Политика за поверителност

Last updated: 6 November 2026

Applies to the Learny apps from version 2.5 (iPhone, iPad, Mac, CarPlay) or 2.5.0 (Android) and to the website learny.page. Section 14 explains what is different in older app versions.

For children and young people: Privacy at Learny – in short

The essentials

• Your learning content stays on your device. Learny stores subjects, categories, cards and learning progress locally. They only leave the device through features you use: iCloud (iPhone, iPad, Mac), sync with your Google account or Google backup (Android), read-aloud with the cloud voice, or an AI feature.
• AI only when you use it. Before the first use of AI, the app asks you. Only then is the content needed for the feature sent to Google Gemini. Google does not use it for training. Processing may also take place outside the EU. On suitable Apple devices, Apple Intelligence handles some tasks directly on the device. You can switch AI off in the settings at any time; all learning features also work without AI.
• Anonymous sign-in. For server features (cloud voice, AI, purchase verification), the app signs in with a random user ID – without a name and without an email address.
• No advertising, no tracking. We do not sell data and we do not create user profiles. One built-in Google component (text recognition on Android) sends technical diagnostic data to Google (section 3.5).
• You are in control. Switch off AI, switch off reward videos, delete server data or your account – directly in the app. Questions: support@learny.page.

1. Controller and contact

Controller within the meaning of the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG):

Emanuel Schmacher e.U. (registered sole proprietorship)
Sielach 76
9133 Sittersdorf
Austria
Email: support@learny.page (for all data protection requests, subject “Privacy”)
Phone: +43 664 2617817

We have not appointed a data protection officer; this is not required under Art. 37 GDPR.

2. Overview

Only on your device (it does not leave the device, except through the features in section 3):

• subjects, categories, cards (including photos), courses, worksheets, vocabulary tests, podcasts and audio guides
• learning progress, statistics, badges, settings, reminder times (the app creates reminders itself; we do not send push notifications)
• iPhone, iPad, Mac: the counters for free AI use (in the device keychain)
• local logs (section 3.12)

Via servers or third-party services:

3. Data processing in the app

3.1 Anonymous sign-in and app integrity check

Anonymous sign-in (Firebase Authentication). When it starts, the app signs in anonymously. This creates a random user ID without a name and without an email address. The app stores the sign-in token on your device. For security, Google also processes your IP address and technical details about the app (user agent) during sign-in; according to Google, logged IP addresses are kept for a few weeks. Firebase Authentication runs exclusively in data centres in the USA.

• Purpose: access to our server features (cloud voice, AI, purchase verification, on Android also reports and sync) and protection against abuse, for example through daily quotas per user ID.
• Deletion: Firebase automatically deletes anonymous accounts 30 days after they were created. A daily clean-up job removes the data on our servers linked to the account within about two days. After that, the app creates a new anonymous account when needed. According to Google, deleted sign-in data is removed from its backups within 180 days. You can also delete your account yourself at any time (section 11).

App integrity check (Firebase App Check). For requests to our servers and to Google, Firebase App Check verifies that they come from a genuine, unmodified Learny app. For this, the app uses Apple’s App Attest or DeviceCheck service on iPhone, iPad and Mac, and Google Play Integrity on Android. Technical integrity attestations are sent to Apple or Google. According to Apple, App Attest attestations contain no hardware identifiers. The resulting token is valid for at most 24 hours. On Android, the Firebase library for our server functions also sends a random app instance identifier (Firebase Instance ID); it contains no device or personal data and is used to deliver the request.

Legal basis: Art. 6(1)(b) GDPR (providing the features) and Art. 6(1)(f) GDPR (our legitimate interest in protecting the servers and the free quotas against abuse). Storing the token on your device is strictly necessary for the service (Section 165(3) Austrian Telecommunications Act 2021, Section 25(2) no. 2 German TDDDG).

