Privacy Policy

We collect only what we need to run the product:

• Account details: your name and email address. Sign-in is passwordless, so we never ask for or store a password.
• Learning activity: your reviews, grades, lesson progress, and the scheduling state that decides when each concept comes back, including response signals (correctness, confidence, response time) we use to tune the scheduler.
• Profile data for your public page: the handle you choose, your headline, picture, location, and the links you add, plus who you follow and the activity feed of what they did.
• Reports: if you report a profile, we store the report and email it to us for human review.
• Journal entries: the private reflections you write during lessons. Only you can read them.
• Sign-in data: single-use, hashed, short-lived tokens we email you to sign in, plus one essential session cookie in your browser that keeps you signed in.

We use your data to authenticate you, schedule and show your reviews, track your progress, and (only if you opt in) send study reminders and account emails. The legal bases are performance of our contract with you (running the service), your consent (optional emails), and our legitimate interest in keeping the service secure. We do not use your data for advertising and we never sell it.

Team data: if you join an organization, its admins can see your name, email, when you joined, and whether you were active in the past week. They never see your individual reviews, progress, or journal.

Every account comes with a public page. Its permanent address uses your account id, and choosing a handle in Settings adds a memorable one. It shows your name, the headline you write, the picture you upload, your location and links, when you joined, your track progress and credentials, practice stats such as streaks and reviews, and your follower and following counts. Pages with a chosen handle are listed in a sitemap so search engines can find them; id-address pages are not. Messaging apps that expand links are shown a preview with the same public information. It never shows your email, journal, or team. In Settings you can hide your review activity (the heatmap and milestones), make the page private, which hides it from anyone not signed in to Kayas, or delete your account, which removes it immediately.

We don’t share your personal data except with the service providers that help us run Kayas, under data-processing terms:

• Hosting and database: bunny.net (EU region) hosts the application and the database.
• Email: Mailersend sends your passwordless sign-in links and account emails when that feature is enabled.

Your data is stored in the EU and retained while your account is active. When you delete your account, your account and all associated learning data are removed; copies in short-lived encrypted backups age out on their normal rotation. One thing is kept: if you chose a profile handle, the handle itself (just the word, linked to nothing) is permanently retired so nobody else can take over a URL you once shared.

Under the GDPR you can:

• Access and export all of your data in one click from Settings.
• Delete your account and all associated data in one click from Settings.
• Rectify inaccurate details, restrict or object to processing, and withdraw consent for optional emails.

We use one essential cookie, an httpOnly session cookie, to keep you signed in. We do not use advertising or third-party tracking cookies.

If we make material changes we’ll update the date above and, where appropriate, notify you. Questions? hello@kayas.dk.