Privacy Policy
Revvy Learn · revvylearn.com Effective date: 6 October 2026
The short version
- We collect what we need to run your account, save your progress, take payments and mark your answers. We don't sell your data and we don't show ads.
- The AI tutor and AI marking send the text you write to Google's Gemini AI. They don't send your name, email or account ID.
- AI marks are practice guidance, not official grades.
- You can ask us for a copy of your data, or ask us to delete it, at any time: email arongijsel@gmail.com.
1. Who we are
Revvy Learn is run by Aron Gijsel, a sole trader based in Cyprus (Sokratous 6, 4730 Trimiklini, Cyprus). "We" and "us" in this policy mean Aron Gijsel. We are the controller of your personal data, which means we decide how it is used and we are responsible for it.
Questions about privacy: arongijsel@gmail.com. Our full business details are in the Legal notice.
2. What we collect, why, and our legal reason
The law (the EU General Data Protection Regulation, "GDPR") says we need a legal reason for everything we do with your data. We use three:
- Contract (GDPR Art. 6(1)(b)): needed to give you the service you signed up for.
- Legitimate interests (Art. 6(1)(f)): needed to keep Revvy Learn safe and working well, and we've checked this doesn't outweigh your privacy. You can object (section 7).
- Legal obligation (Art. 6(1)(c)): the law makes us keep it, like tax records.
Nothing we do relies on your consent. If that changes, we'll ask first.
| What | Why | Legal reason |
|---|---|---|
| Your account: email address and password (stored scrambled; we can never see it). If you use "Continue with Google": your name, email and profile picture link from Google. If you use "Continue with Microsoft": your name and email from your Microsoft account. If you use "Continue with Apple": your email (or the private relay address Apple gives you) and, the first time, your name. The date you joined. | To create your account, sign you in, and send account emails (your sign-in code, confirming your email, resetting your password). | Contract |
| Your reminder choices (only if you make them): which exam series you are sitting, and whether you want reminder emails. If you tick the box we also keep the date and time you ticked it, and the dates we sent each email. | To send the countdown and revision reminders you asked for, and nothing else. You can turn them off in Settings or with the link in every email. | Consent |
| Sign-in security records: when you signed in, your IP address and browser type for each session. | To keep accounts secure and spot misuse. | Legitimate interests |
| Your learning progress (only if you're signed in): sections opened and completed, how far you got, quiz scores and answers, flashcard and practice results, how sure you said you were, your review schedule, pre-test scores, and game scores. | To save your progress and show it on any device. | Contract |
| Results of AI-marked written answers: marks for each assessment objective, grade, word count, and the AI's comments and tips (which can quote a few words of your answer). We don't store the answer itself. | To show you your marks and your pattern across answers. | Contract |
| Payments: your plan, whether it's active, when it renews, and a Stripe customer number. Stripe collects your card details and billing country; we never see your full card number. | To take payments and give you Pro. | Contract; tax records by legal obligation |
| Feedback and problem reports: what you write, any rating, which question or page it's about, your answer if you were reporting a question, your plan, screen size, light or dark mode, browser type, time zone, and a scrambled version of your IP address that changes every day. | To fix mistakes in our content, improve Revvy Learn, and stop spam. | Legitimate interests |
| How the app is used: actions like opening a section, moving to the next step, finishing a topic, trying a calculation, or choosing a reason when you cancel (plus any comment you add). We record the page, time and time zone. If you're signed in, this is linked to your account; if not, it isn't linked to anything that lasts beyond your visit. | To find out which parts help students and which don't. | Legitimate interests |
| Page views and time on the site: which page you opened, how long you were actively using it (only while the page is open and you are doing something) and, inside a topic, which tab (for example Learn Mode or Notes), whether you're on a phone, tablet or computer, your country, and the site you came from. If you're signed in, this is linked to your account. If not, it's linked only to a scrambled code made from your IP address and browser that changes every day, so we can't follow you from one day to the next. Nothing is stored on your device. | To see how many students use Revvy Learn, which parts they use and for how long, so we can improve it. | Legitimate interests |
| Website statistics (Umami, no cookies): pages visited, the site you came from, browser, device type, screen size, language, and approximate location (country, region, city). | To count visitors and see which pages are useful. Umami doesn't give us anything that identifies you. | Legitimate interests |
| Technical logs: our hosting provider records requests to our servers, including IP addresses. | To keep the service running and secure. | Legitimate interests |
3. The AI features
Pro includes three AI features, powered by Google's Gemini AI:
- AI tutor: we send Google your messages in the current conversation, the tutor's earlier replies, and the name and a summary of the topic you're studying.
- "Explain it back" marking: we send the explanation you typed, plus the topic's key points from our notes.
- Written answer marking: we send the question, its mark scheme guidance and the answer you wrote.
We don't send your name, email address or account ID with any of these. But Google receives whatever you type, so please don't put personal details in your answers or tutor messages.
Google processes this text for us as our processor. Under its terms for the paid Gemini service, Google does not use it to train or improve its AI, and keeps it only for a limited time to detect misuse.
We don't store your tutor conversations on our servers. Your browser keeps the current conversation until you close the tab. For written answers we store the result (see section 2), not your answer.
