Privacy Policy

Last updated: 30 September 2026

Your privacy matters to us. This Privacy Policy explains what information Repeat & Learn ("Repeat & Learn", "we", "us", or "our") collects, why we collect it, how we use and share it, and the choices and rights you have. We try to collect only what we genuinely need to run the service, to be transparent about it, and to keep it secure.

1. Who we are and what this policy covers

Repeat & Learn is a spaced-repetition learning application that helps you store knowledge items ("cards"), schedule reviews, optionally deliver them through Telegram, Discord, or the Repeat & Learn Cards app, and optionally process them with AI features.

The service is operated by Vadym Kustov, a sole proprietor (Kleinunternehmer) established in Germany, who is the data controller for the personal data described here. This policy applies to the Repeat & Learn web application at https://repeatandlearn.com, our APIs, our Telegram and Discord bot integrations, the Repeat & Learn Cards app, and any future mobile apps.

The controller's contact details are:

Vadym Kustov
c/o Impressumservice Dein-Impressum
Stettiner Str. 41
35410 Hungen
Germany

Phone: +49 156 798 216 28
Email: hello@repeatandlearn.com

The same details are published in our Impressum.

2. Information we collect

Information you provide directly:

• Account data — your email address, a username, and (unless you sign in only with Google) a password, which we store only as a salted hash, never in plain text.
• Profile and preferences — your interface language, timezone, quiet-hours settings, and similar app preferences.
• Your content — the knowledge items / cards you create, their categories, folders, file types, notes, and the scheduled tasks you configure. Your card content is encrypted at rest in our database.
• Photos you attach to cards — if you add a photo to a card, we store that photo, encrypted in the same way as the card's text (Section 4 says where). Before uploading it, our app redraws the photo, which removes the extra information your camera writes into the file, such as the place where it was taken. Photos are shown only to you, in the app and in the delivery channels you connected.
• Support messages — if you contact us through the in-app support form, we store the message and your email so we can reply.
• Product survey answers — from time to time we ask you a few short questions about the product and for a star rating. The questions cover how easy the product is to use, whether it changed how you spend time in other apps, and how it compares with a repetition app you may have used before; each person is shown only one of them. Answering is entirely optional, and you can close the survey. We store what you answered, which question you were shown and which delivery channel it named, the free-text comment if you wrote one, the rating, your interface language, and whether you ticked the box allowing us to show your answer publicly. We use the answers to decide what to build next and, in aggregate and anonymous form, to describe the product on our website. We publish an individual answer word-for-word only if you ticked that box; aggregated figures contain no personal data. See Section 5 for how long we keep them.
• AI chat conversations and your ratings of them — your messages in the "Discover" AI chat and the replies you receive are stored in your account, encrypted at rest, so the conversation is still there when you come back. If you rate a reply with 👍 or 👎, we also store that rating and any reason or comment you add to it.
• Messages you write to Brainy, and Turbo lessons — Brainy, our AI tutor, answers the messages you write to our Discord bot in a direct message, to your Telegram bot, and in the "Brainy" chat of the Repeat & Learn Cards app. Those messages are received and stored so that Brainy can answer them, together with Brainy's reply. Both are encrypted at rest. When you take a Turbo lesson (a short lesson Brainy builds from the cards of one topic), we store the lesson — the questions, the cards it uses and your answers — encrypted at rest as well, plus open bookkeeping: which topic, when it started and ended, how many steps you completed, and whether it was started by you or offered by Brainy. We never read messages you post anywhere else in Discord — the bot only receives direct messages sent to it. In Telegram, the bot only sees the chat with the bot itself.

Information collected automatically:

• Authentication tokens — when you log in, we set httpOnly session cookies (rl_access_token, rl_refresh_token) so you stay signed in. Your browser also stores a small non-sensitive session hint in local storage.

• Operational records — basic timestamps such as account creation, last login, and when cards are scheduled or shown, used to run the spaced-repetition logic.

• Study activity — when you open the app and when you answer a card, together with the hour of day in your own timezone, which delivery channel you answered in, and how long the card had been waiting. We use this to show you your study statistics, to know which day counts towards your streak, and to send study reminders at the time you normally study (see Section 3). These records are about when you studied, not what you studied, and they are kept for a limited period (see Section 5).

• Delivery-channel identifiers — if you connect a delivery channel, we store what is needed to reach you there: your Telegram chat identifier, your Discord user and direct-message identifiers, or, for the Repeat & Learn Cards app, the push subscription your browser issues for each device you enable notifications on.