3.2 AI features (Google Gemini, Apple Intelligence)

a) When. Only when you start an AI feature. Before the first use of AI, the app shows a notice. AI is only used once you tap “Use AI” (or “Turn on AI features” during onboarding). You can switch off “Use AI features” in the settings at any time. Learny then sends no content to AI services, and Apple Intelligence stays off as well; the next time you use AI, the app asks again. The app stores on your device when you turned AI on or off (time, version of the notice).

b) Which features. Among others: creating cards, categories and courses from a topic, text, photo, scan or document; vocabulary scanner; worksheets, practice exams, “Solve tasks” and “Check my work”; quiz questions and grading of free-text answers; summaries; learning paths and the curriculum assistant; spell check; conversation mode (also in CarPlay); podcasts; audio guides; on iPhone, iPad and Mac, AI speech recognition as a fallback when the device’s recognition is not sufficient.

c) Which data goes to Google.

• what you enter or select for the feature: texts, photos and scans, documents or document pages, voice recordings
• content of your cards and courses as far as the feature needs it, for example for quiz questions, podcasts, the conversation about your cards or as a recognition aid for speech recognition
• language settings; for audio guides and location-based podcasts, the rounded location (section 3.3)
• technical: the pseudonymous user ID (Firebase AI Logic adds it to every request), the App Check token, app and SDK version, your IP address

d) Who and where. Requests go via Firebase AI Logic to Gemini models on the Google Cloud Platform. Google Cloud EMEA Limited processes them as our processor. We use the “global” location: Google may process requests in any Google Cloud data centre in the world, including the USA.

e) Storage.

• Learny does not store your AI input on its own servers. The app stores the results on your device.
• Under the Google Cloud terms, Google does not use the content to train AI models.
• We have switched off Google’s cache for AI requests; input and output are only processed for the duration of the request. Logging of content for monitoring (AI monitoring) is switched off as well.
• If there is a suspicion that the usage policies are being violated, Google may store requests for up to 90 days, solely to investigate the violation (abuse monitoring).

f) Safety filters. Google automatically checks input and output to block harassing, hateful, sexual and dangerous content. In addition, Learny instructs the model to respond in a child-appropriate way. If a response is blocked, the app shows a notice; the request then does not count towards your free quota.

g) Apple Intelligence. On iPhone, iPad and Mac with iOS, iPadOS or macOS 26 or later and Apple Intelligence switched on, Learny handles some tasks with the language model on your device, currently: grading free-text answers, multiple-choice quizzes from subject cards, spell check and conversation reviews in subjects. The content does not leave your device; neither Apple nor we receive it. Learny does not use Private Cloud Compute (processing on Apple servers). In the settings, you can choose Google Gemini instead. Tasks that the on-device model cannot handle reliably, and unsupported languages, always run via Gemini.

h) Please note. Do not enter sensitive data, for example about health or religion. Do not photograph other people without their consent. AI can make mistakes – check important content.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract – you request the feature). Without the transfer, the feature cannot be provided; the rest of the app remains usable. Transfers to third countries: EU-US Data Privacy Framework and standard contractual clauses (Art. 45 and 46(2)(c) GDPR), see section 7.

3.3 Location, maps and place names

• When: only for the audio guide and location-based podcasts, only if you have allowed location access and only while you use the feature.
• On the device: the device determines the GPS position and the compass direction.
• Place name: the app has the operating system’s map service convert the coordinates into a place and district name (iPhone, iPad, Mac: Apple; Android: Google). For this, the coordinates are sent to Apple or Google, who are responsible for this themselves.
• To Google Gemini: the coordinates rounded to three decimal places (accurate to about 100 metres), the viewing direction, the place and district name, and your question or photo.
• Map: on iPhone, iPad and Mac, the app shows a map from Apple Maps. On Android, the app loads map tiles from servers of the OpenStreetMap Foundation (United Kingdom). The Foundation receives your IP address, the app identifier and the requested map section, from which your approximate location can be derived. The tiles are cached on the device. Map data: © OpenStreetMap contributors.
• Storage: we do not store your location on our servers. For location-based podcasts, the app stores the place locally with the podcast. For storage at Google, see 3.2 e.

Legal basis: Art. 6(1)(b) GDPR (you request the location-based feature). You can withdraw location access in the device settings at any time.

