Privacy policy

An email address, for sign-in only. It is linked to your account because it is the account identifier — there is no password and no username in this app. It is not used for tracking and is never shared with a third party. Phone sign-in is currently disabled; sign-in is email only. Your study progress is kept on our server as well as on your device, so that it survives a change of phone: which questions you have answered and whether you got them right, your practice and exam results, and the questions and signs you saved. That happens whether or not you sign in — using the app without an account still creates a record, identified only by a code held on your device with no address attached to it, and signing in later attaches your address to that same record rather than starting a new one.

If you subscribe, we receive a record of it: which plan, when it started, when the current period ends, whether it is set to renew, and which store it came from. Because a subscription recurs, that record is updated over time — each renewal, a cancellation, a failed payment or a refund reaches us the same way. It is handled for us by RevenueCat, our subscription provider, and is identified by a random code generated on your device — not by your email address and not by your account. Card numbers and billing details go to Apple or Google and never reach us.

Google receives an app-instance identifier plus usage and device data. It is not linked to your account: the app never calls setUserId, so Google cannot join it to an email address. It is used only to see which screens learners actually reach. There is no advertising identifier, no ad network and no cross-app tracking.

When the app crashes or misbehaves, Google receives a stack trace, your device model, your OS version and an installation identifier, so the fault can be found and fixed. It also receives how long screens and network requests took. It is not linked to your account, it contains nothing you typed, and it is never used for advertising.

This website — separately from the app — counts page views and referring links using Vercel Analytics. It sets no cookie, stores no identifier in your browser, and builds no profile of you across other sites. If you arrive from an advertisement, the campaign name in the link is recorded so we know which advertisements are worth paying for.

If you turn reminders on, a device push token is stored so a notification can reach you. No notifications are sent unless you turn them on yourself.

Name, location, contacts, photos, advertising identifier, or anything a learner types in the app.

Nothing is sold, and nothing is shared for advertising. Under California law, we do not sell or share personal information, and we have not done so in the past twelve months.

Five companies handle data on our behalf, each for one job and nothing else: Google, for analytics, crash reports and delivering notifications; Resend, for sending the six-digit sign-in code to your email address; RevenueCat, for managing your subscription; Vercel, which runs our server and this website; and Neon, which hosts the database your account and your progress are stored in. Apple and Google also process your payments as the stores you subscribed through. Each one is bound by a contract that requires it to protect your data to the same standard this policy sets, to use it only for the job named here, and to pass it on to nobody else. None of them is permitted to use the data for their own purposes.

Sign-in codes are stored hashed — never the six digits themselves — expire after ten minutes, can be used once, and are removed by a nightly cleanup after that. The counters that rate-limit sign-in hold a hashed form of your email address or network address for 24 hours and nothing else. A sign-in session’s refresh token is deleted when it expires, and within seven days if it is revoked. Your account and your progress are kept for as long as the account exists. When you delete it, your email address and name are erased immediately and the remaining rows are removed 30 days later. Google deletes analytics and crash reports on Firebase’s own retention schedule, and RevenueCat keeps a record of a subscription for as long as the sale has to be accounted for.

Reminders are the only thing this app asks your permission for, and turning them off withdraws it: no further notification is sent, and the token that made them possible is discarded with your account. Deleting your account withdraws everything else at once. You do not have to give a reason, nothing else about the app works differently afterwards, and you can turn reminders back on later without losing anything.

You can ask what personal information we hold about you, ask for a copy of it, ask us to correct it, and ask us to delete it. Deleting your account from inside the app erases your address at once and is the fastest route; the section above says what happens to the rest. You can also ask through the feedback screen in the app and we will answer within 45 days. We will not treat you differently for asking.

You can delete your account from inside the app: Settings → Account. Deletion is final and there is no undo. Your email address and name are erased the moment you confirm, every sign-in session is revoked, and your progress is removed 30 days later. Your subscription is not tied to your account, so deleting the account does not cancel it and does not stop the billing — cancel in the App Store or Google Play as well. See the terms of use.

Use the feedback screen in the app: Settings → Feedback. To make a request about your personal information, say so there and we will answer within 45 days.