• Where you came from — if you arrive through a link we posted on a social network, that link carries a short label identifying the post (for example li-20260825-spacedrepetition). Your browser keeps that label in local storage for up to 90 days, and if you then create an account we store it with your account so we can tell which of our posts brought people here. The label identifies our post, not you: it contains no information about you, is never shared with anyone, and is deleted from your browser as soon as you register. If you arrive any other way, no label is stored at all.

• Page views — we count page views on our website using Cloudflare Web Analytics: both the public pages anyone can open (the landing page, the pricing page, the support and legal pages) and, once you are signed in, the pages of the app itself. For each view it records the address of the page, the website or app that linked you to it, your approximate country, and the type of browser and device you used. A page address never contains your content — our addresses name a section, for example /knowledge-base, never an individual card, and the part of an address after ? is not recorded at all. It sets no cookies and stores nothing in your browser; your IP address is used only in passing to work out the country and is not kept. It cannot identify you, it cannot be linked to your account, and it does not follow you across other websites.

• Your approximate country — when you open the landing page, the pricing page or the checkout, our server looks up which country your IP address belongs to. We use the country only to show the prices and currency that apply in your region, to pre-fill the country on the checkout form (you can change it there — the price you pay is based on the country you confirm), and to decide which messaging apps the landing page mentions. The lookup runs on our own server against an offline database, so your IP address is not sent to anyone for it, and neither the IP address nor the country is stored or linked to your account; your browser keeps the country only until you close the tab. If the country cannot be determined, we use the time zone set on your device instead. Legal basis: our legitimate interest in showing you the prices that actually apply to you (Art. 6(1)(f) GDPR). The database is DB-IP Lite (see Third-party notices).

• Advertising measurement (Meta Pixel) — we advertise on Instagram and Facebook and measure those ads with Meta Pixel, a small script from Meta. What happens when you open our website depends on where you are; we tell that from the time zone set on your device, and if it does not tell us, we treat you as being in Europe. In the European Union, the European Economic Area, the United Kingdom and Switzerland, a banner asks whether we may use cookies to see which of our ads work, and until you click "Allow", Meta Pixel is not loaded at all: nothing is sent to Meta and no Meta cookie is set, and if you click "Decline" it stays that way. Everywhere else, Meta Pixel is switched on when you open our website, without asking first; you can switch it off at any time with the "Cookie settings" link at the bottom of the page, and from then on nothing more is sent and its cookies are deleted. While Meta Pixel is on, your browser tells Meta when you view one of our public pages (the landing page, pricing, the support and legal pages, sign-in, sign-up and checkout — never a page inside the app), when you create an account, when you start a free trial, when you open the checkout and when you pay, together with the plan and the amount, and which sections of the landing page you scrolled to (how it works, channels, speed, statistics and pricing). Meta also receives what every such request carries: your IP address, your browser and device type, the address of the page, and a browser identifier kept in the _fbp cookie (and, if you came from one of our ads, the _fbc cookie identifying that ad click). If you have an Instagram or Facebook account, Meta can link this to it. We never send your email address, your name, or anything you write in the app. We use it to see which of our ads bring people who actually sign up, to let Meta show our ads to people likely to find the app useful, and to show our ads again to people who have already visited our website. Wherever you are, you can change your choice at any time with the "Cookie settings" link at the bottom of the page (see Section 9).

• Your device and screen size — when you open the app we note, for your account, whether you are using an Android phone, an iPhone, an iPad or a computer, the name of the operating system (for example "Windows"), and your screen width as a range (for example "up to 1920 pixels") — never the exact size. We keep a single record per account and overwrite it each time, and we use it only to know which screens and phones the product has to work well on. It is not combined with anything else and cannot be used to recognise your device elsewhere.

• Connection attempts — when you start connecting a way to receive your cards (installing the Repeat & Learn Cards app, connecting Telegram or connecting Discord), we record that you started, at most once per day per channel. We store only which channel it was and on which day — nothing about the attempt itself. We use it to see how many people get stuck halfway and to fix what stops them. These records are deleted together with your study activity (see Section 5).

Apart from that page count and Meta Pixel (see above), we do not use any other advertising network or tracking pixel, session recording, cross-site profiling, or any service that builds a profile of you. We do not sell your personal data.

