Legal

Who We Are (Data Controller)

RealLearn ("RealLearn", "we", "us") is the data controller / data fiduciary responsible for the personal data described in this policy. For all privacy, data-protection, and grievance matters — including requests to exercise your rights under the GDPR, the California Consumer Privacy Act (as amended by the CPRA), or India's Digital Personal Data Protection Act, 2023 (DPDP Act) — you can reach our privacy contact and designated grievance officer at esamzai365@gmail.com. We aim to acknowledge grievances promptly and respond within the timelines required by applicable law.

1. What RealLearn Is

RealLearn is an AI-powered educational platform. Depending on the answer mode you choose, it generates either a quick single-part direct answer ("Fast" mode) or a 3-part learning journey (Foundation, Mechanism, Real World — "Explain" mode) for any topic you ask about. It is powered by Google's Gemma 4 open model: our primary inference provider is Cerebras Cloud (running Gemma 4 31B), with NVIDIA NIM (Gemma 4 31B) configured as the automatic fallback and Cloudflare Workers AI (Gemma) as a last-resort fallback so lessons can still be generated if the primary and fallback are slow or unavailable. This is designed to help students learn through interactive quizzes and structured content. RealLearn also builds a personalized learning profile from your quiz results: a compact, on-device map of the concepts you have proven you know (by passing lesson quizzes) and where you are still building confidence. This profile is computed on your device from data already stored locally in your browser and is used internally to personalize each AI answer — a small, topic-relevant summary of your verified knowledge is attached to your lesson request so the AI can build on your strengths and give extra care to areas you find hard. The profile is not shown on a separate page and is not stored on our servers — see "Cookies and Local Storage" below for exactly what is used and what, if anything, is sent to our servers.

2. Information We Collect

We collect the following information to provide and improve our service:

