Last updated: 13 November 2026.

Privacy Policy

This policy explains what personal data KartuLearn uses, why, how long we keep it, and your rights. In short: the app collects nothing unless you agree. If you agree, it sends us usage figures: what you do in the app, such as the lessons you finish or leave and the questions you get wrong, with a random code instead of your name, and never what you type or say. You can use it without an account. If you make one, with Sign in with Apple or Sign in with Google, our account server keeps your account (the email address Apple or Google gives us, never your name), a copy of your progress and a record of what you've bought, so they follow you to your other devices. If you use iCloud, your progress syncs between your own devices through your own iCloud account, which we can't read. If you use Friends, our friends server keeps the name you choose for friends, your streak and who your friends are, so your friends can see them and nudge you. Apart from these usage figures, Friends, your account if you make one, and the crash reports and App Analytics Apple shares with us if you've allowed it, we only get personal data if you email us. We never sell data, and there are no ads or trackers.

Who we are

Nathan Brosnan, a sole trader in Ireland, is the controller of your personal data. That means we decide how it is used, and we're responsible for it.

• Address: Burkes Lane, Ballinvriskig, Whitecross, Cork T23 RF25, Ireland
• Email: kartulearn@nathanbrosnan.com

We don't have a Data Protection Officer, because the law doesn't require one for a business like ours. Please write to kartulearn@nathanbrosnan.com about anything in this policy.

The app

KartuLearn is an app for iPhone and iPad, which Macs with Apple silicon can also run. You can use it without an account. It sends us nothing unless you agree to share usage figures, use Friends or make an account (all below). It has no tracking and no ads.

• Your progress is kept on your device. If your device is signed in to iCloud, with iCloud on for KartuLearn, the app also keeps it in your own private iCloud storage, so your iPhone, iPad and Mac show the same progress. That copy belongs to your Apple Account: only you can read it, we can't, and nothing of it comes to us. What syncs is what you've answered, the lessons, rounds and tests you've finished, when each word comes back for review, your streak and XP, and your daily time and weekly goal. With it goes a random code for each of your devices, so their copies can be told apart; it says nothing about you or the device. Your other settings stay on each device, and your recordings never leave it. If you make an account, your progress goes to it too: see "Your account, if you make one", below. iCloud is Apple's service, under Apple's privacy policy. If you sign out of iCloud, or turn iCloud off for KartuLearn, Apple removes the synced progress from that device; it stays in your iCloud, and comes back when iCloud is on again.
• Backups. If you back up your device (to iCloud, to a computer, or with Time Machine on a Mac), the backup includes your progress. Deleting the app deletes your progress from the device; its copy in your iCloud stays until you delete it there, in your device's Settings (your name, then iCloud, then the storage list).
• Purchases go through Apple, and Apple's StoreKit checks them on your device; a record of what you've bought is kept in your device's Keychain, on that device only. If you make an account, the app also sends it the App Store's signed record of each purchase (below). Apple takes the payment. We never see your payment details, or who you are. Apple's privacy policy covers what Apple does.
• Downloads. After you install or update the app, it downloads A2 and any fixes to the course from Apple's servers, for everyone, whether or not you've bought A2. Apple handles these downloads like any App Store download, under its own privacy policy; nothing about them comes to us.
• Speaking practice. The app uses the microphone only while you're recording yourself to compare with the course's voices, and only if you've allowed it. Your recording is kept only while that question is on screen, and deleted as soon as you move on: nothing listens to it or sends it anywhere, and it's left out of your device's backups.
• Usage figures, only if you agree: see the next section.
• Friends, only if you use them: see "Friends, if you use them", below.
• Your account, only if you make one: see "Your account, if you make one", below.
• Streak reminders. If you turn them on and allow notifications, the app sets reminders on your device for 6pm and 10pm on a day you haven't studied yet. They're made on the device, and nothing is sent to us or anyone else. Turn them off in the app's Settings, under Reminders, or in your device's Settings.
• Apple's crash reports and App Analytics. If you've chosen in iOS settings to share analytics with app developers, Apple sends us a report when the app crashes, and shows us figures such as how many people opened the app (App Analytics). They don't tell us who you are. You can change this in Settings, under Privacy & Security, then Analytics & Improvements.
• Report a mistake opens your own email app, with a message to kartulearn@nathanbrosnan.com that names the line it's about. Nothing is sent unless you send it.
• Ratings. After some unit tests, the app may ask you to rate it, with Apple's own prompt; iOS decides whether it shows. A rating or review is Apple's service; we see only what's published on the App Store.

