Privacy Policy

Effective date: August 19, 2026

This Privacy Policy explains how Learnalist AS (“Learnalist”, “we”, “us”, or “our”) handles personal data when you use our websites, mobile applications, browser extensions, and related services (collectively, the “Services”). Learnalist AS is the controller of the personal data described in this policy.

Information We Collect

We collect the following categories of information, depending on how you use the Services:

• Account and sign-in information. When you sign in, we process the credentials appropriate to your chosen method. This may include a username and password, or an identifier and authentication token supplied by Google or Apple. Passwords for username-based accounts are stored as hashes rather than in readable form. We may also store profile or preference information you choose to provide, such as a display name or time zone.
• Your content. We store content you create or submit, including lists, notes, learning and spaced-repetition data, habit or plank records, attachments, and associated settings and metadata. If you choose to attach an image, we process the photo you select from your library, take with your camera, or paste into the app and may upload it as part of your content. Uploaded images and other asset files may be stored either on Learnalist-managed infrastructure or in a private Cloudflare R2 object-storage bucket. Cloudflare processes those files and related technical metadata as our storage provider. Access is controlled by Learnalist and may be provided through time-limited signed links.
• Purchase information. Apple or Stripe may provide transaction and product identifiers, purchase status, entitlement period, and refund or revocation information. We do not receive full payment-card details.
• Device and notification information. If you enable notifications, we store information needed to deliver them, such as an app identifier, device or push token, notification settings, and time zone.
• Precise location. If you choose to enable location access, The Humble Plank can attach your precise location to a plank record and the Learnalist app can attach your precise location to a note. The location is stored as part of that record. If you open the map for a saved location, the Learnalist app requests map tiles from OpenStreetMap. OpenStreetMap receives technical request information, such as your IP address and the map area requested, under its own terms and privacy policy. You can disable location access in the relevant mobile app’s system settings. Location cannot currently be removed separately from a note or plank record, but you can delete the note or plank record containing it.
• Technical information. Our servers necessarily process information such as your IP address and requested operation to respond to a request, but we do not currently retain routine access logs. We may record limited diagnostic or security events when needed to investigate errors, abuse, or threats. We do not include the contents of your notes in those logs.
• Communications. If you contact us, we keep the information in your message and our response so that we can address your request and maintain appropriate support records.

We receive information directly from you, automatically when you use the Services, and from providers involved in sign-in, payments, or app operation, including Google, Apple, Stripe, Firebase, Cloudflare, and OpenStreetMap.

How We Use Information and Our Legal Bases

We use personal data for the following purposes:

• Provide the Services and perform our contract with you: create and authenticate your account; store, sync, and display your content; provide requested features; verify and restore purchases; deliver enabled notifications; attach location to a note or plank record when you request that feature; and provide customer support.
• Protect and improve the Services based on our legitimate interests: prevent fraud and abuse; secure accounts and systems; diagnose errors; monitor reliability; and understand how features perform. We consider the impact on your rights before relying on legitimate interests.
• Meet legal obligations: maintain records required by accounting, tax, consumer-protection, or other applicable laws and respond to valid legal requests.
• Use your consent where required: for optional device permissions, communications, or other processing for which applicable law requires consent. You may withdraw consent at any time, without affecting processing that occurred before withdrawal.

We do not use personal data to make decisions based solely on automated processing that produce legal or similarly significant effects.

Public and Shared Content

Lists are not public unless you choose a public sharing option or otherwise make them public. Content you make public can be viewed, copied, or shared by others and may be indexed by search engines. If you share content with specific people, they can access it according to the permissions you grant. Review content carefully before making it public or sharing it.

When We Share Information

We disclose personal data only as needed for the purposes described in this policy:

• Service providers. Providers that support hosting, storage, sign-in, payments, notifications, communications, logging, security, and other operations may process data on our behalf or as independent controllers for their own services. These include Google and Apple for sign-in, Apple and Stripe for payments, Google Firebase for push notifications, Cloudflare for private object storage and delivery of uploaded files, and OpenStreetMap for map tiles when you choose to view a saved location on a map.
• People you choose. We disclose content when you make it public or share it with another user.
• Legal and safety reasons. We may disclose information when reasonably necessary to comply with law or a valid legal request, protect the rights and safety of users or others, investigate fraud or abuse, or secure the Services.
• Business changes. If Learnalist is involved in a merger, acquisition, financing, reorganization, or sale of assets, personal data may be disclosed as part of that transaction, subject to appropriate confidentiality and applicable law.

We may use or disclose aggregated or de-identified information that cannot reasonably identify you. We do not sell personal data, act as a data broker, or use personal data for personalized advertising. We do not publish support communications without permission.

