Privacy Policy

Effective date: August 12, 2026

This Privacy Policy explains how Learnalist AS (“Learnalist”, “we”, “us”, or “our”) handles personal data when you use our websites, mobile applications, browser extensions, and related services (collectively, the “Services”). Learnalist AS is the controller of the personal data described in this policy.

Organization details

Learnalist AS operates Learnalist, mobile apps, and learning tools for notes, habits, flashcards, and plank training.

Legal organization: Learnalist AS
Organization number: 937 775 008
Product name: Learnalist
Country: Norway
Website: learnalist.net
Support: chris@learnalist.net
Privacy: learnalist-privacy-policy@learnalist.net
Contact: chris@learnalist.net

Information We Collect

We collect the following categories of information, depending on how you use the Services:

Account and sign-in information. When you sign in with Google or Apple, we receive an identifier that allows us to create and authenticate your Learnalist account. We may also store profile or preference information you choose to provide, such as a display name or time zone.
Your content. We store content you create or submit, including lists, notes, learning and spaced-repetition data, habit or plank records, attachments, and associated settings and metadata.
Purchase information. Apple or Stripe may provide transaction and product identifiers, purchase status, entitlement period, and refund or revocation information. We do not receive full payment-card details.
Device and notification information. If you enable notifications, we store information needed to deliver them, such as an app identifier, device or push token, notification settings, and time zone.
Precise location. If you choose to enable location access, The Humble Plank can attach your precise location to a plank record and the Learnalist app can attach your precise location to a note. The location is stored as part of that record and is not disclosed to a location-service provider by Learnalist. You can disable location access in the relevant mobile app’s system settings. Location cannot currently be removed separately from a note or plank record, but you can delete the note or plank record containing it.
Technical information. Our servers necessarily process information such as your IP address and requested operation to respond to a request, but we do not currently retain routine access logs. We may record limited diagnostic or security events when needed to investigate errors, abuse, or threats. We do not include the contents of your notes in those logs.
Communications. If you contact us, we keep the information in your message and our response so that we can address your request and maintain appropriate support records.

We receive information directly from you, automatically when you use the Services, and from providers involved in sign-in, payments, or app operation, including Google, Apple, Stripe, and Firebase.

How We Use Information and Our Legal Bases

We use personal data for the following purposes:

Provide the Services and perform our contract with you: create and authenticate your account; store, sync, and display your content; provide requested features; verify and restore purchases; deliver enabled notifications; attach location to a note or plank record when you request that feature; and provide customer support.
Protect and improve the Services based on our legitimate interests: prevent fraud and abuse; secure accounts and systems; diagnose errors; monitor reliability; and understand how features perform. We consider the impact on your rights before relying on legitimate interests.
Meet legal obligations: maintain records required by accounting, tax, consumer-protection, or other applicable laws and respond to valid legal requests.
Use your consent where required: for optional device permissions, communications, or other processing for which applicable law requires consent. You may withdraw consent at any time, without affecting processing that occurred before withdrawal.

We do not use personal data to make decisions based solely on automated processing that produce legal or similarly significant effects.

Public and Shared Content

Lists are not public unless you choose a public sharing option or otherwise make them public. Content you make public can be viewed, copied, or shared by others and may be indexed by search engines. If you share content with specific people, they can access it according to the permissions you grant. Review content carefully before making it public or sharing it.

We disclose personal data only as needed for the purposes described in this policy:

Service providers. Providers that support hosting, storage, sign-in, payments, notifications, communications, logging, security, and other operations may process data on our behalf or as independent controllers for their own services. These include Google and Apple for sign-in, Apple and Stripe for payments, and Google Firebase for push notifications.
People you choose. We disclose content when you make it public or share it with another user.
Legal and safety reasons. We may disclose information when reasonably necessary to comply with law or a valid legal request, protect the rights and safety of users or others, investigate fraud or abuse, or secure the Services.
Business changes. If Learnalist is involved in a merger, acquisition, financing, reorganization, or sale of assets, personal data may be disclosed as part of that transaction, subject to appropriate confidentiality and applicable law.