Usage figures, if you agree

The first time you open the app, it asks whether to share usage figures, and you can change your answer at any time in the app's Settings, under Usage figures. Until you say yes, and after you say no, nothing is sent or kept for them. If you say yes, the app sends us:

• what you do in the app: the first-run screens you reach; the alphabet's rounds, the reading test, unit tests and the placement test, started, finished or left; each lesson part and review part you start, finish or leave, and at which card; each question's first answer (which exercise and word, what kind of question, right or wrong, how long it took, and whether a hint was used); the offer of the full course shown and closed, purchases started and how they ended (never a price or a payment), and Restore purchases; the first time you open the app each day, with your streak; the welcome back; and changes to settings, such as Can't listen now and the language;
• facts about the app: its version, the iOS version, whether it's an iPhone, iPad or Mac, the app's language, whether you have the full course and how (for life, monthly or through Family Sharing), the next step on your path, and how many days since you said yes;
• crash and freeze reports from your device's MetricKit: codes and places in the app's own code, never a message;
• a random code, made by the app on your device when you say yes, so the figures from one device can be counted together. It isn't your name, your Apple Account or your device's identifier. It's deleted when you say no, and saying yes again makes a new one.

It never sends what you type, write or say, your recordings, your email, your contacts or your location. The figures wait on your device, left out of its backups, and go when there's a connection. They go to PostHog, our analytics provider, in its EU cloud in Frankfurt, Germany, set to keep no IP addresses and to work out no location. We use them to see where learners get stuck or stop, and to fix and improve the course and the app. Your code is in Settings, under Usage figures.

Friends, if you use them

Friends is optional. Nothing is sent for it until you choose a name for friends, when you add or accept your first friend. Then our friends server keeps:

• a random code made on your device, and a secret that proves it's you, of which the server keeps only a scrambled form. Both are kept in your iCloud Keychain, so your iPhone and iPad are one person to your friends. The code is at the foot of the Friends screen. It has nothing to do with the usage figures' code, and the two are never put together;
• the name you choose for friends. All your friends see it, and so does anyone who opens an invitation link of yours before it's used or a week has passed;
• your streak card: the days you practised and the days a freeze kept, from the day of your first friendship (and always the last two weeks), your streak, how many streak freezes you hold, and your time difference from UTC (for example "4 hours ahead"), so a friend knows what day it is for you. Not where you are, and nothing else of your progress;
• your friendships, the nudges you send and receive (from whom, to whom, and for which day), and the days of a shared streak saved with a freeze, and by whom;
• your devices' push tokens, so Apple can deliver a friend's nudge to your device as a notification. Apple's push service carries it; its words are put together on your device;
• reports and blocks: if you report a friend's name, who reported it, the name, the reason you chose and when; and the people you've blocked.

Your friends see your name, your streak, your week and your shared streak, and whether you've nudged them. Removing or blocking a friend deletes that friendship, with its nudges and saves; a block is kept until you unblock them. We look at every report; a name two people report is taken away at once, and its owner is asked for another. Delete my friends data, at the foot of the Friends screen, deletes everything the friends server keeps about you, at once, your blocks and reports included. We use none of it for anything but Friends: not for the usage figures, advertising or profiling.