Information from third parties:

• Google Sign-In (optional) — if you choose to sign in with Google, Google sends us your basic account identifier to create or link your account. We do not receive your Google password.
• Payment providers — if you purchase a subscription, our payment providers send us your subscription status and the provider-side identifiers needed to manage it (see Section 4).

3. How and why we use information

We use the information we collect to:

• provide the core service — store your cards, schedule and deliver reviews, and run AI features you request;
• authenticate you and keep your account secure;
• process payments, manage subscriptions, and count how much of your plan's allowances you have used;
• send you essential service emails (email verification, password reset, support replies);
• send study reminders — if you have not reviewed anything during the day, we send a single message to one of your connected delivery channels, at the hour you normally study. The message may name your current streak and one or two cards that are due, so you know what is at stake. It is never sent more than once a day, it respects your quiet hours, it stops after a month of inactivity, and you can turn it off in your profile at any time. We do not use email for these reminders;
• tell you when a batch of cards is left unfinished — cards arrive in batches, and the next batch is only sent once the current one has been answered. If you answer part of a batch and then stop, we send one message to that same chat about six hours later, saying how many cards you have answered and how many are still waiting. It is sent at most once per batch, it respects your quiet hours, it never shows the content of a card, and the same profile switch that turns study reminders off turns it off as well;
• offer you a Turbo lesson — in Discord, Telegram and the Cards app, on some days the study reminder is replaced by an offer of a short lesson on one of your topics (for example, one you have not reviewed for a while), and if you have not studied for three days Brainy may send a single quiz question from your main topic. These messages use the same daily slot, quiet hours and profile switch as study reminders, so you never get more than one a day;
• answer the messages you write to Brainy (our Discord bot, your Telegram bot, the "Brainy" chat in the Cards app) — Brainy runs your Turbo lesson, checks your answers, and replies to other questions you send it;
• respond to your support requests;
• understand what to improve, from the product survey answers you choose to give us;
• improve the quality of AI replies — when you rate a reply in the "Discover" chat, that exchange becomes visible to us: a person on our side reads the question, the reply, and any comment you added, together with the email address of the account it came from. This applies only to conversations you have rated — 👍 as well as 👎. Conversations you never rate are not opened by us; they stay encrypted in your account and are only ever shown back to you;
• detect, prevent, and address abuse, fraud, or technical problems;
• comply with legal obligations.

Legal bases (GDPR). We are established in Germany, so the EU General Data Protection Regulation applies to our processing. We rely on: performance of a contract (to provide the service you signed up for), legitimate interests (to secure the service, prevent abuse, and measure in aggregate how our public pages are used), consent (where required, e.g. optional integrations and AI features, and Meta Pixel for visitors in the EU, the EEA, the United Kingdom and Switzerland — there together with § 25(1) of the German TDDDG, because it stores and reads a cookie on your device), and legal obligation (e.g. tax records for payments). For Meta Pixel outside those regions we rely on our legitimate interest in measuring and improving our advertising (Art. 6(1)(f) GDPR; for visitors in Brazil, Art. 7(IX) LGPD); you can object at any time with the "Cookie settings" link at the bottom of the page (Art. 21 GDPR).

4. Who we share information with (sub-processors)

We do not sell your data. We share data only with service providers that help us operate Repeat & Learn, and only as needed. These are:

About Meta Pixel. For collecting these events on our website and passing them to Meta for ad targeting and delivery, we and Meta Platforms Ireland Ltd (Block J, Serpentine Avenue, Dublin 4, Ireland) are joint controllers (Art. 26 GDPR). In our agreement with Meta (Meta's "Controller Addendum") we have agreed that we are responsible for informing you about this joint processing — which is what this section does — and that Meta Ireland is responsible for your rights of access, rectification, erasure, restriction and portability (Art. 15–20 GDPR) for the data Meta holds after receiving it; you can exercise them directly with Meta, and if you contact us instead we pass your request on to Meta. For the campaign reports and statistics it prepares for us, Meta acts as our processor. What Meta does with the data after receiving it — for example linking it to your Instagram or Facebook account and using it for its own advertising — is Meta's own responsibility and is described in Meta's Privacy Policy at facebook.com/privacy/policy. Independently of our banner, you can limit ads based on activity on other websites in your Instagram or Facebook ad preferences and at youronlinechoices.eu.