• Account Information: Your email address and Clerk ID (provided by our authentication provider, Clerk).
• Usage Data: The questions you ask, your selected answer mode (Fast or Explain), language and learning level, quiz scores, and lesson progress.
• Device Information: Your IP address and browser User-Agent (for security, consent tracking, and rate limiting). Before an IP address is written to a stored consent record we anonymize it by truncation (the last part of the address is removed, e.g. 203.0.113.0), so stored records never contain your full IP address; the User-Agent is stored only as a salted one-way hash.
• Consent Records: Timestamps of when you accepted our Privacy Policy (version 3.4), Terms of Service (version 3.1), and cookie/analytics consent, together with the policy version, an anonymized (truncated) device IP, and a hashed User-Agent, kept as proof of consent. These records are keyed to your Clerk account ID and do not contain your email address — it is held only by Clerk, our authentication provider. Email fields written to consent records by older versions of the app have been removed from our database.
• Cached Lessons (temporary, not linked to you): To make the Service faster, generated lessons may be temporarily cached on our servers, keyed by a one-way hash of the question text, language, level, and answer mode. Cached lessons contain no account information, are not linked to your identity, and expire automatically (typically within a few hours).
• Voice Input (optional): If you choose to use the microphone button, your speech is converted to text by your browser's built-in speech recognition. We never receive, record, or store your audio — only the resulting text appears in the question box, exactly as if you had typed it. See Section 16 for details.
• Read-Aloud Audio (temporary, not linked to you): If you use the "Listen" feature, the lesson text to be read aloud is sent to our server, which generates the audio using Microsoft's Edge text-to-speech service. The resulting audio may be temporarily cached on our server (for up to 24 hours), keyed only by a one-way hash of the text, language, and voice settings — never by your identity — so that repeated playback of the same text does not need to be re-synthesized. See Section 16 for details.
• Saved Lessons: Your learning journeys (chats) are stored locally on your device, split across two browser storage areas for performance: the full lesson content (lesson text and quizzes) of every journey is stored in your browser's IndexedDB, while a lightweight index (question, scores, dates, and part/quiz counts) is kept in localStorage. Both live only on your device and are never transmitted to or stored on our servers; re-opening a saved lesson loads it directly from your device.
• Optional Feedback (anonymous, not linked to you): Soon after you complete your first learning journey, RealLearn may invite you to leave an optional review: what you liked, what we should improve, and a 1–10 star rating. This feedback is completely anonymous. When you submit it, we store only the review text and rating — we deliberately strip and never include your IP address, Clerk ID, or email, and the request is sent with no account identity attached. The prompt is optional and never forced: you can skip it, ask to be reminded later, or dismiss it permanently. Once you have responded (or permanently declined), we record a single local flag in your browser so the prompt does not appear again — this "given" flag lives only in your device's localStorage and is never sent to our servers. You can clear it at any time with "Delete My Data".
• Learning Progress & Achievements (stored locally): To power our engagement features, we keep a record on your device of your experience points (XP) and level, your daily learning streak and any streak "freezes", your daily goal and progress toward it, an activity history of the days you studied (dates and how many parts you completed each day), the achievement badges you have earned, and aggregate counts such as lessons completed, quizzes passed, perfect scores, follow-up questions asked, and which languages and subjects you have explored. This information is stored only in your browser's localStorage. It is not transmitted to or stored on our servers, and clearing your browser data or using "Delete My Data" removes it.
• Personalization & Delight Data (stored locally): To make the app feel personal, we keep a small amount of information in your browser's localStorage only: (1) the date you first used RealLearn on this device, used to show a friendly "learning together for N days" counter; (2) simple once-per-day markers that record whether a seasonal or time-of-day greeting (a small "surprise" message) has already been shown today, so we never show it twice; and (3) optional learning preferences you can set after signing in — a checklist of learning-style choices (for example, simple language, step-by-step explanations, or visual analogies) plus free-text notes about how you learn best. These learning preferences are stored only on your device, can be changed or cleared anytime in Settings, and are not stored on our servers; they are simply included with each lesson- generation request so the AI can tailor its response. We cap the free-text notes at 500 characters. In addition, RealLearn derives a compact learning-context summary from your on-device quiz history — a short, topic-relevant description of the concepts you have proven strong in, are moderate in, or are weak in (for example, "strong in algebraic identities, moderate in factorisation, weak in quadratic equations"). This summary is generated on your device from your saved quiz results, is not stored on our servers, and is included only with the lesson- generation request it personalizes; it is then discarded. We cap this summary at a small fixed length. One narrow exception: if your free-text notes or learning-context summary are blocked by our safety filters, the blocked text is recorded in a pseudonymous moderation log (see "Moderation Logs" below) and is not sent to the AI. If you are signed in, your first name (provided by Clerk) may be displayed in an on-screen greeting — this happens entirely in your browser. None of this information is transmitted to or stored on our servers (except the learning preferences and the compact learning-context summary, which are sent only with the lesson request and then discarded), and clearing your browser data or using "Delete My Data" removes the on-device profile.
• Moderation Logs: When a question you submit, a personalization note, or an AI response is blocked by our safety filters, we record a moderation log entry containing the reason the content was flagged, the text that triggered the flag (limited to the first 500 characters), and a pseudonymous account identifier. These logs never contain your email, IP address, or other personal identifying information, and never contain internal error details. They are automatically and permanently deleted after 90 days by a database-level expiry rule, or immediately when you delete your account — whichever comes first.

3. How We Use Your Information

• To generate personalized learning content for you.
• To track your progress and quiz performance.
• To power gamification and engagement features — experience points, levels, daily streaks, daily goals, and achievement badges — which are calculated and stored locally on your device to help you build a learning habit.
• To show friendly, personalized touches — a time-of-day greeting (optionally using your first name, rendered only in your browser), a local counter of how many days you have used RealLearn, and small once-per-day seasonal surprises — all computed and stored locally on your device.
• To tailor lesson generation using your optional, locally-stored learning preferences (learning-style checklist and free-text notes), which are sent with each lesson request and not retained on our servers.
• To analyze usage patterns through Google Analytics and improve our service.
• To comply with legal obligations and age-appropriate content rules.
• To improve our educational content quality and service experience.
• To communicate important service updates (if you provide contact consent).

