Controller and contact
Catalearn is operated from Andorra. The operator controls the personal data described in this notice. The legal controller name and postal address are still being confirmed. For any privacy request, contact privacy@catalearn.app.
Who the service is for
Catalearn is an invite-only learning beta. You can apply with an email address, and only approved accounts can sign in. We do not collect a date of birth or verify age. The operator has not yet confirmed a policy for users under 16. A parent or guardian must contact us before a person under 16 applies or uses the service.
Data we collect
- Your beta application email address.
- Account data, such as your name, email address, profile image URL, sign-in provider, and account and session identifiers.
- Learning data, such as submitted answers, attempts, lesson progress, reviews, rewards, goals, language, time zone, and reminder settings.
- Notification data, such as an installation identifier and an Apple Push Notification service device token, when you enable notifications.
- Service log data, such as request time, route, status, and network address. We filter sensitive fields from normal application logs.
- Usage analytics, such as app lifecycle, screens, app-use events, landing page views, and waiting-list form events. The iOS app also sends automatic crash error reports. Signed-in app analytics uses your learner ID. New PostHog events do not include your email, name, username, or ordinary app logs. Landing-page events do not include the email address that you enter.
The iOS app stores downloaded course files, drafts, and unsent answers in private, account-bound app storage for offline use.
Purposes and legal bases
- We use beta application and account data to consider your request, give approved access, authenticate you, and provide Catalearn. The basis is taking steps at your request and performing the service agreement.
- We use learning, offline, and notification data to provide the features that you request. The basis is performing the service agreement.
- We use limited service logs to secure, diagnose, and operate the service. The basis is our legitimate interest in a reliable and secure service.
- We use iOS product analytics and crash error reports to improve the beta and fix faults. The basis is our legitimate interest in a reliable and useful service. You can object by contacting us. We use website analytics only with your consent. You can refuse or withdraw website consent without losing a waiting-list application.
Recipients and service providers
Google and Apple process sign-in data. Apple processes TestFlight invitations, beta usage and crash data, device tokens, and notification delivery. Apple states in its TestFlight privacy information that beta usage and crash collection cannot be disabled. This Apple collection is separate from Catalearn's PostHog analytics. Resend sends beta application emails for us. PostHog processes product analytics and iOS crash error reports for us. Hosting, database, and network providers process data that is needed to run and protect the service. Apple and Google can also process data for their own purposes under their notices.
Some providers can process data outside Andorra. The configured PostHog service uses a United States endpoint. Resend and Cloudflare publish data-processing terms that include transfer safeguards. The operator has not yet verified the executed provider agreements and all current processing locations, so we do not claim that every transfer safeguard is complete.
No ads or data sales
Catalearn has no advertising SDK. We do not sell personal data.
Retention and security
- Beta applications remain until they are processed or deleted.
- Account and learning data remain while the account is active and are deleted through the account deletion process, subject to the limits below.
- Website analytics consent records remain until the browser choice is replaced.
- Existing PostHog records are outside the current account-deletion process. The PostHog retention period has not yet been confirmed.
- Precise service-log and backup periods are still being confirmed. Backups are not changed in place. If a backup is restored, the deletion process must run again before production use.
Production connections use HTTPS. Access to the learning service is restricted to approved accounts.
Analytics choices and objections
The iOS beta sends product analytics and crash error reports by default. To object to this use, contact us at privacy@catalearn.app. The website sends analytics only after you allow it. You can change the website choice from the page footer. Withdrawal stops new website PostHog collection. It does not remove historical PostHog records.
Account deletion
Account deletion removes the Catalearn account, learning records, linked identities, sessions, notification registrations, offline authorizations, and matching first-party waiting-list records. The app also removes account data stored on that device. The operator must separately remove matching static access-list entries and relevant copies in TestFlight, Resend, notification mailboxes, and operator-controlled logs. Provider, legal, security, and backup limits can prevent immediate removal of every copy. PostHog records are not removed by this process.
Your rights
You can ask for access, correction, deletion, restriction, objection, or a portable copy when the right applies. You can also withdraw website analytics consent at any time. Send a request to privacy@catalearn.app. We can ask for information that is needed to verify your identity. We will respond without undue delay and normally within one month.
You can complain to the Andorran Data Protection Agency. The APDA can be contacted at apda@apda.ad or +376 808 115.