About push notifications. Notifications for the Repeat & Learn Cards app are relayed by the push service your browser vendor operates. The notification itself carries no card content — only a short prompt telling you that something is waiting. The cards themselves are fetched from our servers by the app after you open it, over an authenticated connection.

About AI features. AI features are optional: they run only when you start them, and only on the text you hand to them. What leaves our systems depends on the feature:

• "Concise" and "Smart fill" for vocabulary decks send the text of the card, or the words and lines you pasted, to the AI provider currently configured for that feature — Google (Gemini), OpenAI, or Lyceum. Translations of individual words are cached on our servers, so the same word is not sent twice. "Concise", "Quizify", the "Discover" chat and Brainy's replies additionally pass your text through OpenAI's moderation service before generating anything.
• "Quizify" (AI quizzes) sends the text of the card, or the terms you typed, together with any instructions you added, to the AI provider currently configured for that feature — Google (Gemini), OpenAI, or Lyceum. The same provider then checks the finished quiz in a second request, which receives only the question, the answer options and the card's text.
• "Discover" AI chat sends your question, the text of any cards you attach to it, and the recent messages of that conversation to a web-search provider (Perplexity) and to the provider that runs the model writing the answer (Google Gemini at the time of writing). Your Discover conversations are stored in your account, encrypted at rest.
• Turbo lessons and Brainy (in Discord, Telegram and the Cards app) send the text of the cards of the topic you (or Brainy's offer) chose, and the answers you write during the lesson, to the provider currently configured for these features (Google Gemini at the time of writing), which writes the questions and checks your answers. When you write to Brainy outside a lesson, your message and the recent messages of that conversation are sent the same way, without web search. This conversation stays where you had it: it is not added to your "Discover" chat on the website.

Which provider serves a given AI feature can change; whenever it does, the table above and Section 8 are updated with it, so they always describe the provider actually in use.

We never send your email, your password, or cards you did not choose to process. Photos attached to cards are never sent to any AI provider — AI features work only with text.

Your content is not used to train AI models. We do not train our own models on it, and we do not allow our AI providers to train theirs on it. We reach every one of these services through its paid business API, where the provider's terms exclude using customer content to train or improve their models — that is a deliberate choice on our part, because the free tiers of some of these services reserve exactly that right. You can simply not use AI features if you prefer your content never leaves our systems for this purpose.

We may also disclose information if required by law, to enforce our Terms, to protect the rights and safety of users or the public, or in connection with a merger, acquisition, or sale of assets (in which case we will notify you).

5. How long we keep information

We keep your account data and content for as long as your account is active. Verification and password-reset tokens are short-lived and expire automatically. Detailed study-activity records (Section 2) are deleted automatically after 90 days; the day-level record of which days you studied is kept for as long as your account exists, because your streak is counted from it. When you delete your account, we delete your personal data and content, except where we must retain certain records (for example, payment/tax records) to comply with the law. A photo attached to a card is deleted about 7 days after you delete the card — the delay lets the deletion reach all your devices and gives you time to undo it. A photo you remove or replace in a card, or upload without saving the card, is deleted within a day. All your photos are deleted when you delete your account. The messages you write to Brainy (in Discord, Telegram and the Cards app), and Brainy's replies to them, are deleted automatically 7 days after they arrive. A Turbo lesson record is kept for as long as your account exists and is deleted with it. Product survey answers are deleted automatically after 24 months. The label recording which post you arrived from (Section 2) is kept for as long as your account exists and is deleted with it; in your browser it expires after 90 days or as soon as you create an account, whichever comes first. Your answer in the cookie banner is kept in your browser for 12 months, after which we ask again. Because we must be able to prove that consent was given (Art. 7(1) GDPR), we also keep a receipt of each answer on our server: a random receipt number that your browser keeps next to your choice, the choice itself, which version and language of the banner you saw, and the time — no IP address and no link to your account. These receipts are kept for 4 years (the 12 months a consent lasts plus the 3-year limitation period) and then deleted automatically; the legal basis is our legal obligation to demonstrate consent (Art. 6(1)(c) GDPR). The _fbp cookie of Meta Pixel expires after 90 days, and if you decline or switch Meta Pixel off we delete it from your browser; Meta keeps the events it has received for up to two years.

6. Security

We protect your data with measures including encryption in transit (HTTPS), encryption at rest for your card content, the photos attached to your cards and other sensitive fields, hashed passwords, signed session tokens, and signature verification on payment webhooks. No method of storage or transmission is 100% secure, but we work to protect your information and review our practices.