4. Legal Bases for Processing (GDPR)

For users in the European Economic Area and other jurisdictions that require a specified legal basis, we process personal data only where we have a valid legal basis. The table below lists the main categories of processing and the basis that applies:

• Performance of a contract / taking steps at your request: account creation and authentication, generating the lessons and read-aloud audio you request, and providing the core Service features tied to your account.
• Consent: optional Google Analytics cookies and usage analytics, optional anonymous feedback, and optional learning personalization (learning-style checklist and free-text notes). You can withdraw consent anytime in Settings or through your browser's cookie controls.
• Legitimate interests: keeping the Service secure, preventing abuse and fraud, rate limiting, transient IP and request-header processing by our hosting infrastructure (Vercel and Render) to deliver pages and API responses, pseudonymized moderation logging to enforce our content rules, anonymous lesson/audio caching for performance, and local gamification data stored on your device. We balance these interests against your privacy rights and keep data minimization in mind.
• Legal obligation: retaining proof of your acceptance of the Privacy Policy and Terms of Service, preserving records required by applicable law, responding to lawful requests from public authorities, and retaining moderation data where necessary to comply with legal or regulatory requirements.

Where we rely on consent, you have the right to withdraw it at any time. Withdrawing consent will not affect the lawfulness of processing carried out before the withdrawal.

5. Data Storage and Security

Your consent records are stored securely in MongoDB, keyed to your Clerk account ID (your email address is held by Clerk, our authentication provider). Your saved lessons, preferences, and all learning-progress and achievement data (XP, level, streaks, daily goals, activity history, and badges) are stored in your browser's local storage areas on your own device — full lesson content in IndexedDB, and the history index, preferences, and progress data in localStorage — and never leave it.

We apply a defense-in-depth approach to security. Measures that are in place include: Clerk-managed authentication with cryptographically verified JWT session tokens and rotating signing keys; encrypted network connections using HTTPS with HSTS; per-request Content-Security-Policy nonces and strict browser security headers (including X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Cross-Origin-Opener-Policy); request rate limiting backed by both per-user and per-IP ceilings with token-spray protection; strict input validation and size limits on every API endpoint; automated, rule-based content moderation on user inputs and AI outputs; IDOR-resistant data access keyed only to the verified Clerk identity; salted one-way hashing of device User-Agents; truncation of IP addresses before storage; API keys and secrets kept in environment variables rather than client code; and MongoDB Atlas managed hosting with encryption in transit and at rest. If we confirm a personal-data breach affecting your information, we will investigate, take reasonable containment steps, and notify affected users and regulators where and as required by applicable law. RealLearn is a small, independently operated service: we do not operate an enterprise 24/7 security operations center, and no method of electronic storage is 100% secure — we cannot guarantee absolute security.

6. AI-Generated Content

RealLearn generates content using Google's Gemma 4 open AI model. Our primary inference provider is Cerebras Cloud (running Gemma 4 31B); if Cerebras is temporarily slow or unavailable, the request automatically falls back to NVIDIA NIM (Gemma 4 31B), and may then use Cloudflare Workers AI (Gemma) as a last-resort provider so your lesson can still be generated. All lesson content (in both Fast and Explain modes), quizzes, and explanations are AI-generated and are not reviewed by humans before being shown. AI-generated responses may be inaccurate, incomplete, or outdated. You should verify important information with qualified professionals or authoritative sources. The Service is for educational purposes only and does not provide professional advice (medical, legal, financial, etc.).

Lesson content is written in a natural, conversational, human-like style — but it is entirely AI-generated. Nothing in the Service is written or reviewed by a human tutor before you see it.