International Data Transfers

Some providers may process data outside Norway or the European Economic Area. Where this occurs, the provider’s applicable terms and data-transfer arrangements govern the transfer. We are reviewing these arrangements as we migrate provider accounts to Learnalist AS. Contact us for current information about a particular provider. Cloudflare R2 buckets used for uploaded content are currently configured with the European Union jurisdiction. Cloudflare states that this jurisdiction keeps R2 objects stored and processed within the European Union.

Cookies and Local Storage

We use cookies and similar local storage where needed to keep you signed in, protect sessions, remember settings, cache data, and provide requested functionality. Mobile applications and browser extensions may also store data locally on your device. Removing cookies or local data, signing out, or uninstalling an app or extension may remove local settings or interrupt some features, but does not by itself delete information stored in your Learnalist account.

How Long We Keep Information

We retain personal data only for as long as reasonably necessary for the purposes described in this policy:

• account information and content are generally retained while your account is active and removed when the account or content is deleted, subject to the exceptions below;
• uploaded image files are retained for as long as the associated content or account requires them and are deleted from their configured storage backend when the image, associated content, or account is deleted, subject to the exceptions below;
• precise location attached to a note or plank record is retained for as long as that record and is deleted when you delete the record or your account;
• routine access logs are not currently retained. Limited application or security logs created to investigate a specific error, abuse, or threat are retained only for as long as reasonably needed for that purpose;
• invalid push tokens are removed when identified, and notification information is removed when no longer needed or when the associated account is deleted;
• purchase and transaction records are retained as needed to provide and restore entitlements, resolve disputes, and comply with accounting, tax, and other legal obligations; and
• support communications are currently stored as email and do not yet have a fixed deletion schedule. We may retain them to address the request, maintain relevant support history, or establish or defend legal claims.

We do not currently operate a scheduled production backup system. An authorized administrator may create an ad hoc copy for maintenance, migration, or recovery work. If such a copy contains information later deleted from the Services, that information may remain in the copy until the work is complete and the copy is deleted. Information may also remain in transaction, event, security, or other records that we must or are permitted to retain for a specific legal or operational purpose. We may keep information that has been irreversibly de-identified.

Security

We use reasonable technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, or alteration. No method of storage or transmission is completely secure, so we cannot guarantee absolute security. Please protect your sign-in method and notify us if you believe your account has been compromised.

Your Choices and Rights

You can edit or delete individual content using available controls in the Services. To request deletion of your account, follow our account deletion instructions or contact us using the privacy email above. Account deletion is permanent and may also make paid entitlements unavailable, so save any content you want to keep and contact support about an active purchase before deletion.

Depending on where you live and subject to applicable exceptions, you may have the right to:

• request access to and a copy of your personal data;
• correct inaccurate or incomplete personal data;
• request deletion of your personal data;
• restrict or object to processing;
• receive data you provided in a portable format;
• withdraw consent where processing is based on consent; and
• lodge a complaint with a data-protection authority.

If the GDPR applies, you may object at any time to direct marketing and may object to processing based on legitimate interests for reasons related to your particular situation. You can lodge a complaint with the Norwegian Data Protection Authority, Datatilsynet, or with the supervisory authority where you live or work.

Send a rights request to learnalist-privacy-policy@learnalist.net. We may need to verify your identity before completing a request. We normally respond to GDPR requests within one month, although the law permits an extension in certain circumstances. If we cannot fulfill a request, we will explain why and describe any available complaint or appeal rights.

Residents of California and other US states may have additional rights under applicable state privacy laws. You may use the same privacy email to exercise those rights. We will not discriminate against you for making a privacy request.

Children’s Privacy

Learnalist is not intended for children under 13, and we do not knowingly collect personal data from children under 13. We do not currently verify users' ages. If we learn that a child under 13 has provided personal data without the authorization required by law, we will delete the account and associated data. A parent or guardian can contact us using the privacy email below.

Changes to This Policy

We may update this policy to reflect changes to the Services, our practices, or the law. We will revise the effective date and provide additional notice by email, in-app notice, or another appropriate method when a change materially affects how we handle personal data.

Contact

For questions, privacy requests, or complaints, contact learnalist-privacy-policy@learnalist.net.

Change Log

• August 19, 2026: Clarified image storage and delivery through Cloudflare R2, its European Union jurisdiction, and image retention and deletion.
• August 12, 2026: Rewritten to describe Learnalist’s current data categories, purposes, legal bases, providers, retention practices, and privacy rights.
• April 2, 2021: First version.