3.4 Speech output and speech recognition

Cloud voice (Google Cloud Text-to-Speech). To read cards aloud, in conversation mode, for podcasts, audio guides and in CarPlay, the app uses synthetic (computer-generated) voices from Google.

• The text to be read aloud, the language and voice, and the pseudonymous user ID are transmitted.
• Requests go through our server function in the EU (Google Cloud, region Belgium). It calls Google’s speech service, which may also process the request outside the EU.
• We do not store texts or audio on our servers.
• Without internet or in case of an error, the app uses your device’s voice.
• Plain read-aloud is not an AI feature within the meaning of the “Use AI features” switch and also works when AI is switched off.

Daily counter. To protect against abuse, we count the number of requests and characters per user ID and day. The counters are kept in our database in Frankfurt (Google Cloud Firestore) and deleted automatically after 30 days.

Speech recognition. Primarily, the app uses the operating system’s speech recognition (Apple or Google). Depending on the device, it runs on the device or at Apple or Google; their privacy policies apply. On iPhone, iPad and Mac, recognition via Gemini can be used as a fallback, but only with AI features switched on (section 3.2). Terms from your cards may be sent along as a recognition aid.

Legal basis: Art. 6(1)(b) GDPR; daily counter: Art. 6(1)(f) GDPR (protection against abuse).

3.5 Camera, photos, documents, microphone and text recognition

• Access only when you use the respective feature and have granted the permission. You can withdraw the permissions in the device settings.
• Text recognition in photos and scans runs on the device (Apple Vision or Google ML Kit). Photos, scans and documents are only sent to the AI if you use an AI feature (section 3.2).
• ML Kit (Android only): Google’s built-in text recognition component sends technical data to Google during use: device manufacturer, model and Android version, app identifier and version, a random installation identifier, performance metrics, events and error codes. According to Google, it uses them for diagnostics and usage statistics of this component. Images and recognised text are not included. Google does not offer a switch for this. Legal basis: Art. 6(1)(f) GDPR (our interest in working on-device text recognition without sending images to servers).

3.6 Free quota for AI features

Without a subscription, you can use the AI features three times, and AI conversations also three times (per device).

• iPhone, iPad, Mac: the counters are stored exclusively in your device’s keychain. They remain there even after you delete the app.
• Android: so that the quota is not reset by reinstalling the app, we also store the counters in our database (Google Cloud Firestore, Frankfurt).
  • The key is the device ID ANDROID_ID. Android assigns it per combination of app signing key, user profile and device; after a factory reset it is new. It is not linked to your name or email address.
  • Only the following is stored: the number of free AI uses and conversations used, and the time of the last change.
  • The app only reads the ANDROID_ID when you use an AI feature without a subscription for the first time, not when the app starts.
  • Retention: 24 months after the last use, then automatic deletion. The counter remains even after an account is deleted, because otherwise it could not fulfil its purpose of preventing repeated use of the free quota.

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in protecting the free quota against repeated use). You can object to this (section 11); in that case, however, we can no longer offer you free use on Android.

3.7 Purchases and subscriptions

• iPhone, iPad, Mac: purchase, payment and subscription management are handled exclusively by Apple. The app checks the purchase status on the device (StoreKit). We receive no payment data and do not store purchase data on servers for iOS.
• Android: purchase, payment and subscription management are handled exclusively by Google Play.
  • For verification, the app sends the purchase token and the product to our server function, which queries the status from Google Play.
  • Together with the pseudonymous user ID, we store: product, purchase token, subscription status, start, expiry date, auto-renewal, test purchase yes/no and the time of the last check.
  • Google Play notifies our server of changes to a subscription (renewal, cancellation, refund). We then query the current status from Google Play and store it with the purchase. Notifications that cannot yet be assigned to an account are deleted automatically after 90 days.
  • To protect against abuse, we count purchase verifications per user ID and day (deleted after 30 days).
  • We receive no payment data.

Legal basis: Art. 6(1)(b) GDPR (providing Learny Pro) and Art. 6(1)(f) GDPR (protection against fake purchases).

