Privacy Policy

This page describes how we process and protect your personal data in accordance with applicable law, including the GDPR.

1. Data controller

Data controller: Tobias Heneman Contact: henematobik213@gmail.com (e-mail, subject "Privacy Policy") or write to us

2. What data we process

2.1 Data you provide to us

• User account (registration by e-mail or sign-in with Google): e-mail address, display name, password hash (we do not store the password itself), and, when signing in with Google, your Google ID and profile picture URL, as well as the time the account was created and last sign-in.
• Study data: bookmarks, notes, read posts including scroll progress, answer history for individual questions, credit balance and credit transaction history.
• AI chat: the full history of conversations and messages, which is stored on our server and linked to your account.
• Feedback form: name, e-mail address, message text and the platform from which you send the message.

2.2 Data processed automatically

• Device identifier: a persistent device identifier (tobiso-device-id) is stored in your browser and also in our database. We use it to attribute anonymous use of AI features and difficulty votes on posts. It is not anonymous data.
• IP address: we use it to limit the rate of requests to AI features (abuse protection) and as a fallback identifier for difficulty votes on posts when no device identifier is available.
• Google Analytics: traffic measurement, which runs only with your consent in the cookie banner (see section 4).
• Android app: the app uses no cookies and no telemetry. To send notifications, we store a device token (Firebase Cloud Messaging), the device name, and the time of registration and last use. This data is not linked to a user account and is used only to send notifications.

3. Purposes and legal bases

We do not use your data for automated decision-making or for profiling with legal effects.

4. Cookies and LocalStorage

• Cookie banner: on your first visit you can choose whether to allow analytics cookies. You can change or withdraw your consent at any time.
• Analytics cookies (Google Analytics): set only after you give consent. Without consent, no traffic measurement takes place.
• Technical cookie: when you sign in with Google, a temporary technical cookie is stored for 10 minutes; sign-in cannot be completed without it.
• LocalStorage is used for the following technical purposes:
  • sign-in token (JWT),
  • device identifier (tobiso-device-id),
  • appearance setting (theme),
  • your choice in the cookie banner,
  • Pomodoro timer state,
  • your difficulty votes on posts.

The sign-in token and the device identifier are personal data; the other items do not in themselves contain personal data.

• The Android app does not use cookies or telemetry.

5. Recipients of data and third-party services

We do not sell your data. To run the website we use the following third-party services:

• Google Analytics (Google LLC) – traffic measurement, only with consent (Consent Mode v2). Google Privacy Policy
• Google OAuth (Google LLC) – optional sign-in with a Google account; when you sign in, we exchange with Google the data needed for authentication (e-mail, name, Google ID, profile picture).
• Google Fonts (Google LLC) – loading of fonts (Baloo 2, Figtree). When a page loads, the visitor's IP address is passed to Google.
• jsDelivr CDN – loading of libraries (Lucide, KaTeX). When a page loads, the visitor's IP address is passed to the CDN operator.
• Firebase Cloud Messaging (Google LLC) – delivery of notifications to the Android app.
• OpenAI, LLC (1455 Market Street, San Francisco, CA 94103, USA) – provider of artificial intelligence features (GPT-4o model), see section 6.
• MonsterASP.NET s.r.o. (company ID 21693421, commercial register) – provider of web and database hosting, including daily backups. The servers are located in the European Economic Area.

Some of these providers are based in the USA or may process data outside the EEA. The transfer is secured by standard contractual clauses or by a European Commission adequacy decision (EU–US Data Privacy Framework) where the provider is certified.

Website administrators have access to account data (for example, the user overview in the administration), only to the extent necessary to run the service, support users and deal with abuse.

6. Data processing through AI

• The website uses the services of OpenAI, LLC (GPT-4o model) for artificial intelligence features.
• Queries and inputs entered into AI features, including the content of posts attached to a conversation, are sent to OpenAI for processing.
• In addition, AI conversation history is stored on our server and, for signed-in users, linked to their account. Anonymous use is recorded by device identifier.
• OpenAI may process the data in accordance with its own privacy policy: OpenAI Privacy Policy.
• Data may be transferred to the USA on the basis of standard contractual clauses.
• Please do not enter personal data into AI features (neither your own nor anyone else's).

7. Retention periods

• User account and study data (including bookmarks, notes, progress, credits and AI conversations): for as long as the account exists. When an account is deleted, its data is deleted immediately, without undue delay. The database is backed up daily by the hosting provider and the last 10 backups are kept. Deleted data may therefore remain in backups for up to 10 days until overwritten. Backups are used only for recovery after an outage.
• AI conversations: until the user deletes the conversation or the account.
• Feedback: no automatic deletion takes place; the administrator deletes it manually, and without undue delay on your request.
• Device identifier, records of anonymous AI use and difficulty votes on posts: no automatic deletion takes place; the records are kept for as long as the service operates. On your request we can delete them if you tell us your device identifier.
• IP address: counters used to limit the rate of requests to AI features are held only in server memory and disappear when the server restarts. If the browser does not send a device identifier when voting on post difficulty, the IP address is stored in its place and kept in the same way as a device identifier. We do not store IP addresses in server logs.
• Server logs: used for security and troubleshooting. They record usernames (for users, usually the e-mail address) at sign-in and token issuance, the administrator's username at administration authentication, and error records, which may contain technical details of the request. Logs are kept for 30 days.
• Device tokens for notifications (Android): until the app is uninstalled, or until Firebase Cloud Messaging marks the token as invalid and it is therefore deleted. Tokens are not linked to a user account, so signing out or deleting the account does not remove them.
• Google Analytics: event data for 2 months, user data for 14 months.

8. Your rights

Under the GDPR you have the right to:

• request information about processing and access to your personal data,
• rectification of inaccurate data,
• erasure of data,
• restriction of processing,
• data portability – on request we will provide your data in a structured, machine-readable format,
• object to processing based on legitimate interest,
• withdraw consent (for example, to analytics cookies) at any time, without affecting the lawfulness of processing before withdrawal,
• lodge a complaint with a supervisory authority: Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, www.uoou.gov.cz.

How to exercise your rights: you can delete your account yourself at any time in your profile using the "Smazat můj účet" (Delete my account) button. Send other requests (access, export, rectification, etc.) to the e-mail address in section 1. We will reply within 30 days at the latest.

9. Children and minors

The service is also intended for primary school pupils. Under the Czech Personal Data Processing Act (Section 7 of Act No. 110ㅤ/2019 Coll.), children under 15 can give consent to the processing of personal data in connection with an offer of information society services only with the consent of their legal guardian. If you are under 15, please ask a parent or legal guardian for consent before creating an account. A legal guardian may ask for access to the child's data or for deletion of the child's account at the e-mail address in section 1.

10. Security

Passwords are stored only as a hash. Communication with the website is encrypted (HTTPS). Only authorised persons have access to personal data.

11. Final provisions

This privacy policy is effective from 9 October 2026 and may be updated from time to time. We will inform you of material changes on the website.