Privacy Policy

1Who we are

Learnea is a learning app. Its AI tutor is called Nea. The data controller is Lia Toumazi, a sole trader trading as Learnea, in the United Kingdom.

In this policy "we" and "us" mean Lia Toumazi trading as Learnea. For anything about your data, write to hello@learnea.app.

2What we collect

• Account: your email, first and last name and username. If you sign in with Google, GitHub or Apple, we receive your name and email from them.
• Password: we never store or log your password. Our sign in provider, Supabase, keeps only a hash of it.
• What you tell Learnea: your learning goal and what you say about what you already know, both in your own words.
• What you do in a quest: every answer you type or pick, your scores, mistakes, skill progress, test and exam answers, and your session history.
• What Learnea works out about you: your strengths, your struggles, how you seem to learn best, and a short written note after each session so Nea can pick up where you left off. This is written automatically and kept per subject.
• Documents you upload: the file name, the full text we extract from it, and that text split into sections.
• Anything you flag: if you report a mistake in the content, the item and your explanation.
• Your time zone: so streaks and lives run on your day and not ours. We do not collect GPS or any precise location.
• Subscription: your plan and whether it is active. Apple or Google takes the payment, so we never see your card or bank details.
• Product events: a record of milestones such as signing up, starting a trial, subscribing, cancelling, and reaching a paywall. These are tied to your account, not anonymous.
• Technical: your IP address and request logs, kept by our hosting provider for security. Error reports when something breaks.
• Waitlist: your email, if you join the waitlist on our website.

We do not collect your contacts or advertising identifiers, we do not track you across other apps or websites, and there is no advertising or analytics software in the app or on the website.

3Why we use it, and our lawful basis

Under UK GDPR we must tell you our reason in law for each use.

• To build your path, run your quests and track your progress, including what Learnea works out about you so the teaching fits you. Basis: performance of our contract with you.
• To check which plan you have, so you get what you paid for. Basis: performance of our contract with you.
• To email you about your account, such as reset codes and reminders about your plan and your streak. Basis: performance of our contract with you.
• To keep Learnea working and secure, including rate limits, error reports and fraud prevention. Basis: our legitimate interest in a service that is not abused or broken.
• To understand how Learnea is used through the product events above. Basis: our legitimate interest in knowing which parts of the product work.
• To check your answers and generate your content using AI. Basis: performance of our contract with you.
• To email the waitlist about early access, launch, and the odd update after it. Basis: your consent, given when you joined, withdrawn by the unsubscribe link in every one of those emails.
• To meet our legal obligations, such as tax records and answering a data request. Basis: legal obligation.

We do not sell your data, we do not show ads, and we do not use your data for marketing without your consent.

Everything listed under Account is needed to make an account, and we cannot provide Learnea without it.

4AI

Learnea uses Claude, made by Anthropic, to build your curriculum, run your quests and mark your answers.

What is sent to Anthropic: your goal, what you said you already know, your first name, your typed and chosen answers, your test and exam answers, the text of any document you upload, and what Learnea has worked out about you so far.

We use Anthropic's commercial API. Under its commercial terms, what we send is not used to train its models. See Anthropic's privacy policy.

5Who we share it with

Only the providers that run Learnea for us, each under a data processing agreement:

• Supabase: database and sign in
• Railway: servers for the app and for learnea.app
• Anthropic: AI
• Resend: email
• Sentry: error reports
• Apple and Google: payments
• Google, GitHub and Apple: only if you sign in with them

We will update this list before adding anyone new. We do not share your data with anyone else, and we never sell it.

If Lia Toumazi sets up a company to run Learnea, or Learnea is sold, your data moves with it and stays under this policy. We will tell you before that happens.

Some of these providers process data outside the UK, including in the United States, under the UK's approved safeguards for international transfers. You can ask us for a copy of those safeguards.

6How long we keep it

• Your account and everything tied to it: for as long as your account exists.
• Server and security logs: kept by our hosting provider for up to 30 days.
• Rate limiting records: held in memory for one hour, never written to disk.
• Backups: deleted data is removed from backups within 30 days.
• A waitlist email: until you unsubscribe or ask us to delete it. Unsubscribing deletes the row, it does not just flag it.

7What happens when you delete your account

Deleting your account removes, at once: your profile and personal details, your enrolments and goals, your progress, scores and mistakes, every quest and test session including every answer you typed, what Learnea worked out about you, anything you flagged, your product events, and your sign in itself. Copies in our backups go within 30 days.

Two things are not removed, and you should know before you delete.

• A document you uploaded that a reviewer approved as official course material stays, with the link to you cut, because other learners' courses are already built on it. One that was never approved is deleted in full. If you want an approved one taken out anyway, write to us and we will look at it.
• The curriculum built from your goal. Ask for a subject we do not have and Learnea builds it, and it stays for other learners. Its description repeats the goal you typed, in your words. It is never shown next to your name, but it does stay. So do not put anything private in your goal.

If you joined the waitlist with the same email, that is a separate list: use the unsubscribe link in the email, or write to us.

8Cookies and storage on your device

We do not use cookies at all, and there are no advertising or analytics cookies anywhere.

Our website, learnea.app, stores nothing on your device unless you say yes when Nea asks. If you say yes, your browser keeps a small note so Nea can recognise you next time: how many times you have visited, when you last came, whether you tried a practice question and how it went, and whether you joined the waitlist. It never leaves your browser, we never receive it, and it is not used to identify you or to follow you anywhere else.

If you say no, nothing is kept except that answer, so Nea does not ask again. Two things are kept either way: that answer, and a note that the opening animation has already played, which lasts until you close the tab. You can undo all of it with Make Nea forget at the bottom of the site, and clearing your browser data removes it too.

The app stores your sign in token, your user ID, your username and your first name in your device's secure keychain, so you stay signed in. Signing out or deleting the app removes them.

None of this is shared with anyone, and none of it is used to track you.

9Decisions made automatically

Learnea decides some things about your learning without a person involved: where a placement test starts you, when a skill counts as mastered, when a skill is sent back for review, and when a unit opens. These affect what you are shown next. They have no legal effect on you and nothing outside your learning turns on them.

If you think one of these is wrong, write to hello@learnea.app and a person will look at it.

10Your rights

Under UK GDPR you can ask us to:

• Give you a copy of your data. In the app: Profile, then Account, then Export my data. It covers everything listed in section 2 that is held against your account.
• Correct anything wrong.
• Delete your data. In the app: Profile, then Account, then Delete account. Read section 7 first. Without the app, see Delete your account.
• Move your data to another service, in a machine readable file. The export above is that file.
• Restrict what we do with your data while a question about it is open.
• Object to any use we base on legitimate interests.
• Withdraw consent at any time, where consent is the basis. Withdrawing it does not undo what we did before.

Write to hello@learnea.app. We reply within one month. There is no charge.

If you are unhappy with how we handled it, you can complain to the Information Commissioner's Office at ico.org.uk, or to the regulator where you live.

11How we protect it

Your connection is encrypted, and so is our database at rest. Sign in is handled by Supabase and passwords are stored only as a hash. Access to production data is limited to those who need it. Our error reporting is set not to collect personal data. No system is perfect: if a breach puts your rights at risk we will tell the Information Commissioner's Office within 72 hours and tell you without undue delay.

12Children

Learnea is for people aged 18 and over, and that includes the waitlist. We do not knowingly collect data from anyone younger. If you believe someone under 18 has made an account or joined the waitlist, write to hello@learnea.app and we will delete it.

13Changes

We will email you at least 14 days before any material change to this policy, and the date at the top always tells you when it last changed.