3.8 Sync and backup

iCloud (iPhone, iPad, Mac). If iCloud is active on your device and allowed for Learny, Learny automatically syncs your learning content between your Apple devices via iCloud Drive or iCloud (CloudKit, private database). This includes a random device identifier of the app (identifierForVendor) so that devices can be told apart. The data is stored in your iCloud storage; Apple is responsible for this under your contract with Apple. We have no access to it. You can switch this off in the iOS settings (Apple Account → iCloud). In the app, you delete the iCloud data with “Delete All Cloud Data”. App data may also be included in your device backups (iCloud backup or computer).

Sync with a Google account (Android, optional). Only if you sign in with your Google account and use sync, we store:

• in Firebase Authentication (USA), the link to your Google account including email address, name and profile picture address,
• in our database (Google Cloud Firestore, Frankfurt), a profile with email address, display name, profile picture address and timestamps, as well as your learning content, learning progress and statistics.

You can stop syncing at any time. With “Delete account and cloud data”, you delete the account and the data on our servers (section 11).

Android backup. If you have switched on Google backup on your Android device, Android backs up the app’s learning database to your Google account. Purchase status and encrypted settings are excluded. Google manages the backup for you under your contract with Google; we have no access to it.

Legal basis: Art. 6(1)(b) GDPR (sync at your request).

3.9 Reporting AI content (Android only)

In the Android app, you can report inappropriate, wrong or dangerous AI content (“Report” on the content or “Report AI content” in the settings). On iPhone, iPad and Mac, you can report such content by email to support@learny.page.

• Stored: the reason, your optional comment (at most 500 characters), the reported AI text (at most 2,000 characters), the type of content (e.g. card, conversation, podcast), the pseudonymous user ID, platform, app version, language and the time.
• Storage location and period: our database (Google Cloud Firestore, Frankfurt), automatic deletion after 90 days.
• After reporting, the app offers to delete the content.
• We may use reports to improve filters and instructions for the AI; reports are not handled or answered individually. Please do not write personal data in the comment.
• At most 20 reports per account and day are possible (daily counter, deleted after 30 days).
• Your reports are part of the data export and are deleted immediately when you delete your account (section 11).

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is to make AI content safer and more accurate and to meet the Google Play requirements for apps with AI content.

3.10 Reward videos (YouTube)

After a learning session, Learny can offer a short animal video as a reward. We only show videos from original channels.

• Two clicks: at first you only see a placeholder. Only when you tap “Watch video on YouTube” after the notice does the app load the video via youtube-nocookie.com.
• What happens then: YouTube (for users in the EU: Google Ireland Limited; Google LLC, USA) receives your IP address, device and browser data and the video ID. At the latest when the video plays, YouTube may set cookies or similar storage in the app’s video window. What YouTube does with this is described in Google’s privacy policy (policies.google.com/privacy) and YouTube’s terms of service.
• Switching off: in the settings with “Show YouTube reward video”.

Legal basis: your consent by tapping “Watch video on YouTube” (Art. 6(1)(a) GDPR, Section 165(3) Austrian Telecommunications Act 2021, Section 25(1) German TDDDG). You can withdraw it by switching off reward videos. Children below the age of consent (14 in Austria, 16 in Germany) need their parents’ permission for this (Art. 8 GDPR, section 12). Transfer to the USA: EU-US Data Privacy Framework.

3.11 Server configuration and technical logs

• Configuration: when it starts, the app loads the current settings for the AI models from our database. Apart from the pseudonymous user ID, nothing personal is processed.
• Server logs: our server functions write technical logs (time, function called, error messages, in some cases the pseudonymous user ID; for reports on Android only the type and reason of the report, without the reported content) to Google Cloud Logging. They serve troubleshooting and security and are deleted automatically after 30 days. Purchase tokens are shortened in logs.

Legal basis: Art. 6(1)(f) GDPR (secure and error-free operation).

3.12 Local logs on your device

The app logs AI use on your device to make the AI notices traceable and to find errors:

• iPhone, iPad, Mac: time, feature, model, language, success or error, duration, a random local identifier, an excerpt of your request (at most 500 characters; email addresses and phone numbers are masked) and a short version of the response (at most 200 characters).
• Android: technical details only (time, feature, success or error).
• Both platforms: turning AI features on and off.