We may use or disclose aggregated or de-identified information that cannot reasonably identify you. We do not sell personal data, act as a data broker, or use personal data for personalized advertising. We do not publish support communications without permission.

International Data Transfers

Some providers may process data outside Norway or the European Economic Area. Where this occurs, the provider’s applicable terms and data-transfer arrangements govern the transfer. We are reviewing these arrangements as we migrate provider accounts to Learnalist AS. Contact us for current information about a particular provider.

Cookies and Local Storage

We use cookies and similar local storage where needed to keep you signed in, protect sessions, remember settings, cache data, and provide requested functionality. Mobile applications and browser extensions may also store data locally on your device. Removing cookies or local data, signing out, or uninstalling an app or extension may remove local settings or interrupt some features, but does not by itself delete information stored in your Learnalist account.

How Long We Keep Information

We retain personal data only for as long as reasonably necessary for the purposes described in this policy:

account information and content are generally retained while your account is active and removed when the account or content is deleted, subject to the exceptions below;
precise location attached to a note or plank record is retained for as long as that record and is deleted when you delete the record or your account;
routine access logs are not currently retained. Limited application or security logs created to investigate a specific error, abuse, or threat are retained only for as long as reasonably needed for that purpose;
invalid push tokens are removed when identified, and notification information is removed when no longer needed or when the associated account is deleted;
purchase and transaction records are retained as needed to provide and restore entitlements, resolve disputes, and comply with accounting, tax, and other legal obligations; and
support communications are currently stored as email and do not yet have a fixed deletion schedule. We may retain them to address the request, maintain relevant support history, or establish or defend legal claims.

We do not currently operate a scheduled production backup system. An authorized administrator may create an ad hoc copy for maintenance, migration, or recovery work. If such a copy contains information later deleted from the Services, that information may remain in the copy until the work is complete and the copy is deleted. Information may also remain in transaction, event, security, or other records that we must or are permitted to retain for a specific legal or operational purpose. We may keep information that has been irreversibly de-identified.

Security

We use reasonable technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, or alteration. No method of storage or transmission is completely secure, so we cannot guarantee absolute security. Please protect your sign-in method and notify us if you believe your account has been compromised.

Your Choices and Rights

You can edit or delete individual content using available controls in the Services. To request deletion of your account, follow our account deletion instructions or contact us using the privacy email above. Account deletion is permanent and may also make paid entitlements unavailable, so save any content you want to keep and contact support about an active purchase before deletion.

Depending on where you live and subject to applicable exceptions, you may have the right to:

request access to and a copy of your personal data;
correct inaccurate or incomplete personal data;
request deletion of your personal data;
restrict or object to processing;
receive data you provided in a portable format;
withdraw consent where processing is based on consent; and
lodge a complaint with a data-protection authority.

If the GDPR applies, you may object at any time to direct marketing and may object to processing based on legitimate interests for reasons related to your particular situation. You can lodge a complaint with the Norwegian Data Protection Authority, Datatilsynet, or with the supervisory authority where you live or work.

Send a rights request to learnalist-privacy-policy@learnalist.net. We may need to verify your identity before completing a request. We normally respond to GDPR requests within one month, although the law permits an extension in certain circumstances. If we cannot fulfill a request, we will explain why and describe any available complaint or appeal rights.

Residents of California and other US states may have additional rights under applicable state privacy laws. You may use the same privacy email to exercise those rights. We will not discriminate against you for making a privacy request.

Children’s Privacy

Learnalist is not intended for children under 13, and we do not knowingly collect personal data from children under 13. We do not currently verify users' ages. If we learn that a child under 13 has provided personal data without the authorization required by law, we will delete the account and associated data. A parent or guardian can contact us using the privacy email below.

Changes to This Policy

We may update this policy to reflect changes to the Services, our practices, or the law. We will revise the effective date and provide additional notice by email, in-app notice, or another appropriate method when a change materially affects how we handle personal data.

Contact

For questions, privacy requests, or complaints, contact learnalist-privacy-policy@learnalist.net.

Change Log

August 12, 2026: Rewritten to describe Learnalist’s current data categories, purposes, legal bases, providers, retention practices, and privacy rights.
April 2, 2021: First version.