Privacy Policy

Last updated: November 2026

What this site is

UniScout is a personal project that helps prospective students browse UK degree course information alongside official HESA Discover Uni outcome statistics. It is not affiliated with UCAS, HESA, or any university. It's run by an individual as a personal project, who is the data controller for the personal data described below. You can reach them at privacy@uniscout.uk.

Using the site without an account

You don't need an account to use UniScout. Without one, your A-level, IB, Scottish Highers, BTEC, AP, Singapore A-level, CBSE, ISC, French Bac, Irish Leaving Cert, HKDSE, Matura or Access to HE subjects and grades, your contextual-eligibility answers and any postcode you check are sent to our server only to work out the results you asked for (matching courses, or which contextual criteria you meet), and are thrown away as soon as the answer is sent back. They are never stored on our servers. Your browser keeps a copy on your own device so you don't lose them between pages (see the Cookie Policy). If you check a postcode on the contextual offers page and then go on to the full check, the postcode is passed to it in your browser's session storage, on your own device, and removed as soon as the check has used it. It is never put in the page address, so it doesn't reach our logs or analytics. Courses you save on Discover while signed out also stay on your device only.

Text you type into the course search is sent to Cloudflare's AI service to turn it into a search query, and is not stored. Your IP address is used briefly to stop any one connection sending too many requests, and our hosting provider, Cloudflare, may keep standard access logs (e.g. IP address, requested page, timestamp) for operating and securing the service. No advertising scripts are included. Analytics is opt-in: only if you press Accept on the consent banner do we load PostHog, which records page views against a random identifier so we can see which parts of the site get used. Events also note whether you were signed in at the time (just yes or no), so we can tell visitors apart from existing users. That data is pseudonymous rather than truly anonymous: it is not linked to your name, your email or your account, but it does group your visits together, and we treat it as personal data. We do not forward your IP address to PostHog, and it never receives your answers to the contextual offer questions. Declining, or never answering, leaves analytics switched off entirely. On the same opt-in basis, we also count which sign-up prompt variant you were shown and whether you signed up, again against a random identifier and with no cross-site tracking, used solely to compare which wording works better. Those counts are kept in Cloudflare's analytics storage, which deletes them automatically after about three months. See the Cookie Policy for how to change your choice at any time.

If you report a mistake using the "Have a suggestion or noticed a mistake?" box, we store only your message, the page you sent it from and the time. It isn't linked to your account, your IP address or any identifier, so please don't include personal details in it. We use reports only to correct the site and delete them once they've been dealt with. Pressing “Report” on an offer tracker post works the same way: we record which post was reported and when, but not who reported it.

If you create an account

Creating an account is entirely optional. It lets you save your grades and contextual answers between visits instead of re-entering them each time, keep your Discover list, and use the offer tracker. If you sign up, we collect:

Your email address and name: used to identify your account, sign you in, and send you a one-time verification link when you sign up. Your password is never stored in readable form; it's run through a one-way hash before it ever touches the database, so we can verify it but not read it back. If you use “Continue with Google” instead, Google tells us your name, email address and profile picture link, and we don't get or store a password at all.
Which version of this policy you accepted, and when: so we know whether to show you a changed policy to accept.
Your sign-in sessions: while you're signed in, we keep a record of each session with the IP address and browser details (user agent) it was started from, to keep your account secure. Sessions expire after 7 days without use, or straight away when you sign out.
The grades and contextual answers you choose to save: your A-level, IB, Scottish Highers, BTEC, AP, Singapore A-level, CBSE, ISC, French Bac, Irish Leaving Cert, HKDSE, Matura or Access to HE subjects and predicted grades (and any A-levels you take alongside a BTEC), and the same optional circumstance data described above, except now stored against your account so it's there next time you sign in. Some of the contextual-offer questions touch on things like free school meal eligibility, care experience, or refugee or asylum-seeker status; we only store your answers if you choose to save them, and only use them to check eligibility against published university contextual-offer criteria. Your answers about disability or health, ethnicity and disrupted education are more sensitive still, so they need a separate tick box: unless you tick “Also save my answers about…” on the contextual check, they are used for that check and then dropped, never stored. Untick it and save again to remove them. If you use the postcode check, we may also save the result (which of those criteria it satisfies) against your account, but never the postcode itself, which is only used to look up the result and is never stored.
Your university start year, if you set it: used only to pre-fill the loan repayment calculator.
Your answers when you set up your account: after you verify your email we ask a few questions before you use the site: how you heard about UniScout, your first name, which school year you're in, your fee status (home or international), where you are with applying, which subjects and options (such as degree apprenticeships or a year abroad) you're interested in, and, if we can't check your qualification against entry requirements yet, what it is in your own words. We also note if you tell us you didn't take GCSEs. They are stored against your account and never shared with universities or employers. The contextual offer check uses the fee status on your account to answer its fee status question, so you aren't asked twice, and if you answer that question in the check, your account's fee status is updated to match. You can change your school year, fee status, where you are with applying and your interests on My Account; to change anything else, email us (see Contact).
Your Discover list and swipes: if you use Discover while signed in, we store the courses and universities you save, and a log of which cards you were shown and what you did with each (saved, passed, how long you looked). We use this to choose which cards to show you next. We also count, across everyone's saved lists, which courses are often saved together, so that when someone saves a course on Discover we can suggest others that students who saved it also liked. Only the courses you save are counted (not what you passed on or how long you looked), and we only use a pair of courses once several different students have saved both, so a suggestion never reveals what any one person saved. To leave yours out, untick “Count my saved courses” under My long list on My Account; your list still works for you as before. Your list itself is never shown to anyone else or shared with universities, and you can wipe it at any time with “Reset taste profile” on My Account, which also takes it out of these counts.
Your GCSE grades, if you save them: optional, entered on My Account or saved when you post an offer on the offer tracker. We use them only to fill in the GCSE box when you post an offer, and you can change or clear them at any time from My Account. Saved GCSEs are never shown to other users unless you include them with an offer, and are never shared with universities.
Your UCAS choices, if you add them: up to five courses you've applied to (university, UCAS code and course name), entered on the offer tracker or My Account. We use them to show you how many offers have been posted for those courses and, if you turn alerts on, to email you when a new one is. Adding all five (or four, if you tell us that's all you applied to, which we also save) lets you see the offer conditions other students posted; we only check how many choices you've added, not which ones. We also count, across everyone's choices, which courses are often applied to together, so that when someone saves a course on Discover we can suggest others that applicants to it also chose (for example, “often applied to alongside KCL Law”). We only use a pair of courses once several different students have both on their list, so a suggestion never reveals what any one person applied to. Your choices, together with the A-level subjects saved on your account, also count towards totals on What can I study with my A levels? showing where students with the same A levels applied, unless you untick “Count my choices” (see below). Nobody else can see your own choices, they are never shared with universities, and you can change or remove them at any time; removing them also takes them out of these counts.
Your admissions test scores, if you add them: optional, entered on My Account: which tests you've taken (for example the TMUA, UCAT or IELTS) and your score in each. We use them only to fill in the test scores on an offer you post on the offer tracker. Nobody else sees them unless you attach them to an offer, they are never shared with universities, and you can change or delete them at any time.
Your gender: optional, asked when you set up your account, with “Prefer not to say” and “Other” as options. It's stored against your account, you can change it at any time from My Account, and it is never shared with universities.
Your school or college: if you pick it when you set up your account, or in the contextual offer check and save your answers, we store which school it is (its Department for Education reference number) against your account, so you don't have to find it again. You can remove it at any time by clearing it in the check and saving, and it is never shared with universities.
Whether to email you occasional updates: sign-up has an optional tick box asking if you'd like occasional emails about new UniScout features and study tips. If you haven't answered, we remind you at most once a week; if you say no, we won't ask again for six months. It is unticked by default, entirely optional, and you can turn it off (or back on) at any time on My Account. This is separate from any offer alerts, which are only ever sent for the courses you choose to follow, and from emails from universities and employers, which need their own opt-in.

We use Cloudflare Email Service, our hosting provider, to send account emails (verification and password reset), any offer alerts you set up, and — only if you've opted in — occasional UniScout updates and emails from universities and employers. Cloudflare receives your email address and the content of those emails (for an offer alert, the details of the offers it lists) only to deliver them.

The offer tracker

The offer tracker is only for signed-in users. Posting an offer or a rejection is optional. If you post one, we collect:

The details you enter: whether it was an offer or a rejection, whether you applied as a home or international student, the university, UCAS course code, course title, the date and (optionally) time the decision arrived, the date you applied, whether it was contextual (a contextual offer, or for a rejection, whether you were a contextual applicant), and (optionally) your GCSE grades, the conditions of your offer as you type them (for example “A*AA including A* in Maths”) or, for a rejection, the reason you were given, and any admissions test scores from your account that you choose to attach. Like your predicted grades, attached test scores are copied onto the offer, so changing or deleting them on My Account doesn't change offers you've already posted.
Your grades and subjects: you can only post an offer once you've added your A-level, IB, Scottish Highers, BTEC, AP, Singapore A-level, CBSE, ISC, French Bac, Irish Leaving Cert, HKDSE, Matura or Access to HE grades to your account. When you post, we save a copy of those subjects and grades with the offer, including whether each grade was predicted or achieved (you confirm them first), so the offer keeps showing what you applied with even if you change your account later.
Screenshots, if you add them: optionally, one of the offer (or rejection) and, for an offer, one of its conditions. These let offers be checked as genuine; other users only see whether an offer came with a screenshot, never the screenshot itself.

