Privacy policy

1. The controller of your personal data is [to be filled in: business name], [to be filled in: registered address], NIP [to be filled in: tax id (NIP)] ("we").
2. For anything about personal data, write to [to be filled in: privacy email] or to our registered address. We have not appointed a data protection officer.

1. By default your study progress, notes and settings stay on your device; we do not receive them.
2. Only these reach our servers: Account data, sync data (if you turn sync on), plan and payment data, AI tutor messages, and the technical data needed to run and secure the Service.
3. We do not sell data, show ads or use tracking tools, and we do not profile you in a way that has legal effects.

1. Account and sign-in – email address, name (if you sign in with Google), Account id. Purpose: creating and running your Account. Basis: performing the contract (Article 6(1)(b) GDPR).
2. Cloud sync (only if you turn it on) – answers, reviews, notes, bookmarks, settings and mock-exam results linked to your Account. Purpose: studying on several devices. Basis: performing the contract.
3. Plan and payments – Stripe customer id, subscription or pass status, dates, amounts, payment outcome, plan-limit counters, trial, referral codes, extension requests and your consent at purchase (terms version, time, plan). We never receive card details. Purpose: selling and providing Pro, accounting, refunds. Basis: performing the contract and our legal obligations under tax and accounting law (Article 6(1)(c) GDPR).
4. Complaints, withdrawals and contact – the content of your messages and the data in them. Purpose: handling requests. Basis: legal obligation (Consumer Rights Act) and our legitimate interest in answering messages (Article 6(1)(f) GDPR).
5. Security and operation – IP address, browser type, time and address of requests, error codes. The IP address is used to limit request rates in server memory only and is not stored by us. Purpose: preventing abuse, diagnosing errors. Basis: legitimate interest.
6. Establishing and defending claims – contract and payment data and the record of your consent at purchase. Basis: legitimate interest.
7. Anonymous usage counts – how often the atlas and games are opened, with no Account, IP address or content. They are not personal data; you can turn them off in Settings → Your data, and a "Do Not Track" or "Global Privacy Control" signal turns them off automatically.
8. Giving data is voluntary, but without an email address you cannot create an Account and without payment data you cannot buy Pro. You can use the Free plan without an Account.
9. We make no decisions based solely on automated processing, including profiling (Article 22 GDPR).

These providers process data on our behalf under data processing agreements (Article 28 GDPR):

1. Vercel Inc. (USA) – hosting the app and server, technical logs.
2. Convex, Inc. (USA) – database: your Account in the app, sync, plan, payments (no card data), limit counters.
3. WorkOS, Inc. (USA) – sign-in, sending sign-in codes and emails, storing your Account email.
4. Stripe Payments Europe, Limited (Ireland) – payments, invoices and the subscription portal. For some processing Stripe acts as a separate controller (for example fraud prevention and legal obligations); see Stripe's privacy policy.

Public authorities may also receive data where the law requires it, and our accountants receive accounting documents.

1. Vercel, Convex, WorkOS are based in the USA, so data may be transferred outside the European Economic Area.
2. The transfers rely on the European Commission's adequacy decision of 10 July 2023 for the EU-U.S. Data Privacy Framework (for certified companies) and otherwise on the Commission's standard contractual clauses (Decision 2021/914).
3. You can get a copy of the safeguards by writing to [to be filled in: privacy email].

1. Account and sync data – until you delete your data in Settings → Your data or delete your Account. Older versions of synced records are removed automatically (the last 3 versions, a 30-day change journal).
2. Plan-limit counters – 2 to 33 days. Payment event log – 90 days. Referral codes and claims – 90 days after the last change.
3. Accounting documents and payment data (including the record of your consent at purchase) – 5 years from the end of the year in which the tax payment fell due, and longer if there is a dispute, until claims are time-barred.
4. Technical logs – briefly, usually a few days, as set by our hosting provider.
5. Data on your device – until you delete it; you are fully in control of it.

1. You have the right to access your data and get a copy, to rectification, erasure, restriction of processing and data portability, and to object to processing based on legitimate interest.
2. You can export and delete your study data yourself in Settings → Your data; this never depends on your plan. For anything else, write to [to be filled in: privacy email]; we reply within a month.
3. You have the right to complain to the President of the Personal Data Protection Office (Prezes UODO), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, Poland (uodo.gov.pl).

We use only necessary cookies and browser storage. The full list: Cookies and browser storage.

When we change how we process data (for example by adding a provider), we update this page and its version, and tell Account holders about significant changes by email.