The logs do not leave your device. The app deletes them after 30 days, and immediately when the app is deleted. However, they may be included in your own device backups.

3.13 Support by email

When you write to us, we process your email address, your message and anything else you tell us in order to handle your request. Our mailbox is hosted by HostEurope (section 6). Retention: 3 years after the request has been completed (limitation period, Section 1489 Austrian Civil Code), 7 years for tax-relevant correspondence.

Legal basis: Art. 6(1)(b) GDPR (requests about your use) or Art. 6(1)(f) GDPR (other requests).

3.14 Labelling exported AI files (Content Credentials)

The EU AI Act (Art. 50(2)) obliges us to label AI-generated content in a machine-readable way. If you export or share a PDF or audio file with AI content (for example a worksheet, a summary, printable flashcards or a podcast), Learny from version 2.8 embeds digitally signed provenance information based on the open C2PA standard in the file (“Content Credentials”), in addition to the visible label.

• For this, the app sends to our server function in the EU (Google Cloud, region Belgium): checksums (hash values) of the file, the notice that the content was created with AI, app and operating system version and a random identifier of the file; technically also the pseudonymous user ID and the App Check token. The file itself, its content and its title do not leave your device for this.
• The server signs this information with Learny’s key and obtains a timestamp from a timestamping service (Sectigo or DigiCert). The timestamping service only receives a hash value, no data about you.
• We do not store the information. To protect against abuse, we count signatures per user ID and day (daily counter as in section 3.4, deleted automatically after 30 days).
• The file then states: that the content was created with AI or contains AI content, the app, version, operating system, time and Learny’s signature – no name, no account, no device, no location. Anyone who receives the file can read and check this information. How this works is explained at learny.page/en/ai-labelling/.
• Without internet or in case of an error, the file is created without a signature, with the visible label and the metadata.

Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 50(2) AI Act (legal obligation to label), alternatively Art. 6(1)(f) GDPR (our interest in verifiable provenance labelling); daily counter: Art. 6(1)(f) GDPR (protection against abuse).

3.15 What Learny does not do

• no advertising, no advertising IDs, no tracking across apps or websites, no sharing with data brokers
• no user profiles and no automated decisions about you (section 10)
• no public profiles and no chat with other people
• the app displays formulas in worksheets with a built-in library (MathJax); nothing is loaded from the internet for this

4. Website learny.page

Hosting and server logs. The website is hosted by HostEurope GmbH (Cologne, Germany) as our processor. When you visit it, the server processes your IP address, date and time, the page requested, the referrer and the browser type. The logs are deleted after 7 days at the latest. Legal basis: Art. 6(1)(f) GDPR (secure provision of the website).

Cookie notice. On your first visit, the website asks whether you allow third-party content (Google reCAPTCHA). “Accept” and “Decline” are equally prominent. We store your choice in a cookie (12 months) or in your browser’s local storage; there we also remember whether you closed the app notice. After “Accept”, the website also remembers your language in a session cookie that expires when you close the browser. Legal basis: Section 165(3) Austrian Telecommunications Act 2021 or Section 25(2) no. 2 German TDDDG (strictly necessary) and Art. 6(1)(f) GDPR.

Language. If the address contains no language, the website chooses it based on your browser’s language setting. No third-party services are queried for this.

Google reCAPTCHA. Only if you agree do we load reCAPTCHA from Google (Google Ireland Limited; Google LLC, USA) to protect the contact form and the newsletter against spam. Google receives your IP address, browser and device details and information about your behaviour on the page, and may set cookies. Legal basis: consent (Art. 6(1)(a) GDPR, Section 165(3) Austrian Telecommunications Act 2021, Section 25(1) German TDDDG), which you can withdraw via the website’s cookie settings. Transfer to the USA: EU-US Data Privacy Framework. Without reCAPTCHA, you can always reach us by email.

Contact form. We process your email address, your message and technical data (IP address, time) to answer your request. Legal basis and retention as in section 3.13.

Newsletter.