Your account, if you make one

An account is optional. Nothing is sent for it until you sign in, in the app's Settings under Account, with Sign in with Apple or Sign in with Google. Then our account server keeps:

• your sign-in: whether it's Apple or Google, the code Apple or Google gives us for you, and the email address it gives us. With Apple you can choose to hide your email, and we then get a private address that Apple forwards to you. Never your name, and never your password, which only Apple or Google sees. With Apple, we also keep a code Apple gives us, only to end your Sign in with Apple for KartuLearn when you delete the account;
• your progress: a copy of what syncs between your devices (what you've answered, the lessons, rounds and tests you've finished, when each word comes back, your streak, XP and streak freezes, your daily time and weekly goal), with a random code for each of your devices. Our server passes it between your devices and doesn't read it;
• what you've bought: the App Store's signed record of each purchase: which product, when, when a monthly plan renews or ends, whether it came through Family Sharing, and whether it was refunded. Never a price you paid or a payment detail. Apple also tells our server when a monthly plan renews or ends, or a purchase is refunded;
• each device you've signed in on: whether it's an iPhone, an iPad or another kind of device, and when it was last used, so you stay signed in;
• your friends code, if you use Friends, so your friends follow you to your other devices.

We use these only to run your account: to keep your progress and what you've bought with you on your devices. Not for the usage figures, advertising or profiling, and the usage figures are never put together with your account. Apple and Google only confirm to us who you are; what they do is under their own privacy policies. Download my data, in the app's Settings under Account, gives you a copy of all of it as a file. Delete my account, in the same place, deletes everything the account server keeps about you, at once; you can delete your friends data with it. Your progress on your devices and in your own iCloud stays, and nothing you bought from Apple is lost.

Emails you send us

If you email us, for example with Report a mistake, we get your email address, your name if your email shows it, and what you wrote. We use them to answer you and to fix the course.

Our website

Our website, kartulearn.com, with our support pages and this policy, is served by Cloudflare. It uses no cookies and no analytics. Cloudflare handles visitors' IP addresses to deliver the pages and protect them from attacks, under Cloudflare's privacy policy; we don't keep them.

Why we use your data

The law calls these "legal bases". We use the usage figures only because you agreed: your consent. You can withdraw it at any time in the app's Settings, under Usage figures; that doesn't affect what was sent before. We use what Friends keeps to run Friends for you, which you asked for by using them, and what your account keeps to run your account, which you asked for by making it: that's needed for our contract with you (our terms). We use the emails you send us, and the crash reports and App Analytics Apple gives us if you've allowed it, for our legitimate interests: answering you, finding faults, and fixing and improving the course. You can object to this (see "Your rights"). When you use a legal right (about a fault, a refund or your data), we use your email to meet our legal obligations.

Apart from the usage figures, we don't rely on your consent. We don't sell or share your data, and we don't use it for advertising. We make no automated decisions about you, including profiling. The app's review scheduler, on your device, only decides when a card comes back.

Who else handles your data

• Microsoft (Microsoft Ireland Operations Limited) is our email provider and holds the emails you send us. It keeps our mailbox in the European Union. Microsoft is part of a US group and may reach the mail from outside the European Economic Area, for example for support or security. Those transfers are covered by the EU-US Data Privacy Framework, which Microsoft has joined, and by the standard contractual clauses in Microsoft's data protection terms. You can ask us for a copy of the safeguards.
• PostHog (PostHog Inc.) holds the usage figures, if you agree to share them, as our processor under its data processing agreement, in its EU cloud in Frankfurt, Germany. PostHog is a US company and may reach the data from outside the European Economic Area, for example for support. Those transfers are covered by the standard contractual clauses in its data processing agreement. You can ask us for a copy of the safeguards.
• Cloudflare (Cloudflare, Inc.) runs our friends and account server and its databases, for Friends and accounts only, and serves our website, as our processor under its data processing addendum. The database is kept in the European Union (Cloudflare's EU jurisdiction). Cloudflare is a US company and may reach the data from outside the European Economic Area, for example for support or security. Those transfers are covered by the EU-US Data Privacy Framework, which Cloudflare has joined, and by the standard contractual clauses in its data processing addendum. You can ask us for a copy of the safeguards.
• Apple, for the App Store, purchases, downloads and crash reports, as described above, for delivering friends' notifications (the Apple Push Notification service), and, if you use it, Sign in with Apple, which Apple runs under its own privacy policy.
• Google (Google Ireland Limited), only if you choose Sign in with Google: Google confirms to us who you are and gives us your email address, under Google's privacy policy. Nothing else of KartuLearn goes to Google. Your progress in iCloud is between you and Apple, in your own account: we have no access to it.

