Privacy Policy

We collect only what we need to run the product:

• Account details: your name and email address. Sign-in is passwordless, so we never ask for or store a password.
• Learning activity: your reviews, grades, lesson progress, and the scheduling state that decides when each concept comes back, including response signals (correctness, confidence, response time) we use to tune the scheduler.
• Profile data for your public page: the handle you choose, your headline, picture, location, and the links you add, plus who you follow and the activity feed of what they did.
• Reports: if you report a profile, we store the report and email it to us for human review. Anonymous reports and reports that have been resolved are retained for up to 180 days.
• Sign-in data: single-use, hashed, short-lived tokens we email you to sign in, plus one essential session cookie in your browser that keeps you signed in.
• Local browser data: short-lived sign-in and invite handoffs, your unfinished lesson drafts, and interface preferences. Lesson drafts are tied to your account and cleared when you sign out.
• Service measurement and diagnostics: identity-free counts of interactions with the public sample, retained for 90 days, and error diagnostics if error reporting is enabled. Public-event rate limits briefly use an IP-derived bucket for security; the event itself stores no IP, account, or browser identity.
• Notification delivery records: short-lived claims used to prevent duplicate email or push reminders, retained for up to 90 days.

We use your data to authenticate you, schedule and show your reviews, track your progress, and (only if you opt in) send study reminders and account emails. The legal bases are performance of our contract with you (running the service), your consent (optional emails), and our legitimate interest in keeping the service secure. We do not use your data for advertising and we never sell it.

Team data: if you join an organization, its admins can see your name, email, when you joined, and whether you were active in the past week. They never see your individual reviews or progress.

Every account has a profile that starts visible only to signed-in KAYAS members. Its permanent address uses your account id, and choosing a handle in Settings adds a memorable one. You can choose to make the profile public to anyone with the link and, separately, allow search-engine listing after you choose a handle. A profile can show your name, the headline you write, the picture you upload, your location and links, when you joined, your track progress and credentials, and your follower and following counts. Review activity such as streaks, reviews, heatmaps, and milestones stays hidden unless you turn it on. It never shows your email or your team. You can change every sharing choice in Settings or delete your account.

We don’t share your personal data except with the service providers that help us run KAYAS, under data-processing terms:

• Hosting and database: bunny.net hosts the primary application and database in an EU region.
• Email: MailerSend sends your passwordless sign-in links and account emails when that feature is enabled.
• Error diagnostics: Sentry receives sanitized browser and server error reports only when the operator enables it; direct identifiers and sign-in tokens are excluded.
• Mobile push delivery: Apple Push Notification service and Google Firebase Cloud Messaging deliver notifications to devices that opt in.

The primary application and database are hosted in the EU. Email, error-diagnostic, and mobile-push providers may process limited data in other locations under their own terms and applicable transfer safeguards. When you request deletion, the account is locked immediately. You can cancel deletion by signing in again during a 30-day grace period; after that, the account and associated learning data are hard-deleted. Encrypted backup copies age out within 90 days. Identity-free public interaction events and notification delivery claims are retained for up to 90 days; anonymous reports and resolved reports are retained for up to 180 days. One thing is kept: if you chose a profile handle, the handle itself (just the word, linked to nothing) is permanently retired so nobody else can take over a URL you once shared.

Under the GDPR you can:

• Access and export all of your data in one click from Settings.
• Request account deletion in one click from Settings; access is locked immediately, with a 30-day period to cancel before hard deletion.
• Rectify inaccurate details, restrict or object to processing, and withdraw consent for optional emails.

We use one essential httpOnly session cookie to keep you signed in. Local storage holds sign-in and invite handoffs, account-scoped unfinished lesson drafts, interface preferences, and your acknowledgement of the storage notice. We also record identity-free first-party counts for the public sample. We do not use advertising or third-party tracking cookies.

If we make material changes we’ll update the date above and, where appropriate, notify you. Questions? hello@kayas.app.