• Sign-up with double opt-in: after entering your email address, you receive a confirmation email; you are only subscribed after clicking the link.
• Data processed: email address, chosen language, subscription status, times of sign-up, confirmation and any reminder, and random identifiers for the confirmation and unsubscribe links. We keep a log of the emails sent (time, email address, subject, result).
• If you do not confirm your sign-up, we may remind you once by email.
• Sent from our own server at HostEurope, without external newsletter service providers. We do not track opens or clicks.
• Legal basis: consent (Art. 6(1)(a) GDPR, Section 174 Austrian Telecommunications Act 2021). Below the age of consent (14 in Austria, 16 in Germany) only with your parents’ permission (Art. 8 GDPR).
• You can unsubscribe at any time via the link in every email or by email to support@learny.page (subject “Unsubscribe newsletter”).
• Retention: until you unsubscribe; after that, we keep proof of the consent and of the unsubscription (including the sending log) for up to 3 years.

5. Legal bases at a glance

The operating system permissions for camera, photos, microphone and location are technical permissions, not consents within the meaning of the GDPR. We base the processing of the content on the legal basis stated in each case.

Storing or reading information on your device: only where strictly necessary for the service you requested (Section 165(3) Austrian Telecommunications Act 2021, Section 25(2) no. 2 German TDDDG), otherwise with your consent (reward videos, reCAPTCHA).

6. Recipients

For the services that Apple and Google provide as independent controllers, their privacy policies apply: apple.com/legal/privacy and policies.google.com/privacy. Where Google processes technical operating data (such as IP addresses) for its own purposes such as security when providing its services, Google is responsible for this itself.

7. Transfers to countries outside the EU

• USA (Google): Firebase Authentication processes data exclusively in the USA. Gemini may process requests worldwide; the speech services and YouTube may also transfer data to the USA. Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR). In addition, Google has agreed to the European Commission’s standard contractual clauses in its data processing terms (Art. 46(2)(c) GDPR).
• Other countries (Gemini “global”): for processing in other countries, the standard contractual clauses in Google’s data processing terms apply.
• United Kingdom (OpenStreetMap): there is an adequacy decision of the European Commission for the United Kingdom (Art. 45 GDPR).
• Apple: for users in the EU, Apple Distribution International (Ireland) is responsible. According to its privacy policy, Apple bases transfers to Apple Inc. in the USA on standard contractual clauses.

You can obtain a copy of the safeguards by writing to support@learny.page. Google’s standard contractual clauses are also available at cloud.google.com/terms/data-processing-addendum.

8. Retention periods

9. Do you have to provide data?

You are not obliged by law or contract to give us data. However, some features do not work without it:

• Without anonymous sign-in and the integrity check, cloud voice, AI, purchase verification and (on Android) reports do not work. Learning, cards and vocabulary tests still work, even offline.
• Without transferring your input, the respective AI feature cannot be used; the rest of the app remains usable.
• Without location access, the audio guide is only available without a location reference.
• Without a purchase token, we cannot unlock Learny Pro on Android.

10. No automated decisions

We do not make solely automated decisions that produce legal effects concerning you or similarly significantly affect you, and we do not create profiles (Art. 22 GDPR). When the AI grades a quiz answer or points out mistakes, this is only a learning aid; you can always see the result differently and keep learning.

11. Your rights and how to exercise them

You have the right to

• access your data (Art. 15 GDPR),
• rectification (Art. 16),
• erasure (Art. 17),
• restriction of processing (Art. 18),
• data portability (Art. 20),
• object to processing based on our legitimate interest (Art. 21),
• withdraw consent with effect for the future (Art. 7(3)), for example via the “Show YouTube reward video” setting or by unsubscribing from the newsletter,
• lodge a complaint with a supervisory authority (Art. 77), in Austria with the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, phone +43 1 52 152-0, dsb@dsb.gv.at, www.dsb.gv.at. You can also contact the supervisory authority in your country of residence.

