Privacy Policy
Last updated: 2026-10-27
Draft — not yet reviewed by a lawyer.
This policy explains what personal data Marlo processes, why, on what legal basis, who receives it and what rights you have under the EU General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG). We process as little data as possible and do not use advertising or analytics trackers.
1. Controller
Manolo Wrolich, Kinkstraße 2, 9020 Klagenfurt, Austria. E-mail: manolo@wrolich.com. We have not appointed a data protection officer because we are not required to.
2. What we process, why, and on which legal basis
| Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Account data: e-mail address, password (stored only as a salted hash), time and version of terms acceptance, sign-in timestamps, session information | Create and secure your account, sign you in, send confirmation and password-reset e-mails | Art. 6(1)(b) contract | Until you delete your account |
| Sign-in with Google (only if you choose it): e-mail address, name and profile identifier supplied by Google | Sign you in without a password | Art. 6(1)(b) contract | Until you delete your account |
| Your study content: courses, decks, chapters, questions and answers, notes, file names, and uploaded source files (private storage) | Provide the Service you asked for | Art. 6(1)(b) contract | Until you delete the item or your account |
| Study progress: answers given, resets, wrong-answer list, practice-exam runs, reports of faulty questions, a random device identifier created in your browser | Spaced repetition, resume exams, sync across devices | Art. 6(1)(b) contract | Until you reset or delete it, or delete your account |
| Settings: language and time zone | Show the Service in your language | Art. 6(1)(b) contract / Art. 6(1)(f) legitimate interest | Cookie 12 months; profile until account deletion |
| Monthly AI usage counter | Enforce fair-use limits and protect against abuse and cost overruns | Art. 6(1)(f) legitimate interest | Until you delete your account |
| Technical data: IP address, browser/device information, timestamps in server and security logs | Operate the Service securely, detect abuse, fix errors | Art. 6(1)(f) legitimate interest | Short log retention by our providers (typically days to a few weeks) |
| Text and title you choose to send for AI question creation | Create the draft questions you requested | Art. 6(1)(a) consent (you confirm before each use) | Not stored by us beyond your saved deck; the AI provider keeps abuse-monitoring logs for a limited time (see section 4) |
| Messages you send us by e-mail | Answer your request | Art. 6(1)(b) or (f) | As long as needed, then deleted |
You are not required to give us data, but without account data we cannot provide the Service. Without your consent, AI question creation is simply not used. We do not make decisions about you based solely on automated processing; AI only generates draft study content that you review.
3. What stays on your device
Text recognition (OCR) of photos and scanned pages, PDF/Word/PowerPoint reading and the optional "question style profile" run entirely in your browser. The OCR engine and language files are served by us, not by an external content network. Recognised text is cached in your browser tab (session storage) for up to 24 hours so you do not have to repeat the step; it is not uploaded unless you save a deck or use AI creation. The style profile contains only abstract question-form characteristics (length, style), no questions or answers, and is stored locally in your browser until you delete it.
4. Recipients and service providers (processors)
We use the following providers, who process data on our behalf under data processing agreements:
- Supabase, Inc. — database, sign-in, e-mail delivery for sign-in messages and file storage. Project region: Frankfurt, Germany (AWS eu-central-1).
- Vercel Inc., USA (Region Frankfurt) — hosting of the web application and delivery of web pages; technical connection data (e.g. IP address) is processed to deliver the pages.
- Google (only if you choose "Continue with Google") — Google operates the sign-in; Google's own privacy policy applies to its part of the process.
- OpenAI (only when you use AI question creation and confirm it) — receives the selected study text, the material title and, if enabled, abstract style characteristics, to generate draft questions. According to the provider's documentation, API data is not used to train its models by default and abuse-monitoring logs are kept for up to 30 days. Do not send text containing personal data of others or sensitive data.
We do not sell your data, do not share it for advertising, and do not use it to train AI models. Government authorities receive data only where legally required.
5. Transfers outside the EU/EEA
Some providers (especially OpenAI, Google and, depending on their infrastructure, Vercel Inc., USA (Region Frankfurt) and Supabase) may process data in the USA or other countries outside the EU/EEA. Where that happens we rely on the EU–US Data Privacy Framework where the recipient is certified, or otherwise on the EU Standard Contractual Clauses (Art. 46 GDPR) together with additional safeguards such as encryption in transit.
6. Cookies and local storage
We use only technically necessary cookies and browser storage that is required to provide the function you request. These do not need consent (§ 165(3) Telecommunications Act). We use no advertising, tracking or analytics cookies and no third-party fonts or scripts.
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
| sb-…-auth-token (cookie) | Necessary | Keeps you signed in | Session / until sign-out or token expiry |
| lang (cookie) | Functional, set when you pick a language | Remembers your language | 12 months |
| study-app-phase2:… and study-app-device-id-v1 (local storage) | Necessary | Stores your study state locally for offline use and synchronisation | Until you clear browser data or delete the deck |
| study-app:teacher-style:… (local storage) | Optional, only if you create a style profile | Stores the abstract question-style profile | Until you delete the profile |
| OCR text cache (session storage) | Necessary | Avoids repeating text recognition | Up to 24 hours / until the tab is closed |
7. How long we keep data
We keep data as long as you have an account. When you delete your account under Account, we immediately delete your profile, content, study progress, usage counter and uploaded files from our live systems. Copies in provider backups are overwritten in the providers' regular backup cycles. Technical logs are deleted by our providers after short periods. Where the law requires us to keep records (for example for bookkeeping if you buy a paid plan), we keep only those records for the legal period.
8. Your rights
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3)); this does not affect earlier processing. The easiest way is self-service: under Account you can download all your data as a machine-readable JSON file and delete your account. For anything else, e-mail manolo@wrolich.com.
You also have the right to lodge a complaint with a supervisory authority. In Austria this is the Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, www.dsb.gv.at. You may also complain to the authority in your own EU country.
If you live in California or another US state with a privacy law: we do not sell or share personal information for cross-context advertising, and we will honour the access, deletion and correction rights that apply to you; contact us at manolo@wrolich.com.
9. Security
Data is transmitted encrypted (HTTPS). Every user can access only their own rows (row-level security), and uploaded files sit in a private bucket that only you can read. Passwords are never stored in plain text. No system is perfectly secure; if a breach affects you we will notify you and the authority as the law requires.
10. Children
The Service is not intended for people under 16. If you believe a child has created an account, write to manolo@wrolich.com and we will delete it.
11. Changes
We update this policy when the Service or the law changes. The date at the top shows the current version; for material changes we will notify you in the app or by e-mail.