Privacy Policy

Last updated: 27 February 2026.

Controller and scope

This policy explains how this application processes personal data for registered users. The service operator is the data controller for account and platform data processing.

Data categories

  • Account identity data: username, email, authentication metadata.
  • Study content: uploaded files, extracted text, generated flashcards/notes/quizzes, chat interactions.
  • Usage and performance data: task activity, ratings, study timing, confidence and progress signals.
  • Security and technical data: session/CSRF cookies, request metadata needed for protection and abuse prevention.

Purposes and legal bases (GDPR Art. 6)

  • Contract performance: provide login, storage, study workflows, and account management.
  • Legitimate interests: reliability, fraud/security monitoring, diagnostics, and product safety.
  • Legal obligation: where required for lawful requests, accounting, or compliance duties.
  • Consent: where separately requested for optional processing features.

Third-party processors and international transfers

When AI features are used, submitted content may be processed by Google Vertex AI (Gemini). Data may be transferred outside your jurisdiction depending on processor region and account configuration. Controllers should ensure appropriate safeguards (for example, SCCs/contractual safeguards) with processors.

Retention schedule (default)

  • Account profile and core study records: retained while your account is active.
  • Generated transient planning/activity snapshots and logs: periodically minimized according to operational retention settings.
  • Failed ingestion/system transient records: retained short-term for debugging, then purged.
  • Account deletion requests: trigger removal of account-linked records and associated stored files where supported.

Your rights

You can access export and deletion controls in Privacy & Data. Depending on your jurisdiction, you may also request rectification, restriction, objection, and portability where applicable.

DSAR response SLA

Requests are targeted for acknowledgement promptly and full response within 30 days, subject to verification and lawful extensions for complex requests.

Contact and complaints

For privacy requests, use Privacy & Data. For product or account configuration help, start in Settings. You may also have the right to lodge a complaint with your local supervisory authority.