RealLearn does not use your data to train, fine-tune, or improve any AI model. Your questions are sent to our primary inference provider, Cerebras Cloud (which runs the Gemma model), for one-time inference only. If Cerebras is temporarily slow or unavailable, the same request falls back to NVIDIA NIM (running Gemma), and may then use Cloudflare Workers AI as a last-resort fallback for one-time inference so the lesson can still be generated; the same "no training on your data" commitment applies to all three providers. Safety moderation of your question and the generated lesson is performed locally on our own servers using rule-based pattern matching — your question is not sent to any third party just for moderation. We do not store your questions or generated lessons in a form linked to your account, with one narrow exception: if a question (or personalization note) is blocked by our safety filters, the flagged text — capped at 500 characters — is recorded in a pseudonymous moderation log that is automatically deleted within 90 days (see Sections 2 and 10). To improve speed, a generated lesson may be kept in a short-lived server-side cache keyed by a one-way hash of the question text (not by your identity) and is deleted automatically when it expires. However, please note that your questions are transmitted to these providers' APIs, and their own terms may govern how they handle that data. We recommend reviewing NVIDIA's Privacy Policy, Cloudflare's Privacy Policy, and Cerebras's Privacy Policy for details on their data practices.

7. Cookies and Local Storage

We use browser localStorage to store your consent preferences, theme settings, your saved-lesson history index, your learning-progress and achievement data (XP, level, streaks, daily goals, activity history, and badges), and your personalization data (the date you first used RealLearn on this device, once-per-day markers for seasonal greetings, and optional learning-style preferences with free-text notes capped at 500 characters), and browser IndexedDB to store the full content of your saved lessons (chats). We use Google Analytics cookies (loaded only after consent) for service improvement. We do not use tracking cookies for advertising. Clerk, our authentication provider, uses essential cookies for session management. For more details, please see our Cookie Policy. You can clear your localStorage and IndexedDB at any time through your browser settings or by using the "Delete My Data" feature in the app, which clears both.

Personalized learning profile (your knowledge context): RealLearn builds a compact proficiency profile entirely on your device from the saved-lesson history index and progress data already described above — no lesson content is uploaded and the profile is never stored on our servers. When you ask a question, a small, topic-relevant learning-context summary (short labels for concepts you are strong in, moderate in, or weak in, capped at a fixed length) is generated on your device and attached to that lesson-generation request so the AI can personalize the answer. This summary is processed in memory to tailor the response and is not stored, logged with any identifier, or linked to you; only a one-way hash of the summary is used to key the shared, anonymous lesson cache so that two learners with different knowledge profiles receive distinct, tailored answers. There is no separate page to browse or manage this profile — it works automatically in the background from your quiz results. If you are offline, the AI still answers; the summary is simply omitted.

8. Your Rights and Choices

Depending on where you live, you may have the following rights regarding your personal data:

• Access: You can request a copy of the personal data we hold about you using the "Export My Data" feature.
• Correction / Rectification: You can update your email through your Clerk account settings and correct locally-stored preferences directly in Settings.
• Erasure ("right to be forgotten"): You can delete your account and all associated data using the "Delete My Data" feature. This removes your MongoDB records, Clerk account, and all local data.
• Objection / Restriction: You may object to certain processing based on legitimate interests or ask us to restrict processing in specific circumstances.
• Data portability: You can receive your data in a structured, commonly used format through the export tool.
• Withdraw consent: Where we rely on consent, you can withdraw it at any time from Settings → Privacy or through your browser's cookie controls. Previously collected data may remain until deletion.
• Lodge a complaint: You have the right to complain to a data-protection supervisory authority in your country or region.

To exercise any of these rights, use the in-product tools or contact us at esamzai365@gmail.com. We will verify your identity through your authenticated account before acting on your request.