Directly in the app:

• Switch off AI: Settings → “Use AI features”.
• Switch off reward videos: Settings → “Show YouTube reward video”.
• iPhone, iPad, Mac – delete server data: Settings → Data Management → “Delete server data”. Our server function first deletes all data of your anonymous account on our servers (e.g. daily counters) and then the account itself. Your learning content on the device and in iCloud remains; you delete the iCloud data with “Delete All Cloud Data”.
• Android – delete account: Settings → “Delete account and cloud data”. This deletes your account and all data on our servers: profile, synced learning content, statistics, purchase link, daily counters and reports. The counter for the free quota is excluded (section 3.6).
• Export: you can export your learning content in the app. On request, we provide a copy of your data on our servers – including your reports – as a file (Art. 15 and 20 GDPR).
• Instructions for deletion without the app are available at learny.page/en/account-deletion/.

What remains after deletion: the free quota counter on Android (up to 24 months after the last use), server logs (up to 30 days), sign-in data in Google’s backups (up to 180 days), AI requests kept by Google in case of suspected abuse (section 3.2 e), accounting records (7 years), and the data for which Apple and Google are responsible themselves (e.g. your purchase history in the store). You delete local data by removing the app. Deletion does not cancel an active subscription; you do that in the subscription settings of Apple or Google Play.

By email: to support@learny.page, subject “Privacy”. We reply within one month.

Important: your data on our servers only carries a random user ID or the ANDROID_ID, no name. Without your help, we often cannot assign it to you (Art. 11 GDPR). When you make a request, please send us the details that allow us to identify your data (for example the email address of your Google account if you use sync on Android), or delete the data directly in the app.

12. Children and young people

Learny is a learning app and is also used by pupils, including children. We do not ask for or check anyone’s age. That is why the same safeguards apply to everyone: no advertising, no tracking, no public profiles, no chat with other people, safety filters and child-appropriate instructions for the AI (section 3.2 f).

We base most processing on the contract of use or our legitimate interest, not on consent. Where we need consent – for YouTube reward videos (section 3.10) and for the newsletter and reCAPTCHA on the website (section 4) – children under 14 (in Austria, Section 4(4) DSG) or under 16 (in Germany and some other countries) can only consent with their parents’ permission (Art. 8 GDPR).

Using a learning app free of charge is an everyday, minor transaction that children can validly enter into themselves (Section 170(3) Austrian Civil Code, ABGB). Should a child exceptionally be unable to conclude the contract of use validly under the law that applies to them, we base the processing for the feature the child started on Art. 6(1)(f) GDPR (our legitimate interest in providing the requested feature) – with the same safeguards and without any disadvantage for the child.

Tips for parents:

• With the “Use AI features” switch, you decide whether content is sent to AI services. The learning features also work without AI.
• Reward videos can be switched off in the settings.
• Your child only grants location, camera and microphone access when using the respective feature; you can withdraw these permissions in the device settings.
• Purchases go through Apple (“Ask to Buy” in Family Sharing) or Google Play (Family Link), where you can require approval for purchases.
• You can request access or deletion for your child at any time: support@learny.page, subject “Child protection”. If we learn that we are processing a child’s data without the necessary permission (for example for the newsletter), we delete it.

We do not deliberately process special categories of personal data (e.g. health data). However, because you can write and take photos freely in the AI features, this cannot be completely ruled out. Please do not enter such data.

A short, child-friendly version of this privacy policy is at the end of this page (“Privacy at Learny – in short”).

13. Data security

We take technical and organisational measures in accordance with Art. 32 GDPR, including:

• encrypted transmission (HTTPS/TLS), no unencrypted connections in the app
• server functions only with sign-in and a verified genuine app (Firebase App Check)
• access rules in the database: each account can only read and write its own data; counters, purchase notifications and reports are only accessible to the server
• no secret keys in the app; validation and limits for all input to our server functions; daily quotas per account
• encrypted storage of sensitive values on the device (keychain or encrypted settings)
• automatic deletion after fixed periods (section 8)
• database in the EU (Frankfurt), server functions in the EU (Belgium)

14. Note on older app versions (up to 2.4)

If you still use an older version, the following applies in addition or instead:

• Android up to version 2.4.0: the app transmits usage statistics to Google Analytics for Firebase (including app events, device data, an app instance identifier) and crash and error reports to Firebase Crashlytics (error history, device data, session events at every start, an installation identifier). Recipient: Google Ireland Limited or Google LLC. Google deletes Crashlytics reports after 90 days; we have set the Analytics data to the shortest possible retention and will delete it after the transition. In addition, this version reads the ANDROID_ID when the app starts.
• Both platforms up to version 2.4: reward videos are loaded from YouTube without a prior tap. For formulas in worksheets, the MathJax library is loaded from the jsDelivr service, which receives your IP address. For the audio guide, the coordinates are sent to Gemini unrounded. During onboarding, the app asks for consent to the use of AI. For these older versions, the consent given at the time remains the legal basis; you can withdraw it in the app. From version 2.5, AI use is designed differently (confirmation per feature, no storage of your inputs); we base this processing on Art. 6(1)(b) GDPR (section 3.2). We do not carry over data from older versions, because we do not store AI inputs.

Please update the app to the latest version.

15. Users in Switzerland and the United Kingdom

• Switzerland: the Swiss Federal Act on Data Protection (FADP) also applies. We base transfers to the USA on the Swiss-US Data Privacy Framework or on standard contractual clauses. You can also contact the Federal Data Protection and Information Commissioner (FDPIC).
• United Kingdom: the UK GDPR also applies. We base transfers to the USA on the UK extension to the Data Privacy Framework or on standard contractual clauses with the UK addendum. You can also lodge complaints with the Information Commissioner’s Office (ICO).

16. Changes to this privacy policy

We adapt this privacy policy when the app, our service providers or the legal situation change. We inform you about significant changes in the app. You can always find the current version at learny.page/en/privacy/ and in the app under Settings.

Last updated: 6 November 2026

---

Privacy at Learny – in short

Here is what Learny does with your data, in simple words. You can find the full privacy policy at learny.page/en/privacy/. If you don’t understand something, ask your parents or write to us.

Your cards belong to you

Your subjects, cards and learning progress stay on your phone, tablet or computer. If you allow it, Apple stores them in your iCloud or Google in your Google account, so you have them on your other devices too.

When Learny sends something over the internet

• When you use AI. The AI turns your text, photo or voice recording into flashcards, for example. For this, Learny sends exactly these things to Google. This only happens after you have tapped “Use AI”. Google does not use your things to train its AI.
• On some Apple devices the AI works directly on the device. Then everything stays with you.
• When Learny reads something aloud to you. The voice comes from a computer at Google. For this, the text is sent there.
• With the audio guide. Only if you allow it, Learny sends roughly where you are (accurate to about 100 metres).
• With reward videos. The videos come from YouTube. Only when you tap “Watch video on YouTube” does YouTube get data from your device, for example your internet address. If you are younger than 14 (in Germany younger than 16), ask your parents first.
• When you export a worksheet or a podcast. Learny writes into the file that it was made with AI and signs this digitally. For this, Learny only sends a kind of fingerprint of the file to our server, not the file itself.
• When you report something. If you think an AI answer is wrong or strange, you can report it in the Android app (on Apple devices by email). Then we receive the report.

So that all this works, Learny signs in with a random number. The number does not reveal who you are – we don’t know your name.

What Learny does not do

• no advertising
• no selling of data
• no following you across other apps or websites
• no chat with strangers

AI is not a person

In conversation mode you talk to an AI, not to a person. The AI can make mistakes. Check important things, for example before a test, with your exercise book, or ask your teacher.

Please don’t send

• photos of other people if they don’t agree
• private things such as illnesses, your address or passwords

You decide

• AI off: Settings → “Use AI features”. Then nothing goes to the AI. You can still learn.
• Videos off: Settings → “Show YouTube reward video”.
• Location, camera, microphone: you can allow or block them in your device’s settings.
• Delete data: in Learny’s settings you can delete your data on our servers (“Delete server data” or “Delete account and cloud data”).
• Subscription: all learning features are free. A subscription runs through Apple or Google; for children, the parents decide.

Questions?

You or your parents can write to us at any time: support@learny.page. Parents can also ask us to tell them which data we have, or to delete it.

Learny · Emanuel Schmacher e.U. · Sielach 76, 9133 Sittersdorf, Austria
Last updated: 5 November 2026