Privacy Policy

3.1 Account and Profile Data

When you create an account, we collect:

User ID (UUID, automatically generated), email address, display name, profile picture URL (where provided via Google Sign-In), account creation date, and last update date. Your password, if set, is stored exclusively as a cryptographic hash and is never stored or transmitted in plain text.

3.2 Authentication Data

Depending on your chosen sign-in method, we process:

(a) Email/password: Email address and password hash via Supabase Auth.
(b) Google Sign-In: Email address, display name, Google Account ID, and profile picture URL, received from Google via OAuth 2.0.
(c) Apple Sign-In (iOS only): Apple ID and email address (which may be masked by Apple). Apple Auth tokens are stored encrypted solely for mandatory token revocation upon account deletion, as required by Apple App Store Guidelines since June 2022.
(d) Anonymous session: A temporary UUID is assigned to your device session. No email or personal identifier is collected. If you subsequently register an account, your anonymous session data is merged with your new account.

3.3 Biometric Data

If you enable biometric login (Face ID or fingerprint recognition), authentication is performed exclusively by your device's secure hardware and operating system. Biometric data never leaves your device and is never transmitted to or stored by LEGACY Network AG.

3.4 User-Uploaded Content

When you upload documents (PDF, Word, images, audio files, video files) to the Service, we:

(a) Store the original document in encrypted Supabase Storage, accessible only to you;
(b) Extract the text content server-side;
(c) Transmit the extracted text to our AI processing providers to generate your learning paths, modules, lessons, and quiz questions;
(d) Store the generated learning content and your learning progress in your account database.

Uploaded documents and their extracted content are accessible only to you. We do not share the content of your documents with other users. We do not use your document content for AI model training.

3.5 Learning and Gamification Data

In connection with your use of the learning features, we collect total XP points earned, current and longest streak (days), last active date, subscription status and trial end date, learning paths created in the current month, lesson and module completion data, quiz scores, and achievement and badge data.

3.6 Subscription and Payment Data

We collect subscription management data including: subscription plan type (weekly, monthly, or annual), subscription status (free trial, free, or premium), subscription start and end dates, auto-renewal status, first purchase date, remaining complimentary months, and referral code data.

We do not collect or store any payment data, including credit card numbers or other financial account details. All payment processing is conducted by Apple (iOS) or Google (Android). We receive confirmation of subscription status via RevenueCat.

3.7 Usage and Analytics Data

We collect pseudonymised usage data through Mixpanel to understand how users interact with the Service. This includes:

(a) User properties: pseudonymised User ID, subscription status, app language, colour scheme, total XP, streak data, number of learning paths created, completed modules, lessons, learning minutes, badge count, group count, referral count, device type, app version, days since registration, and A/B test variant assignments.
(b) Event data: structured analytics events covering authentication actions, onboarding steps, document uploads, learning path generation, lesson and quiz activity, gamification events, group activity, subscription events, settings changes, notification interactions, and screen views.

Document content and quiz answers are never transmitted to analytics services. Only structured metrics (counts, durations, types) are collected.

3.8 Device and Technical Data

We collect certain technical information necessary for the operation and security of the Service, including: device type and model, operating system version, app version, app instance ID (via Firebase), and crash reports and stack traces (via Sentry, only in the event of application errors).

3.9 Local Device Data

Certain data is stored locally on your device and is not transmitted to our servers: app preference settings, a temporary learning cache for offline performance, and local push notification scheduling data.