Privacy Policy
This Privacy Policy explains what personal data the Biolearn mobile application and related services (the "App") collect, why they are collected, who they are shared with, how long they are kept, and what rights you have. It is written to satisfy the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and Apple App Store Review Guideline 5.1.1.
1. Who is responsible for your data
The controller of your personal data is:
Mateusz Gruszka, a sole trader registered in the Central Register and
Information on Economic Activity (CEIDG) in Poland
Address: ul. Parkowa 2, 62-860 Opatówek, Poland
Email: biolearn.app@gmail.com
We have not appointed a Data Protection Officer, as we are not required to. For all privacy matters, write to the email address above; we answer within 30 days.
2. What we do not do
To be explicit, because it materially affects your privacy:
- We do not sell your personal data and never have.
- We do not share your data with data brokers or advertising networks.
- We do not run advertising in the App and do not track you across other companies' apps or websites (no Apple App Tracking Transparency tracking).
- We do not collect your precise or coarse location, contacts, photos, microphone or camera data, health or fitness data, or biometric data.
- We do not use your data to build advertising profiles or to train third-party AI models.
3. What data we collect
3.1 Account data
- Email address (required — it is your login identifier).
- Password, stored only as a salted bcrypt hash. We never store or can read your plaintext password.
- Display name / username, if you provide one.
- Interface language and your chosen daily learning goal.
- Reminder time, if you enable learning reminders.
- Account creation date and, if applicable, account deletion date.
3.2 Learning data
- Lessons started and completed, units and courses in progress.
- Answers you give to questions, whether they were correct, and spaced-repetition review dates.
- Flashcard review history.
- Daily streaks, weekly ranking position, and progress statistics.
3.3 Purchase and subscription data
All payments are processed by Apple (App Store) or Google (Google Play). We never receive your card number, bank details, or billing address. Through our subscription processor RevenueCat we receive and store:
- A pseudonymous store identifier for your app installation (RevenueCat app user ID).
- The purchased product identifier, subscription period type (trial / paid / lifetime), the store used (App Store or Play Store), and the store environment (sandbox / production).
- Purchase, renewal, expiration and cancellation timestamps, and whether the subscription will auto-renew.
- Transaction amount and currency, used for accounting and revenue reporting.
3.4 In-app analytics
- Which paywall version or A/B test variant you were shown, which product you tapped, the platform, and whether the purchase completed. This is used solely to decide which pricing screen to keep; it is not shared with anyone.
- App version, so we can hide features your build does not support.
3.5 Support and feedback
- Ratings and free-text feedback you submit in the App, linked to your account.
- The content of emails you send us, including your email address.
3.6 Technical and server log data
- IP address, request timestamp, requested endpoint, HTTP status and user agent, recorded automatically by our server and hosting provider for security and troubleshooting.
4. Why we use your data, and on what legal basis
| Purpose | Data used | GDPR legal basis |
|---|---|---|
| Creating your account, authenticating you, and saving your learning progress across devices | Account data, learning data | Art. 6(1)(b) — performance of a contract with you |
| Unlocking PRO content and verifying that your subscription or lifetime purchase is active | Purchase and subscription data | Art. 6(1)(b) — performance of a contract |
| Sending learning reminders and streak notifications | Reminder time, push token held by the operating system | Art. 6(1)(a) — your consent, withdrawable at any time in App or OS settings |
| Answering your support requests and feedback | Support and feedback data, account data | Art. 6(1)(b) and Art. 6(1)(f) — legitimate interest in user support |
| Fixing bugs, preventing abuse and fraud, keeping the service secure | Technical and log data, app version | Art. 6(1)(f) — legitimate interest in a secure, working service |
| Improving the App and deciding which pricing screen to use | Aggregated learning data, in-app analytics | Art. 6(1)(f) — legitimate interest in improving our product |
| Bookkeeping, tax and accounting obligations | Transaction records | Art. 6(1)(c) — legal obligation under Polish tax law |
5. Who we share your data with
We disclose personal data only to the following categories of recipients, each acting as our processor or as an independent controller for their own service:
| Recipient | Role | Data received | Privacy policy |
|---|---|---|---|
| Salesforce / Heroku (application hosting and PostgreSQL database, operated on Amazon Web Services) | Processor — stores all App data | All data described in section 3 | salesforce.com/company/privacy |
| RevenueCat, Inc. (USA) | Processor — subscription management and receipt validation | Store user identifier, product identifiers, purchase and renewal events | revenuecat.com/privacy |
| Apple Inc. — App Store | Independent controller — payment processing and distribution | Payment details (never passed to us), purchase confirmations | apple.com/legal/privacy |
| Google LLC — Google Play and Gmail (support mailbox) | Independent controller / processor | Payment details on Play, and the contents of support emails you send us | policies.google.com/privacy |
We may also disclose data to public authorities, courts or advisers where we are legally required to do so, or where it is necessary to establish, exercise or defend legal claims. If we ever merge with or sell the business, your data may transfer to the acquirer; you will be notified before any such transfer takes effect and before your data becomes subject to a different policy.