AI marks are automated guidance, not official grades. They can be wrong, and no examiner, school or exam board sees or uses them. Nothing the AI does has a legal effect on you or affects you in a similarly significant way, so the GDPR rules on automated decisions (Art. 22) don't apply.
4. Who else handles your data
We use a small number of companies to run Revvy Learn. They may only use your data to provide their service to us.
| Company | What they do | Where the data is | How transfers outside the EU are protected |
|---|---|---|---|
| Supabase (Supabase Inc., USA) | Accounts, sign-in and our database | Our database is in Stockholm, Sweden | Standard Contractual Clauses (SCCs) |
| Vercel (Vercel Inc., USA) | Hosts the website and runs our server code | Pages come from servers near you; the code that handles your account runs in the EU (Stockholm, Sweden) | EU-US Data Privacy Framework (DPF) and SCCs |
| Stripe (Stripe Payments UK Ltd) | Payments | UK, EU and USA | UK adequacy decision; DPF and SCCs |
| Google (Gemini API) | The AI features | USA and other countries | DPF and SCCs |
| Resend (USA) | Sends account emails, and the reminder emails you opted into | Sent from Ireland | DPF and SCCs |
| Umami (Umami Software, Inc., USA) | Website statistics | EU (Frankfurt, Germany) | SCCs |
Two companies act on their own account, under their own privacy policies:
- Google, if you choose "Continue with Google". Google knows you signed in to Revvy Learn, and your profile picture is loaded from Google's servers.
- Stripe, for its own legal duties (for example fraud prevention and anti-money-laundering checks).
We share data with authorities only if the law requires it. We never sell personal data.
5. Cookies and browser storage
We don't use advertising or tracking cookies, so you won't see a cookie banner. We use:
| Name | Type | What it's for | How long |
|---|---|---|---|
sb-trweeckuswgkenckeqfb-auth-token (and a -code-verifier version during sign-in) | Cookie | Keeps you signed in | Until you sign out, at most 400 days |
__cf_bm | Cookie on supabase.co, set by Cloudflare for our login provider | Blocks bots | 30 minutes |
theme, sidebar-collapsed, rl:practice:… | Browser storage | Remembers your settings, like dark mode | Until you clear it |
revvy_…, flashcards-…, last-visited-…, visited-features, rl:attempt:… | Browser storage | Saves your progress, your place and your unsent drafts on this device, so Revvy Learn works without an account | Until you clear it |
tutor-chat-…, revvy_visit_started | Session storage | Keeps your current tutor conversation | Until you close the tab |
rv_door_… | Session storage | Remembers which topic you have opened in this tab, so we can offer a free account when you open a second one. Nothing is sent to us from it | Until you close the tab |
All of these are needed for the site or for a feature you chose to use. Stripe's payment page sets its own cookies under Stripe's policy.
On a shared computer, your progress and drafts stay in that browser's storage even after you sign out. You can remove them by clearing the site data in your browser settings.
6. How long we keep it
| Data | How long |
|---|---|
| Account, learning progress and AI marking results | Until you delete your account. We delete them within 30 days of your request. |
| Payment records | 6 years after the end of the tax year, because tax law requires it |
| App usage records, page views and time on the site | 180 days, then deleted. We keep only totals that can't identify anyone. |
| Feedback and problem reports | Until 12 months after we've dealt with them. The scrambled IP address is deleted after 30 days. |
| Website statistics | 24 months |
| Tutor conversations and "Explain it back" text | Not stored by us. Google keeps them for a limited time to detect misuse. |
| Server logs | A few days at most (set by our hosting provider) |
7. Your rights
You have the right to:
- See your data and get a copy (access).
- Correct it if it's wrong (rectification).
- Delete it (erasure).
- Take it with you in a common computer format (portability).
- Object to what we do based on legitimate interests. We'll stop unless we have a strong reason that outweighs yours.
- Ask us to pause using your data while we look into a problem (restriction).
How: email arongijsel@gmail.com from the email address on your account (so we know it's you). There isn't a "delete my account" button yet, so for now we handle deletion by email. We'll reply within one month. If your request is complicated we may take up to two months more, and we'll tell you why. It's free.
Deleting your account doesn't cancel an active subscription by itself: cancel it first in Settings.
8. Children and young people
Most of our users are 15 to 18. You must be at least 14 to create an account. (For comparison, Cyprus law lets young people agree to online services on their own from age 14: Law 125(I)/2018, section 8.)
If you're under 18, you need a parent's or guardian's permission before you buy Pro.
If we learn that someone younger than 14 has an account, we'll close it, delete their data and refund any payment. Parents or guardians who think this has happened can email arongijsel@gmail.com.
9. Keeping your data safe
Connections are encrypted, passwords are stored scrambled, and only the founder can see account records and feedback, only to run the service. If a data breach puts you at risk, we'll tell you as the law requires.
10. Complaints
If you're unhappy with how we handle your data, please email us first so we can put it right. You can also complain to the Office of the Commissioner for Personal Data Protection in Cyprus: gov.cy/dataprotection, commissioner@dataprotection.gov.cy, +357 22 818 456. If you live in another EU country, you can complain to the data protection authority there instead.
11. Changes to this policy
If we change this policy, we'll update the date at the top. If a change matters (say, a new company handling your data), we'll tell you by email or in the app first.