Privacy Policy

Effective date: May 25, 2026 Version: 1.0

This Privacy Policy explains how RepeatFlow processes personal data when you use the RepeatFlow mobile application for iOS and Android, the RepeatFlow website, and related account, synchronization, subscription, support, export, and deletion features (together, the “Service”).

RepeatFlow is a learning and review-planning app. It helps users organize learning materials, notes, links, flashcards, review schedules, reminders, and progress records. To provide these features, RepeatFlow uses account login, cloud synchronization, local device storage, subscription verification, analytics and diagnostics consent controls, data export, and deletion functions.

This Privacy Policy should be read together with our Terms of Service:

https://repeatflow.app/terms

The English version of this Privacy Policy is the primary version. Translations may be provided for convenience. If a translation conflicts with the English version, the English version controls.

1. Who controls your personal data

The controller of your personal data is:

Pilip Hulko Poland Website: https://repeatflow.app Privacy contact: [email protected] Support contact: [email protected]

RepeatFlow does not publicly list a postal address in this Privacy Policy. Privacy requests can be sent to [email protected]. If a postal address or additional contact detail is legally required for a specific request, we will provide the appropriate contact information through an appropriate channel.

RepeatFlow may later be operated by a sole proprietorship, registered business, company, or other legal entity. If this happens, this Privacy Policy may be updated and users will be notified where required by law.

If you are in the European Economic Area, you may lodge a complaint with your local data protection authority. In Poland, the supervisory authority is the Prezes Urzędu Ochrony Danych Osobowych (UODO).

2. Age requirements

RepeatFlow is not intended for children under 16 years of age.

If we learn that we have collected personal data from a child under 16 without appropriate consent where such consent is required, we will delete that data or take other appropriate action.

RepeatFlow is a general learning and productivity service. It is not directed to children and is not intended to be listed or used as a children’s app.

3. Summary of how RepeatFlow handles data

RepeatFlow:

• uses email OTP login and does not collect passwords;
• stores user-created learning data needed to provide the Service;
• stores data locally on your device and synchronizes account data with the backend when available;
• uses Apple App Store and Google Play for subscriptions;
• does not store or process payment card data directly;
• uses local notifications for reminders and does not currently use remote push notifications;
• uses Firebase Analytics and Firebase Crashlytics only after you give consent in the app;
• does not use third-party advertising;
• does not sell personal data;
• does not use personal data to track users across third-party apps or websites for advertising or data broker purposes;
• provides JSON export;
• provides account deletion and learning data deletion options.

4. Data we process

We process only the data reasonably needed to provide, secure, maintain, improve, and support RepeatFlow.

4.1 Account and authentication data

RepeatFlow uses email-based one-time password (“OTP”) login. We do not collect or store passwords.

We may process:

• email address;
• account ID;
• OTP challenge metadata;
• OTP code hashes;
• OTP attempt counts and resend timestamps;
• session IDs;
• access tokens;
• refresh token hashes;
• device ID;
• account device records;
• last seen and sync revision metadata;
• email change records where needed for account security and integrity.

OTP codes are valid for a short time, currently 10 minutes, and are stored only as hashes.

Access tokens are short-lived, currently 15 minutes by backend default.

Refresh tokens are stored server-side only as hashes and currently expire after 30 days by backend default.

Server-side session records may remain until expiry, revocation, account deletion, or routine cleanup.

4.2 User-created learning data

RepeatFlow stores learning data that you create or manage in the app, including:

• Subjects or learning areas;
• Repeat Plans;
• Repeat Plan steps;
• Materials;
• Material titles;
• links to websites, documents, Notion pages, or other external resources;
• text notes;
• flashcards or cards;
• Material versions;
• review calendar and review schedule;
• completed review points;
• overdue and current review state;
• Daily Limit settings;
• planner settings;
• Recovery and rescheduling state;
• learning progress and related metadata.

RepeatFlow does not currently support uploading PDFs, files, or images to RepeatFlow servers. You may save links to external PDFs, files, websites, Notion pages, or other resources as part of your Materials.

You control what you enter into Materials, notes, links, and cards. RepeatFlow is not designed to collect special categories of personal data, such as health data, biometric data, political opinions, religious beliefs, or precise location. Please do not store unnecessary sensitive personal data or special category data in RepeatFlow.

RepeatFlow does not currently provide public profiles, public feeds, or built-in public sharing links that make your RepeatFlow learning data publicly accessible. Your learning content is private to your account unless you export it, copy it, take screenshots, record it, or share it outside the app using device or third-party tools.