We don't give your data to anyone else, unless the law requires us to.

Where your data is

Your progress is on your device, in your own iCloud if you use it, and in your device's backups if you make them. Usage figures, if you agree to share them, are with PostHog in Frankfurt, Germany. What Friends keeps, if you use them, and what your account keeps, if you make one, are on Cloudflare's servers in the European Union. Emails you send us are with Microsoft, as above.

How long we keep it

• Emails: for as long as we need them to deal with what you wrote, and then for up to a year, in case you write again about the same thing. An email about a purchase, a fault or a refund we keep for six years after the matter is dealt with, because that's how long a legal claim about it can be made.
• Usage figures: for one year from when they're sent, then deleted. Anything still waiting on your device is deleted when you say no.
• Friends: until you delete it in the app, or remove the friend it's about. Nudges are deleted after 30 days, an invitation after a week, and a report after a year; a block lasts until it's lifted. If you haven't used Friends for a year, everything it keeps about you is deleted.
• Your account: until you delete it in the app. There's no time limit, since it's yours to keep. A device's sign-in unused for a year ends; the account stays. Deleting is at once; Cloudflare's restore points, which let us recover from a fault, hold it for up to 30 days more.
• Your progress: without an account, we never have it: it stays on your device until you delete the app, and in your iCloud until you delete it there. With an account, its copy is kept with the account, as above.

Your rights

You have the right to:

• get a copy of your data (access)
• have wrong data corrected (rectification)
• have your data deleted (erasure)
• have its use limited (restriction)
• object to our use of it for our legitimate interests (objection)
• take your data with you, in a format a computer can read, where that right applies (portability)

Email kartulearn@nathanbrosnan.com to use any of them. We may ask you to show it's you, for example by writing from the address you used before. For the usage figures, we can only find yours by their code: copy it from the app's Settings, under Usage figures, and send it to us, and we'll give you a copy of them or delete them. Without the code we can't tell which are yours. What your account keeps you can download yourself, with Download my data, or delete, with Delete my account, both in the app's Settings under Account. What Friends keeps you can delete yourself, at once, with Delete my friends data in the app; for a copy of it, send us the code at the foot of the Friends screen. It's free. We'll answer within one month. If a request is complicated, the law lets us take up to two more months, and we'll tell you if we need them.

If you're unhappy with how we've used your data, please tell us. You also have the right to complain to the Data Protection Commission in Ireland:

Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963, Ireland. www.dataprotection.ie

If you live elsewhere in the EU or the EEA, you can also complain to the data protection authority where you live.

Children

The app doesn't ask your age. It shares usage figures only if you agree; if you're under 16, please ask a parent or guardian first, since in Ireland 16 is the age to agree to this yourself. Friends keeps a name and a streak, and only once you choose to use them; a parent or guardian can delete it at any time with Delete my friends data. An account keeps an email address and progress, and only once you choose to make one; Apple and Google set their own age rules for signing in, and a parent or guardian can delete it at any time with Delete my account. We can't tell how old someone who emails us is, so we treat every email the same way: we use it to answer you and to fix the course, as above.

Keeping your data safe

The only data of yours we could ever hold is an email you sent; if you agree to share them, the usage figures, which carry a random code and not your name; if you use Friends, what the friends server keeps; and, if you make one, what your account keeps. All of it is sent encrypted, our server keeps your friends secret and your devices' sign-ins only in a scrambled form, and our email, PostHog and Cloudflare accounts are protected with two-step sign-in. If a data breach puts your data at risk, we'll tell the Data Protection Commission, and you, where the law requires.

Changes to this policy

A new version of this policy comes with an update of the app, and the date at the top changes. If a change matters to you, we'll say so in the update's notes on the App Store.