Who can see what:

Other signed-in users see the details you posted (including whether it was an offer or a rejection, your fee status, when you applied, any GCSE grades you gave, any test scores you attached and any reason you gave for a rejection) and your predicted grades. They also see your subjects unless you choose not to share them: untick “Show my subjects with this offer” when posting, or use “Hide subjects” on your offer at any time. They never see your name, email or anything else from your account, and they can't see your screenshots.
Offer conditions you type are only shown to signed-in users who've added all their UCAS choices; everyone else just sees that the offer has conditions. You can add, change or remove them on your offer at any time with “Edit conditions”. Please don't include your name, UCAS Personal ID or anything else that identifies you.
Anyone using What can I study with my A levels? sees totals that include your offer: if you share your subjects, your A-level subjects and the subject area of the course are counted (with the course title as an example) towards how many students with that mix got offers in each area (rejections aren't counted there). Only counts and course titles are shown there, never your grades, university, dates or anything about you, and offers with hidden subjects aren't counted at all. Deleting your offer, or hiding its subjects, removes it from those totals within an hour.
Anyone, including search engines, sees figures that include your post on the course's page and, once a university has at least 25 posts this year, on that university's offers page (for example uniscout.uk/offers/durham): how many offers, interviews and rejections there have been this year, when they arrived (counted by week or month, plus the date of the first offer), and the predicted A-level grades offer holders most often had. A course with fewer than 3 posts only shows how many there are, not whether they were offers or rejections, and it only shows dates and grades once it has at least 5. These pages never show an individual post, and never your subjects, GCSEs, test scores, offer conditions or anything about you. A breakdown of how predicted grades did, and the latest posts for a course or university, are shown to signed-in users only. Deleting your offer removes it from these figures within an hour.
Your screenshots can only be seen by you and by the site's administrator, who checks and, where needed, corrects or removes posted offers. They are never shown to other users or shared with universities or anyone else.
The site's administrator can also see which account (by email address) posted each offer, so they can follow up on a post that looks wrong. This is never shown to anyone else.
Students with an alert for that course get an email listing the same details other signed-in users can see (never your name, email or subjects).

Screenshots from UCAS or a university portal often show your name, UCAS Personal ID or other details. Please crop or cover anything that isn't needed to show the offer and its conditions before you upload. Also bear in mind that, even without your name, a very specific combination (a small course, an unusual set of subjects, international fee status, a contextual offer, an exact date and time) could let someone who knows you guess it was yours.

Offer alerts: if you set an alert, we store the UCAS code (and university, if you choose one) against your account and email you when someone posts a matching offer or rejection (at most once every 4 hours, covering everything posted since your last alert email). You can remove alerts at any time on the offer tracker page.

Where it's kept: offer details and alerts are stored in our database, and screenshots in private file storage, both with Cloudflare, our hosting provider.
Our basis: your consent (UK GDPR Article 6(1)(a)). You choose what to post, and you can withdraw consent by deleting it.
Deleting: you can delete any offer you posted, together with its screenshots, from the offer tracker at any time. Deleting your account removes all your offers, screenshots and alerts.

Emails from universities and employers

Universities (for example, open day invites) and degree apprenticeship employers (about their apprenticeship vacancies and work experience) can ask us to send an email to students who meet criteria they choose, such as studying a particular A-level subject, having predicted grades above a certain level, or planning to start university in a particular year. We send the email ourselves. The university or employer never receives your name, email address, grades or any other details about you, and they can't see who it went to.

Only if you opt in: you only get these emails if you tick the separate “Emails from universities and employers” box on My Account. It is unticked by default and separate from UniScout updates, and you can untick it at any time. If you haven't answered, we remind you at most once a week; if you say no, we won't ask again for six months. Every one of these emails says who it's from and has a link to stop them.
What we use to decide who gets an email: only the A-level, IB, Scottish Highers, BTEC, AP, Singapore A-level, CBSE, ISC, French Bac, Irish Leaving Cert, HKDSE, Matura or Access to HE subjects and predicted grades, GCSEs, intended start year and UCAS choices you've saved. We never use your contextual-offer answers, gender, school, school year, fee status, where you are with applying, how you heard about UniScout, the interests you picked when setting up your account, Discover list or anything you've posted on the offer tracker, and never your disability, health or ethnicity answers.
What the university or employer gets back: only anonymous totals, such as how many students met their criteria and how many emails were sent. We don't track whether you open these emails. We won't give a total below 10, so a small group can't be narrowed down to particular students.
What we keep: a record of which emails were sent to your account, so we don't send you the same one twice and can answer questions about it. It's deleted with your account.

If you click a link in one of these emails or reply to it, you're dealing with that university or employer directly, and anything you give them is covered by their own privacy policy, not this one.