4.3 Settings, sync, and service metadata

We may process app and account settings, including:

• app language;
• first day of week;
• date format;
• global notification settings;
• Subject-level notification settings;
• notification time;
• analytics and diagnostics consent status.

We may also process sync and service metadata, including:

• device ID;
• sync revisions and checkpoints;
• pending and synced mutation metadata;
• conflict or error sync status;
• entity sync state;
• outbox metadata;
• data epoch and cache reset metadata.

4.4 Local device data

RepeatFlow stores data locally in a SQLite database on your device. Local storage is used to support offline use, improve performance, and allow synchronization when the device reconnects to the backend.

Local data may include account-related cache, learning data, app settings, pending offline changes, and sync metadata.

Local device data remains on your device until you delete it, delete learning data, delete the account, sign out or clear local data where supported, uninstall the app, or the operating system removes app data.

Uninstalling the app may delete local device data depending on the operating system, but it does not automatically delete server account data.

4.5 Subscription and purchase status data

If you purchase a paid subscription, payment is handled by Apple App Store or Google Play.

RepeatFlow does not store or process payment card data directly.

To verify purchases, restore subscriptions, prevent fraud, resolve billing issues, and maintain subscription access, RepeatFlow may process:

• purchase platform: Apple or Google;
• product ID;
• external subscription ID;
• purchase token;
• transaction ID;
• original transaction ID;
• subscription status;
• current period end;
• last verification time;
• entitlement or plan status;
• raw provider response or event JSON where needed for verification, audit, debugging, chargebacks, fraud prevention, or legal/accounting obligations.

RepeatFlow may send purchase identifiers, such as purchase tokens, transaction IDs, original transaction IDs, product IDs, and platform information, to Apple App Store Server API or Google Play Developer API to verify purchases, restore subscriptions, and maintain entitlement status.

4.6 Notifications

RepeatFlow may provide review reminders and daily summary reminders.

In the current configuration, reminders are local notifications generated on your device. RepeatFlow does not currently use remote push notifications and does not store server-side push notification tokens.

Notifications are optional. You can enable or disable global notifications and configure Subject-level notification settings in the app. The app may request operating-system notification permission before scheduling reminders.

4.7 Analytics

RepeatFlow uses Firebase Analytics only after you give analytics consent in the app.

Analytics is used to understand app usage, improve onboarding, improve product flows, understand feature usage, and identify where users encounter problems. Analytics is not used for advertising, third-party advertising profiles, or tracking users across third-party apps or websites.

Analytics events may include:

• app opens;
• onboarding progress;
• screen or feature usage;
• subscription screen views;
• export, delete, and privacy settings usage;
• sync or error diagnostic events;
• general product usage events.

Analytics events are designed not to include the contents of your learning Materials, notes, links, card fronts, card backs, or personal learning content.

You can change analytics consent in the app settings. If you withdraw analytics consent, RepeatFlow stops future optional analytics collection where technically possible. Previously collected analytics may be retained in aggregated or de-identified form, or deleted where required and technically available.

4.8 Crash diagnostics

RepeatFlow uses Firebase Crashlytics only after you give diagnostics consent in the app.

Crash diagnostics are used for app stability, crash diagnostics, bug fixing, security, and service reliability. Crash diagnostics may include:

• crash reports;
• non-fatal error reports;
• stack traces;
• app version;
• device model;
• operating system version;
• crash time;
• diagnostic logs.

Crash reports are designed not to intentionally include learning content, notes, links, cards, or Materials.

You can change diagnostics consent in the app settings. If you withdraw diagnostics consent, RepeatFlow stops future optional Crashlytics collection where technically possible.

4.9 Backend logs, security, and abuse prevention

RepeatFlow may process technical logs and security data, including:

• IP address;
• request metadata;
• method, path, status, duration, and remote address for server requests;
• app version;
• device and operating system information;
• session metadata;
• sync status;
• error and job logs;
• OTP attempt counts;
• rate-limiting metadata;
• billing and subscription verification logs.

Logs are used for service reliability, security, abuse prevention, fraud prevention, rate limiting, incident investigation, and debugging. Logs are designed not to intentionally contain learning content.

Backend logs and security logs are separate from optional Firebase Analytics and Firebase Crashlytics. They may be processed without analytics or diagnostics consent where necessary for security, fraud prevention, abuse prevention, legal compliance, service reliability, or operation of the Service.