6. International transfers
Our servers and database are located in the European Union. RevenueCat, Apple and Google are established in the United States, so some data described above is transferred outside the European Economic Area. Those transfers rely on the European Commission's Standard Contractual Clauses and, where applicable, on the EU–US Data Privacy Framework. You may request a copy of the safeguards in place by emailing us.
7. How long we keep your data
| Category | Retention period |
|---|---|
| Account data and learning data | For as long as your account exists. After you request deletion, your account is deactivated immediately and the data is permanently erased within 30 days. |
| Feedback and support correspondence | Up to 24 months from the last message, then deleted. |
| Transaction and subscription records | 5 full calendar years from the end of the tax year in which the transaction occurred, as required by Polish accounting and tax law. These records are kept in a form that is no longer linked to your learning data. |
| Server logs | Up to 90 days. |
| Backups | Encrypted backups are rotated and fully overwritten within 35 days; deleted data disappears from backups within that window. |
8. Deleting your account and your data
You can delete your account and all associated personal data at any time, directly in the App:
- Open the App and go to Profile.
- Select Delete account.
- Confirm. Your account is deactivated immediately and you are signed out.
Alternatively, email biolearn.app@gmail.com from the address associated with your account and we will delete it for you.
Deletion removes your email address, password hash, profile settings, learning history, streaks, feedback and analytics records. Transaction records required by tax law are retained for the period stated in section 7 and are dissociated from your learning data.
Deleting your Biolearn account does not cancel your subscription. A subscription bought through the App Store or Google Play must be cancelled in your Apple ID or Google Play account settings, otherwise it will continue to renew and be charged. See section 4 of our Terms of Use.
9. Your rights
Under the GDPR you have the right to:
- Access — obtain a copy of the personal data we hold about you.
- Rectification — have inaccurate or incomplete data corrected.
- Erasure — have your data deleted ("right to be forgotten"), as described in section 8.
- Restriction — ask us to limit processing while a dispute is resolved.
- Data portability — receive your data in a structured, commonly used, machine-readable format, or have it sent to another controller.
- Object — object at any time to processing based on our legitimate interests.
- Withdraw consent — where processing is based on consent (for example notifications), withdraw it at any time, without affecting processing carried out before withdrawal.
To exercise any right, email biolearn.app@gmail.com. We respond within one month and never charge for this. Exercising your rights will never result in worse service or higher prices.
You also have the right to lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl. If you live elsewhere in the EEA, you may complain to your local authority.
10. Automated decision-making
We do not carry out automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you. Spaced-repetition scheduling and streak tracking are automated, but only decide which learning material you are shown next.
11. Security
We protect your data with: TLS/HTTPS encryption for all traffic between the App and our servers; bcrypt password hashing; short-lived JSON Web Tokens for authentication; encryption at rest for our database and backups; access to production systems restricted to the controller alone; and signature verification on all incoming subscription webhooks. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the supervisory authority within 72 hours and, where the risk is high, notify you directly without undue delay.
12. Children's privacy
Biolearn is intended for users aged 13 and over (16 and over in European Economic Area countries that have not lowered the digital-consent age, unless a parent or guardian consents). We do not knowingly collect personal data from children below that age. If you believe a child has provided us with personal data, email biolearn.app@gmail.com and we will delete the account and its data promptly.
13. Links to other sites and third-party content
The App may link to external websites or embed third-party educational content such as videos or 3D models. We are not responsible for the privacy practices of those third parties, and this Policy does not apply to them. We encourage you to read their privacy policies.
14. Changes to this Privacy Policy
We may update this Policy from time to time. The "Last updated" date at the top always reflects the current version. If the changes are material, we will notify you in the App or by email before they take effect. Continuing to use the App after the changes take effect means you accept the updated Policy.
15. Contact
Questions, requests or complaints about this Policy or your data: biolearn.app@gmail.com.