Privacy Policy

We collect the following categories of personal data:

1. Account data. When you register, we (via Firebase Authentication) collect your email address and password (stored in hashed form by Firebase, not by us), or, if you sign in with Google, your name, email address, and profile picture as provided by Google.
2. Usage and progress data. Quiz results, answered and missed questions, study streaks, daily activity statistics, and other progress data you generate while using the Service, stored against your account in our database (Firestore).
3. Payment and subscription data. If you purchase a Subscription, our payment processor (Stripe) and subscription management provider (RevenueCat) process your payment details (such as card information) and billing information on our behalf. We do not receive or store your full card number. We do receive transaction metadata (such as plan purchased, amount, and subscription status) needed to grant you access to the Service.
4. Content you submit. Reviews, ratings, question reports, and account-deletion feedback you choose to submit through the Service.
5. Server log data. Whenever you access the Service, our hosting infrastructure (Firebase App Hosting / Google Cloud) automatically records technical data such as your IP address, browser type, operating system, referring page, and date and time of access. This data is used solely to operate, secure, and troubleshoot the Service and is not combined with other data sources.
6. Analytics data. If you consent to analytics cookies, we collect usage data through Google Analytics (GA4), such as pages visited, general device and browser information, and approximate location derived from your IP address. See Section 4 (Cookies and analytics).

We only process personal data where we have a valid legal basis under Article 6 GDPR. We use personal data for the following purposes:

1. to create and manage your account and authenticate you (legal basis: performance of a contract, Art. 6(1)(b) GDPR);
2. to provide the Service, including tracking your quiz progress, streaks, and study statistics across sessions (Art. 6(1)(b) GDPR);
3. to process payments, manage your Subscription, and grant or revoke access to paid content accordingly (Art. 6(1)(b) GDPR);
4. to respond to question reports, reviews, and support requests you submit (Art. 6(1)(b) GDPR; and Art. 6(1)(f) GDPR, legitimate interest in maintaining content quality);
5. to detect and prevent abuse of the Service, including the prohibited uses described in our Terms of Use (Art. 6(1)(f) GDPR, legitimate interest);
6. to understand aggregate usage of the Service and improve it, where you have given analytics cookie consent (Art. 6(1)(a) GDPR, consent); and
7. to comply with legal obligations, such as accounting and tax requirements relating to payments (Art. 6(1)(c) GDPR, legal obligation); and
8. to operate, secure, and troubleshoot the Service using server log data (Art. 6(1)(f) GDPR, legitimate interest in a functioning and secure Service).

Providing account data (email address, password or Google login) is a requirement to create an account and use the Service; without it, we cannot provide you with access. Providing payment data is required only if you choose to purchase a Subscription. All other data (e.g. reviews, question reports, analytics) is provided voluntarily.

We do not carry out automated decision-making or profiling within the meaning of Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you.

We do not sell your personal data. We share personal data with the following categories of recipients, each acting as a processor on our behalf or, where noted, as an independent controller of data you provide directly to them:

1. Firebase / Google Cloud (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; ultimate parent Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) — authentication and database hosting (Firestore) for account and progress data. Firebase acts as a processor on our behalf under a data processing agreement; see Firebase’s Privacy and Security in Firebase and Google’s Privacy Policy.
2. Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland; ultimate parent Stripe, Inc., 354 Oyster Point Blvd, South San Francisco, CA 94080, USA) — payment processing. Stripe acts as an independent controller for the payment data it collects directly from you at checkout; see Stripe’s Privacy Policy.
3. RevenueCat (RevenueCat, Inc., 2261 Market Street #5666, San Francisco, CA 94114, USA) — subscription and entitlement management, i.e. determining which paid content your account may access. RevenueCat acts as a processor on our behalf; see RevenueCat’s Privacy Policy.
4. Google Analytics (GA4) (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; ultimate parent Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) — usage analytics, only if you have granted analytics cookie consent; see Google’s Privacy Policy and Google Analytics data safeguards. You can also opt out of Google Analytics for all websites using the Google Analytics opt-out browser add-on.
5. Law enforcement, regulators, or other third parties where required by law, to enforce our Terms of Use, or to protect the rights, property, or safety of the Provider, our users, or others.

We use a strictly necessary cookie/local storage entry to remember your cookie consent choice, and, where you consent, Google Analytics cookies to measure usage of the Service. Analytics cookies are off by default (Google Consent Mode “denied”) and are only activated after you click “Accept” on the cookie banner. You can withdraw consent at any time by clearing your browser’s local storage for this site or, where available, via the cookie banner settings.

Firebase Authentication also stores a session token in your browser’s local storage so that you stay logged in between visits. This is strictly necessary for the Service to function and is not an analytics or advertising cookie.

Google (Firebase, Google Analytics) and Stripe may process personal data on servers located outside Norway and the European Economic Area, including in the United States. Where this occurs, these providers rely on recognized transfer safeguards, such as the European Commission’s Standard Contractual Clauses, to protect your personal data.

We retain account and progress data for as long as your account is active. If you delete your account through the Service (Account settings → Delete account), we delete your progress data, missed questions, and Firebase Authentication account. We may retain limited records (such as anonymized account-deletion feedback or transaction records required for accounting and tax purposes) for a longer period where required by law.

Subject to the conditions set out in applicable data protection law (including the GDPR as implemented in Norway through the Personal Data Act / personopplysningsloven), you have the right to:

1. access the personal data we hold about you;
2. request correction of inaccurate personal data;
3. request erasure of your personal data, including via the self-service “Delete account” feature in your account settings;
4. request restriction of, or object to, certain processing;
5. request a portable copy of your personal data; and
6. withdraw consent at any time (e.g. for analytics cookies), without affecting the lawfulness of processing carried out before the withdrawal.

To exercise these rights, contact us at the email address in Section 10.

You have the right to lodge a complaint with a data protection supervisory authority. As the Provider is established in Finland, the lead authority is:

Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto)
PL 800, Ratapihantie 9, 00521 Helsinki, Finland
tietosuoja.fi

You may also lodge a complaint with the supervisory authority of your own country of residence, for example the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no) for users resident in Norway. A full list of EU/EEA supervisory authorities is available at edpb.europa.eu.

The Service is intended for users aged 16 or older, consistent with our Terms of Use. We do not knowingly collect personal data from children under this age. If you believe a child has provided us with personal data without appropriate consent, please contact us so we can delete it.

Questions about this Privacy Policy, or requests to exercise your data protection rights, can be sent to fi.studio.auralis@gmail.com. We may update this Policy from time to time; material changes will be reflected by updating the “Last updated” date above.