database.
• Speech-AI providers (Microsoft Azure Speech, Google Gemini Live, and Fish Audio) — used by our Oral Coach features. Student voice audio is streamed to these providers in real time to produce a transcript and (for conversation practice) a real-time AI examiner response. We use API tiers that do not retain audio or transcripts for model training. Full recordings are stored only on our own database so the family can replay the session.
• SendGrid (United States) — sending email and receiving scanned-paper attachments.
• Stripe (United States, when web subscriptions are enabled) — payment processing.
• Apple App Store / RevenueCat (when iOS subscriptions are enabled) — payment processing for iOS.

Where a processor is based overseas (notably the AI providers, SendGrid, and Stripe), the data we send them constitutes a cross-border transfer under PDPA s.26. We rely on these processors’ published privacy commitments and standard contractual terms to ensure a comparable standard of protection to PDPA. We will update this list and notify users via the in-app dashboard and email if we materially add to or change our processors.

4. Children’s privacy

Mark Buddy is designed for parents managing primary-school students’ revision. Student accounts are created and administered by parents — children cannot self-register. Parents have full visibility of and control over their child’s account, including the ability to delete it at any time. The parent provides consent on the child’s behalf at sign-up.

We do not knowingly collect personal information directly from children outside what their parent provides. We do not allow children to communicate with anyone outside the service. If you believe a child’s data has been collected without parental consent, contact us at the address below and we will delete it.

Enhanced standard of protection. Because Mark Buddy is used by children, we apply a higher standard of data protection in line with the PDPC’s Advisory Guidelines on the PDPA for Children’s Personal Data in the Digital Environment (March 2024). In practice this means data-minimisation by default (we do not ask for a child’s real name, address, phone number, or school), no third-party advertising or behavioural-tracking SDKs, no messaging or social features that expose children to outside contacts, and age-appropriate defaults on features (e.g. Oral Coach practice is opt-in and starts only on a deliberate tap).

5. Subscriptions and IAP

Subscriptions purchased via the iOS app are billed by Apple and managed in your Apple Account. Cancellations and refund requests for iOS subscriptions are handled by Apple. Payment will be charged to your Apple Account at confirmation of purchase. Subscriptions automatically renew at the price stated in the App Store unless cancelled at least 24 hours before the end of the current period. Subscriptions purchased via the website are managed through our Stripe customer portal, accessible from the in-app subscription screen.

6. Data retention

We keep account data, exam papers, drawings, audio notes, oral practice recordings and transcripts, and coaching summaries for as long as the account is active. When a parent deletes their account, we delete all linked student accounts, exam papers, uploaded media, oral recordings, audio notes, and coaching summaries within 30 days. Billing and transaction records are retained for 5 years to meet Singapore tax-record requirements. Anonymous logs may be retained longer for security analysis (typically 90 days).

7. Your rights

Under PDPA you have the right to access the personal data we hold about you, correct it, withdraw your consent, or request deletion. You can:

• Update your name and email from the in-app settings.
• Delete your account and all linked student accounts from the in-app account-management screen.
• Request a complete copy of the personal data we hold on you (right of access) by emailing our Data Protection Officer at the address below. We will respond within 30 calendar days.
• Disable transactional progress emails from your account settings; you will still receive essential service notices (such as billing receipts).
• Withdraw your consent at any time. Note that withdrawing consent for essential data (such as account email) means we can no longer provide the service.

If you are not satisfied with how we handle a privacy request, you may lodge a complaint with the Personal Data Protection Commission of Singapore at pdpc.gov.sg.

8. Security

We use TLS in transit, encrypted backups at rest, and strict internal access controls on production data. No system is perfectly secure, so we recommend choosing a strong password and not reusing it across services.

In the event of a personal-data breach that is likely to result in significant harm or affects 500 or more individuals, we will notify the Personal Data Protection Commission within 3 calendar days of our assessment, and affected users without undue delay, as required under PDPA Part VIA.

9. AI in Mark Buddy

In line with the PDPC’s Advisory Guidelines on the Use of Personal Data in AI Recommendation and Decision Systems (March 2024), we want to be clear about where and how AI is used in our service.

• Marking (AI decision). Marks and feedback on quizzes, papers, and compositions are produced by AI models (see §3 for providers). AI marks may occasionally be wrong. Every question includes a “Flag” button that sends it to human review, and marks are corrected when a genuine error is found.
• Question selection (AI recommendation). The next question or focused-practice set is chosen by an algorithm that looks at your child’s recent accuracy and known weak topics. Parents can override this in-app by picking a specific topic, paper, or quiz.
• Coaching text (AI generation). Explanations, essay feedback, and Lumi’s advice are generated by AI based on your child’s answers. These are educational suggestions, not medical, psychological, or professional advice.
• No fully-autonomous consequential decisions.AI marks and recommendations inform parents and students; they do not by themselves change accounts, subscriptions, or any real-world outcome outside the app.

10. Changes to this policy

We may update this policy as the service evolves. Material changes will be communicated via the in-app dashboard and via email to parents. Continued use of the service after a change indicates acceptance of the updated policy.

11. Contact and Data Protection Officer

For general support email hello@markforyou.com.

For PDPA access, correction, withdrawal, or deletion requests, our Data Protection Officer is jessica@markforyou.com.

Terms of Use · Home