4.10 Support data

When you contact support, we may process:

• your email address;
• message content;
• attachments you voluntarily provide, such as screenshots;
• account identifiers;
• diagnostic information;
• follow-up communication.

Support does not routinely access your learning content. Access may occur only where needed to handle your request, investigate a technical or security issue, comply with law, or protect the Service, and should be limited to what is necessary.

4.11 Website data and cookie-free analytics

The RepeatFlow website is used for public pages such as support, privacy, terms, and account deletion. It is not the full app.

The website does not currently use non-essential cookies.

RepeatFlow may use privacy-friendly, cookie-free website analytics, such as Cloudflare Web Analytics, configured without cross-site tracking, to understand basic website usage and performance. This may include aggregate page views, referrers, device/browser information, approximate region, and similar technical website signals.

If RepeatFlow later adds non-essential cookies, cross-site tracking, advertising pixels, session replay, or similar technologies, we will update this Privacy Policy and provide consent controls where required.

RepeatFlow does not currently respond to browser “Do Not Track” signals. You can control cookies and similar technologies through your browser settings where website features use them.

4.12 Approximate location

RepeatFlow does not request GPS or precise location permission and does not collect precise device location.

Approximate location may be inferred from IP address in server logs, security logs, or website analytics for security, abuse prevention, service reliability, aggregate analytics, and legal compliance.

5. Why we process data and legal bases

Where GDPR or similar privacy laws apply, we rely on the following legal bases.

Our legitimate interests include keeping RepeatFlow secure, preventing abuse, maintaining service reliability, debugging technical issues, protecting users, enforcing our Terms, and defending legal claims. We rely on legitimate interests only where we believe our interests are not overridden by your rights and freedoms.

6. No ads, no sale of personal data, no cross-app tracking

RepeatFlow does not sell personal data.

RepeatFlow does not use third-party advertising.

RepeatFlow does not share personal data for third-party advertising.

RepeatFlow does not use personal data to track users across third-party apps or websites for advertising or data broker purposes.

RepeatFlow does not use advertising identifiers for advertising.

RepeatFlow does not create third-party advertising profiles.

Product personalization inside RepeatFlow, such as review schedules, Daily Limit, reminders, planner behavior, and Recovery, is based on your learning data, review progress, preferences, and settings. This is used only to provide and personalize the Service, not for third-party advertising.

7. Local storage, offline use, and synchronization

RepeatFlow uses local storage so that supported learning and settings actions can be used offline.

When your device has a network connection and you are signed in, local data syncs with the RepeatFlow backend. If you use RepeatFlow on multiple devices or offline, local states may temporarily differ.

For synchronized account data, the backend/server is the source of truth.

Normal sync conflicts are resolved by entity or operation. The server version may win for the conflicting entity or operation. Related stale pending operations may be marked as conflict_dropped or superseded, and unrelated pending offline changes are intended to be kept where technically possible. A normal conflict does not wipe the whole local database.

In exceptional cases, for example after “delete all learning data” changes the server data epoch, the app may reset the local learning cache and pull a fresh server state.

RepeatFlow does not guarantee that all offline changes will always be preserved in every conflict scenario. You are encouraged to export important data periodically.

Uninstalling the app may delete local device data depending on the operating system, but it does not automatically delete server account data. To delete server data, use in-app account deletion, the account deletion page, delete learning data, or contact privacy support.

8. Export

RepeatFlow provides data export in JSON format.

The primary export is a server/account export when you are signed in and online. Before export, the app should try to synchronize pending local changes. The server export represents the account data stored by RepeatFlow.

The app may also provide a local device export generated from the on-device SQLite database. A local export may include unsynced local changes, but may not include newer data from other devices or server-only data.

Export is intended to remain available to Basic users and downgraded users, subject to technical availability, account access, and abuse-prevention controls.

Server export files are generated on request, delivered to you, and are not stored long-term by RepeatFlow.

9. Account deletion and learning data deletion

9.1 Account deletion

You can request account deletion:

• in the app, if you are signed in;
• through the account deletion page: https://repeatflow.app/delete-account;
• by contacting [email protected], where necessary.

Account deletion requires email OTP confirmation.

After confirmation, RepeatFlow deletes your account and associated learning data from the production database as soon as possible and no later than 30 days where technical processing is required.