7. Your choices and rights

You can:

• Access and update your account information and preferences in the app.
• Export or request a copy of your data by contacting us.
• Delete your account and data at any time using the in-app "Delete account" feature, which removes your personal data and content (subject to the legal-retention exceptions above).
• Choose not to use optional features (Telegram, Discord, or Cards delivery, AI features, Google Sign-In), and disconnect any delivery channel at any time in the app.
• Turn off study reminders and unfinished-batch messages in your profile — one switch covers both — and set quiet hours during which we send you nothing at all.
• Switch Meta Pixel on or off, wherever you are, at any time with the "Cookie settings" link at the bottom of the page. Switching it off does not affect what was sent before.

You have the rights to access, correct, delete, restrict, or port your data, to object to certain processing, and to withdraw consent where processing is based on it. You also have the right to lodge a complaint with a data-protection supervisory authority — either in the EU country where you live or, since we are established in Germany, with the authority competent for us. To exercise any of these rights, contact us (see Section 11). We will not discriminate against you for exercising your rights.

Our competent supervisory authority (zuständige Aufsichtsbehörde) is:

Sächsische Datenschutz- und Transparenzbeauftragte
Devrientstraße 5
01067 Dresden
Germany

Phone: +49 351 85471 101
Email: saechsdsb@slt.sachsen.de
Website: www.datenschutz.sachsen.de

8. International data transfers

We and our service providers may process your data in countries other than yours. Your account and the text of your cards stay in the EU: our application servers run in Frankfurt, Germany, and our database is hosted in Ireland. Photos you attach to cards are the exception: they are stored by Cloudflare, Inc. (USA) in its R2 storage, which we have not restricted to the EU, so they may be stored in the United States. Each photo is encrypted on our servers before it is sent there, and the key never leaves us. Supabase and Fly.io are US-incorporated companies, so remote administrative access from outside the EU cannot be ruled out; that is covered by the safeguards below. Some of the providers listed in Section 4 are located outside the EU — in the United States (for example OpenAI, Perplexity, Google, Cloudflare, Meta). This includes the text you hand to an AI feature: at the time of writing, the answers in the "Discover" chat, in "Concise", in "Quizify", in Turbo lessons and Brainy's replies are written in the United States. Where a transfer outside the EU does take place, we rely on appropriate safeguards (such as the European Commission's Standard Contractual Clauses; for Meta Platforms, Inc., also its certification under the EU–U.S. Data Privacy Framework). You can request a copy of these safeguards from us — see Section 11. If you do not want your text processed outside the EU, do not use the AI features — every other part of the service works without them.

9. Cookies

We use a small number of strictly necessary cookies to keep you signed in and operate the service (our authentication session cookies). Because these cookies are essential to provide the service, the app may not function correctly without them.

Advertising cookies. Meta Pixel sets the _fbp cookie (a random identifier of your browser) and, if you arrived through one of our ads, the _fbc cookie (the identifier of that ad click). In the EU, the EEA, the United Kingdom and Switzerland they are set only after you click "Allow" in our cookie banner; elsewhere they are set from your first visit (see Section 2). If you decline, or later switch Meta Pixel off with the "Cookie settings" link at the bottom of the page, we delete both. We use no other advertising or third-party tracking cookies.

Besides those cookies, our own website stores a few small values in your browser's local storage: your interface preferences, a non-sensitive session hint, your answer in the cookie banner, and — only if you arrived through one of our social-media posts — the label of that post (Section 2). None of these are shared with third parties and none are used to build a profile of you or to follow you across other websites.

The visit count described in Section 2 needs no cookie and no consent: it neither stores anything on your device nor reads anything from it, which is precisely why we were able to choose it over the usual analytics products.

10. Children

Repeat & Learn is not directed to children under the age of 13 (or the minimum age required in your country), and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact us and we will delete it.

11. How to reach us

For privacy questions or to exercise your rights, contact us at hello@repeatandlearn.com or by phone at +49 156 798 216 28. You can also reach us through the in-app support form, or write to:

Vadym Kustov
c/o Impressumservice Dein-Impressum
Stettiner Str. 41
35410 Hungen
Germany

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you in the app or by email.

This Privacy Policy is adapted from Automattic's legalmattic templates and is made available under the Creative Commons Attribution-ShareAlike 4.0 International license.