Why we're allowed to use it

UK data protection law needs a reason (a “lawful basis”) for each use of your data:

Running your account (your email, name, password, sessions and the things you choose to save, including Discover and UCAS choices): to provide the service you signed up for (UK GDPR Article 6(1)(b)).
Contextual answers about disability or health, ethnicity, and disrupted education: these are “special category” data, so we only save them with your explicit consent (Articles 6(1)(a) and 9(2)(a)), which you give with the separate tick box on the contextual check. You can withdraw it by unticking the box and saving, or by deleting your account.
Offer tracker posts and analytics: your consent (Article 6(1)(a)), as described in each section above.
Occasional UniScout updates: your consent (Article 6(1)(a), and the email-marketing rules in PECR), given with the optional tick box at sign-up or the one-off prompt for existing accounts. We never send these unless you've ticked the box, and you can withdraw at any time on My Account.
Emails from universities and employers, and using your saved grades and choices to decide who receives them: your consent (Article 6(1)(a), and PECR), given with its own separate tick box on My Account. You can withdraw it at any time by unticking the box or using the link in any of those emails.
Combined counts of UCAS choices for Discover suggestions: our legitimate interest in recommending courses students are likely to want to look at (Article 6(1)(f)). Only pairs chosen by several students are used, and you can object by getting in touch, or by removing your choices.
Combined counts of Discover saves for Discover suggestions: our legitimate interest in recommending courses students are likely to want to look at (Article 6(1)(f)). Only pairs saved by several students are used, and you can object at any time by unticking “Count my saved courses” on My Account, or by getting in touch.
Counting UCAS choices with A-level subjects on What can I study with my A levels?: our legitimate interest in showing students where people with similar A levels apply (Article 6(1)(f)). Only totals of at least 5 students are shown, and you can object at any time by unticking “Count my choices” on My Account.
Security (rate limiting, session records, access logs, and the administrator checking offer posts): our legitimate interest in keeping the site working, safe and accurate (Article 6(1)(f)).

Who processes it for us

We don't sell your data, and we don't share it with advertisers, universities or employers. The only thing universities and employers ever get from us is the anonymous totals described under emails from universities and employers. These services handle your data on our behalf, only to run the site:

Cloudflare: hosts the site, database and screenshot storage, runs the course-search AI and rate limiting, stores the sign-up prompt counts, and sends account, offer alert and opted-in partner emails.
PostHog (EU region): analytics, only if you accept it.
Google: only if you choose “Continue with Google” to sign in.

Some of these companies are based in, or use servers in, the United States. Where your data leaves the UK, they rely on safeguards approved under UK law (such as the UK–US data bridge or the UK’s international data transfer agreements).

How long we keep it

Account and saved-profile data (including your Discover list and swipe log) is kept for as long as your account exists. Offers you post (with their screenshots) and your offer alerts are kept until you delete them or your account, and so is the record of which university and employer emails you've been sent. Sign-in sessions expire after 7 days without use. Deleting your account (see below) removes all of this immediately and permanently. Mistake reports are deleted once they've been dealt with. Sign-up prompt counts are deleted automatically after about three months.

Your rights, and deleting your data

You can permanently delete your account, and everything saved against it, at any time from the My Account page without needing to ask us. This removes your account record, your saved grades and contextual answers, the answers you gave when setting up your account, GCSEs, UCAS choices, Discover list and swipe log, any offers you posted to the offer tracker together with their screenshots, your offer alerts, and your active sessions straight away.

Wherever we rely on your consent, you can withdraw it at any time as described above; this doesn't affect the lawfulness of anything done before you withdrew.

Beyond deletion, you have the usual rights over your personal data (to access a copy, correct it, restrict or object to its use, or ask questions about any of this). Get in touch using the contact details below and we'll sort it out. If you're in the UK, you can also complain to the Information Commissioner's Office if you're unhappy with how a request was handled.

Contact

For anything about your data or this policy, email privacy@uniscout.uk.

Local storage & cookies

Your browser stores a small amount of data on your own device to remember things like whether you've dismissed the cookie notice, and, if you're signed in, a session cookie that keeps you signed in. See the Cookie Policy for the full list.

Where the data comes from

Course information is collected from public university course pages. Outcome statistics (satisfaction, employment, salary, entry tariff) come from HESA's Discover Uni dataset, published under the Creative Commons Attribution 4.0 licence. No personal data about students is included in or derived from that dataset. It is aggregate, course-level statistics only.

Third-party links

This site links out to official university course pages and university contextual-offer policy pages. Those sites have their own privacy practices, which this policy doesn't cover.

Changes to this policy

If we change how we use your data, we'll update this page and the date at the top. If you have an account, we'll ask you to accept the new version the next time you sign in or visit. If a change affects something you've consented to, we'll ask you again rather than assume it carries over.