Account deletion removes or disables, where applicable:

• account profile;
• email/account profile data;
• sessions and devices;
• app settings;
• Subjects;
• Repeat Plans created by you;
• Materials;
• Material versions;
• links;
• notes;
• flashcards/cards;
• reviews and review progress;
• sync data, checkpoints, outbox, and server change log;
• local app data after sign-out or reset where applicable;
• subscription entitlement links where legally and technically allowed.

Some records may be retained where required or justified for legal, billing, security, anti-abuse, audit, dispute-resolution, chargeback, fraud-prevention, or compliance reasons.

After account deletion, limited audit or security records may be retained, including email address and deletion timestamp, where needed to prevent abuse, comply with legal obligations, resolve disputes, or prove that deletion was completed.

Deleting your RepeatFlow account does not necessarily cancel your Apple App Store or Google Play subscription. You should manage and cancel your subscription separately through the relevant app store subscription settings.

9.2 Delete all learning data

RepeatFlow may provide a separate “delete all learning data” function. This deletes learning data while keeping your account and subscription status active.

“Delete all learning data” removes:

• Subjects;
• custom Repeat Plans;
• Materials;
• Material versions;
• links;
• notes;
• flashcards/cards;
• reviews and review progress;
• learning sync history and checkpoints.

It keeps:

• account;
• email;
• sessions and devices;
• app settings where applicable;
• subscription and entitlement status;
• billing, legal, security, and audit records where required.

10. Retention periods

We keep personal data only for as long as necessary for the purposes described in this Privacy Policy, unless a longer period is required or permitted by law.

Typical retention periods are:

Where analytics or crash diagnostics are linked to a user or device and deletion is technically available, RepeatFlow will delete or anonymize them upon a valid deletion request unless retention is required by law, security reasons, or legitimate legal obligations.

11. Who we share data with

RepeatFlow does not sell personal data and does not share personal data for third-party advertising.

We share data only where necessary to operate, secure, maintain, improve, support, or legally protect the Service.

11.1 Service providers and processors

We may use the following providers and categories of providers:

• Amazon Web Services (AWS): backend hosting, server infrastructure, PostgreSQL database hosting, logs, monitoring, backups, and OTP email delivery through Amazon SES;
• Amazon SES: delivery of OTP codes and service-related emails;
• Cloudflare: DNS management, website hosting/delivery, CDN, traffic routing, performance, security protection, and cookie-free website analytics where configured;
• Apple App Store / StoreKit / App Store Server API: in-app purchases, subscriptions, transaction identifiers, purchase status, and server-side subscription verification;
• Google Play Billing / Google Play Developer API: in-app purchases, subscriptions, purchase tokens, purchase status, and server-side subscription verification;
• Google Firebase Analytics: optional product analytics, used only after analytics consent;
• Google Firebase Crashlytics: optional crash diagnostics, used only after diagnostics consent;
• local on-device technologies: SQLite for local storage and Flutter local notifications for local reminders.

RepeatFlow may also use internal infrastructure components such as caches, queues, metrics databases, log storage, monitoring dashboards, and alerting tools to operate, secure, debug, and monitor the Service. These tools may process technical logs, metrics, request metadata, device/session identifiers, IP addresses, and operational diagnostics. They are not intended to process user learning content, except where such content appears incidentally in logs or support/debugging data.

11.2 Legal, security, and business disclosures

We may disclose data where required by law, court order, valid legal process, or lawful request from public authorities.

We may also disclose data where reasonably necessary to:

• protect the rights, privacy, safety, or security of RepeatFlow, users, or others;
• prevent abuse, fraud, or security incidents;
• enforce our Terms of Service;
• resolve disputes;
• handle chargebacks or billing issues;
• complete a merger, acquisition, financing, reorganization, sale of assets, or similar business transaction, subject to appropriate safeguards and notice where required by law.

12. International data transfers

Your data may be processed in countries other than your country of residence, including the European Economic Area, the United States, and other countries where RepeatFlow or its service providers operate.

RepeatFlow does not promise EU-only hosting unless separately stated.

Where personal data is transferred outside the EEA to a country that is not recognized as providing an adequate level of protection, we rely on appropriate safeguards where required, such as adequacy decisions, Standard Contractual Clauses, equivalent transfer mechanisms, and supplementary measures where appropriate.

13. App permissions

RepeatFlow may request or use the following permissions:

• Internet/network access: used for account login, synchronization, subscription verification, and backend communication;
• Notifications permission: used for optional local review or daily summary reminders;
• Files/storage/share access: used only when you export JSON data or choose a file/share destination.

RepeatFlow does not request camera, microphone, contacts, photos, health, GPS, or precise location permissions in the current version.

