Privacy policy

1. Information and purposes

Signing in and protecting your account

You can sign in with a phone number and SMS code, an email address and emailed code, or Sign in with Apple. Firebase Authentication associates your sign-in details with an account identifier. With Apple sign-in, this can include the name and email address Apple shares, including a private relay address if you choose Hide My Email. A supplied display name is used to personalise your profile.

For emailed codes, we process your email address, a hashed verification code, expiry time, and request and attempt counters to deliver codes, verify access and limit abuse. The email delivery service receives your address and the message containing your code. Never send a verification code to support.

Learning and personalisation

We save information linked to your account: lesson completion, quiz scores and attempt counts, activity and completion times, XP, level, streaks, badges, daily goals, hearts and their refill state, and your placement starting point. This lets the app restore progress, show achievements, manage learning limits and choose where you continue. Existing profiles may also retain an avatar link and language, currency, sound or notification preferences from earlier app versions. Placement results and onboarding state are also stored on your device; the starting point is saved to your account when applied.

Reminders and device storage

If you enable reminders, iOS schedules local notifications on your device. Reminder preferences, your chosen time or a time based on your learning activity are stored locally. The account records whether the reminder prompt was shown. You can change reminders in the app or your device’s notification settings. The app and its Firebase libraries also keep sign-in state and cached data on your device so they can operate across launches.

Subscriptions

Apple processes purchases. The app reads verified subscription information, such as the product, expiry date and revocation status, to enable Plus and display your plan. We do not receive your full payment card details from Apple. Apple’s purchase and account records are governed by its own policies.

Technical information and support

Our service providers process technical information, including IP addresses and user-agent information, to handle requests, authenticate users and prevent abuse. App and server error logs can contain technical details and account identifiers needed to investigate failures. If you email support, we receive your email address, message and any attachments you choose to send.

The website

Website lesson previews run in your browser. Their quiz selections and calculator inputs are not saved to your app account. Hosting services process connection information when delivering pages and assets. Following a link to Apple or another external service takes you to that service’s own privacy practices.

2. Service providers and disclosure

• Google Firebase and Google Cloud: account authentication, cloud profile and progress storage, and server functions for email sign-in. Google explains the associated technical data and retention in its Firebase privacy information.
• Phone verification: Google receives and stores phone numbers used for sign-in for spam and abuse prevention across Google services, as explained in its phone authentication documentation.
• Brevo: delivery of emailed sign-in codes. Brevo processes the recipient address, message and delivery information. See Brevo’s privacy policy.
• Amazon Web Services: Amazon S3 and CloudFront host and deliver this website’s pages and assets.
• Apple: Sign in with Apple, App Store payments and subscription management, and device notification permissions. See Apple’s privacy information.

These providers may process information outside your country. Their privacy and data-processing terms describe their international operations and protections. The app’s email sign-in server functions run in the United States.

Information may also be disclosed when required by law or needed to investigate abuse, enforce our terms or protect people and the service. This policy does not authorise unrelated advertising uses of your learning records.

3. Retention and account deletion

Account and learning records are kept to support your account and continued learning until you delete them. Signing out or uninstalling the app does not delete cloud records.

To delete your account, open Profile and choose Delete account. You may need to sign in again; Apple-linked accounts require a fresh Apple confirmation. A successful deletion removes your cloud profile, lesson progress, badges, any legacy quest records, and your Firebase sign-in account. This cannot be undone. If the app reports a failure, follow its instructions to retry or contact us, because deletion may be incomplete.

The app also attempts to disconnect Sign in with Apple. If that step fails after deletion, the app tells you how to remove the connection in your Apple Account settings.

Deleting your account does not cancel your Apple subscription. Cancel separately in your device’s Settings, under your Apple Account and Subscriptions. Deletion does not remove purchase records held by Apple.

Email codes expire after 10 minutes and the code record is removed when successfully used. Unused code and rate-limit records are scheduled for cleanup after 24 hours from the last send; the database’s automatic cleanup can occur later. Expiry prevents using an old code even while cleanup is pending.

Deleting an account does not immediately remove every provider log, backup or support email. These records have separate retention processes. For example, Google describes how Firebase authentication data is removed from live and backup systems in its retention information. Contact us to request removal of support correspondence or ask about records outside the in-app deletion flow.

4. Your choices and rights

You choose a sign-in method and whether to enable reminders. Account information and progress are needed to provide the signed-in learning service. Support information is used to answer your request, and security information is used to protect accounts and operate the service.

Where applicable data-protection law requires a legal basis, we process information to provide the service you request, for legitimate interests in maintaining and securing it and responding to support, to meet legal obligations, or with consent where required. You can withdraw optional permissions through your device settings.

Depending on your location and applicable law, you may have rights to access, correct, delete or receive a copy of your personal information, restrict or object to processing, or withdraw consent. Email app@knooty.com to make a request. We may need to verify that the account is yours before acting. The app does not currently provide a self-service data export. You may also complain to your local data-protection authority.

5. Younger learners

The current app uses individual learner accounts. It does not provide the parent dashboard, parent-created child accounts or verified parental consent flow described in the archived policies. The app does not ask for a date of birth. An App Store age rating describes content suitability; it is not verification of age or parental consent.

If you are a parent or guardian with questions about a child’s account or want to request access or deletion, contact app@knooty.com. Please identify the sign-in method and your request without sending verification codes or unnecessary information about the child.

6. Security and updates

We use authenticated account access and database rules intended to restrict learners to their own records. No online service can guarantee absolute security. Keep access to your email, phone and Apple Account secure.

We will publish revisions on this page with an updated date. Any additional notice or consent required by applicable law will be handled for the relevant change. For questions, email app@knooty.com.