14. Service emails and communications

RepeatFlow sends service-related emails, including:

• OTP codes;
• account and security messages;
• deletion confirmations;
• important service notices.

You cannot opt out of emails that are necessary to provide, secure, or administer the Service.

RepeatFlow does not currently send marketing emails.

15. External links

Your Materials may contain links to external websites, documents, Notion pages, or other services. If you open such a link, the external website or service will process data under its own privacy policy and terms. RepeatFlow is not responsible for the privacy practices, content, availability, or security of external websites or services.

16. AI-assisted diagnostics

RepeatFlow does not use third-party AI or LLM services to process your learning content, notes, flashcards, Materials, links, or review data.

RepeatFlow may use AI-assisted tools to analyze technical logs and error reports for service reliability, security, and troubleshooting. RepeatFlow aims to minimize personal data in such analysis and does not intentionally include user learning content.

17. Automated decision-making and profiling

RepeatFlow does not make decisions based solely on automated processing that produce legal effects or similarly significant effects for users.

RepeatFlow does not use advertising profiling.

Review schedules, Daily Limit, reminders, planner behavior, and Recovery may be personalized based on your learning data, review progress, preferences, and settings. This is part of providing the Service and is not used for third-party advertising.

18. Testing, review builds, and pre-release distribution

During app testing, app review, or pre-release distribution, Apple TestFlight, Google Play testing tools, app store review systems, or related platform services may process diagnostic, install, purchase, and testing-related data under their own terms and privacy policies.

19. Security

We use technical and organizational measures designed to protect personal data, including where applicable:

• encrypted transport;
• server-side access controls;
• hashed OTP codes;
• hashed refresh tokens;
• scoped session tokens;
• database access controls;
• infrastructure-level security features;
• backup protection;
• monitoring;
• limited retention of logs;
• least-privilege operational access.

No method of transmission or storage is 100% secure. We cannot guarantee absolute security.

If we become aware of a security incident affecting personal data, we will investigate and, where required, notify affected users and/or regulators according to applicable law.

20. Your rights

Depending on where you live and the circumstances of processing, you may have the right to:

• access your personal data;
• receive confirmation that your data is being processed;
• correct inaccurate data;
• delete personal data;
• restrict processing;
• receive data in a portable format;
• object to processing based on legitimate interests;
• withdraw consent where processing is based on consent;
• not be subject to solely automated decisions with legal or similarly significant effects;
• lodge a complaint with a competent data protection authority.

You can correct many account settings and learning data directly in the app.

You can change analytics and diagnostics consent in app settings.

For privacy requests that cannot be handled in the app, contact:

[email protected]

We generally respond to privacy requests within 30 days. In complex cases, this period may be extended by up to two additional months where allowed by law, in which case we will inform you.

We may need to verify your identity before fulfilling a request. Some requests may be limited or denied where allowed by law, including where retention is required for legal obligations, security, fraud prevention, dispute resolution, chargebacks, or legal claims.

21. App Store and Google Play data summary

For app store privacy and data safety purposes, RepeatFlow may process the following categories:

• Contact information: email address;
• User content: learning Materials, notes, links, flashcards, Subjects, Repeat Plans, and review progress;
• Identifiers: user/account ID, device ID, session IDs, purchase/subscription identifiers;
• Purchases: subscription status, product ID, transaction ID, original transaction ID, purchase token;
• Usage data: app events and feature usage only after analytics consent;
• Diagnostics: crash reports, non-fatal errors, performance and technical diagnostics only after diagnostics consent, plus backend logs needed for security and reliability;
• Approximate location: may be inferred from IP address in server/security logs or cookie-free website analytics;
• Financial information: RepeatFlow does not directly collect payment card data;
• Precise location: not collected;
• Health data: not collected;
• Advertising ID: not used for advertising.

Data may be linked to your account, device, or subscription status where needed to provide the Service, maintain security, verify purchases, handle support, or comply with law.

Data is not used for third-party advertising tracking.

Personal data is not sold.

Personal data is not shared for targeted advertising.

22. Changes to this Privacy Policy

We may update this Privacy Policy from time to time.

If changes are material, we will notify you through the app, website, email, or another appropriate channel before or when the changes take effect, where required by law.

The latest version will be available at:

https://repeatflow.app/privacy-policy

23. Contact

For privacy questions, data export, correction, deletion, consent withdrawal, or other data protection requests, contact:

[email protected]

For general support, contact:

[email protected]