9. Third-Party Services

We use the following third-party services:

• Clerk (clerk.com) — Authentication and user management.
• Cerebras Cloud (cerebras.ai) — Our primary AI content generation provider. Your question, chosen language, and difficulty level are sent to Cerebras' API (which runs Google's Gemma 4 31B open model) for one-time inference (lesson generation only — safety moderation runs locally on our servers and is not sent to Cerebras). No user identity is included in the API call. Cerebras' own data practices apply to API requests.
• NVIDIA NIM (nvidia.com) — Our automatic fallback AI provider. Used when Cerebras is temporarily slow or unavailable. NVIDIA receives the same question, language, and difficulty level for one-time inference with no user identity attached, and no user data is used for training.
• Cloudflare Workers AI (cloudflare.com) — Our last-resortAI provider. Used only when the primary and NVIDIA fallback paths are temporarily slow or unavailable, so lessons can still be generated. It runs Google's Gemma open model hosted on Cloudflare's network. When invoked, the same question, language, and difficulty level are sent for one-time inference with no user identity attached, and no user data is used for training.
• MongoDB Atlas (mongodb.com) — Managed database hosting. Stores your consent records (keyed to your Clerk account ID — your email address is held by Clerk, not in our database), moderation logs, and anonymous feedback as described in Section 5, encrypted in transit and at rest. MongoDB acts as our storage processor and does not use your data for its own purposes.
• Vercel (vercel.com) — Hosts and serves the RealLearn web application. As the delivery infrastructure, Vercel transiently processes network request data (such as your IP address and request headers) to serve pages and protect against abuse. It does not receive your questions' lesson content or your consent records.
• Render (render.com) — Hosts our backend API. Requests you make to generate lessons, save consent, or use read-aloud pass through Render's infrastructure, which transiently processes network request data (such as your IP address) to route and serve those requests. Our own application code truncates IPs before anything is stored (see Section 2).
• Google Analytics — Website analytics to understand usage patterns and improve our service. Loaded only after cookie consent.
• Serper (google.serper.dev) — Real-world news context fetching for the "Real World" part of Explain-mode lessons. Only your question topic and language are sent; Fast-mode answers do not use this service.
• Browser Speech Recognition (Web Speech API) — Voice input is provided by your own browser. Depending on your browser and device, speech recognition may be processed by the browser vendor's speech service (for example, Google for Chrome). RealLearn never receives or stores your audio; your browser vendor's privacy policy governs that processing.
• Microsoft Edge Text-to-Speech — The "Listen" (read-aloud) feature is generated by our server using Microsoft's Edge neural text-to-speech service. Only the lesson text to be read and the chosen language/voice settings are sent; no account identity, email, or IP address of yours is included in the request to Microsoft. Microsoft's own data practices apply to that processing — see Microsoft's Privacy Statement.

10. Data Retention

We keep personal data only as long as needed for the purpose it was collected:

• Account & consent records (Clerk ID, consent timestamps, anonymized/truncated IP, hashed User-Agent; your email address is held by our authentication provider Clerk, not stored in our own database) — for as long as your account is active, and deleted from our servers within 30 days of account deletion. Full IP addresses are never retained: they are truncated before storage, and records created before policy version 2.3 have been retroactively anonymized the same way.
• Moderation logs (pseudonymous account identifier, the reason a question or response was flagged, and the flagged question itself, capped at 500 characters) — retained for abuse prevention for a maximum of 90 days, after which they are deleted automatically by a database-level expiry (TTL) rule. They are deleted earlier if you delete your account. Unlinked/aggregate safety metrics may be retained longer.
• Cached lessons and read-aloud audio (not linked to your identity) — expire automatically, typically within a few hours (lessons) or up to 24 hours (audio).
• Locally-stored data (saved lessons in IndexedDB; history index, preferences, learning progress, and optional learning personalization in localStorage) — remains on your device until you clear it or use "Delete My Data", which removes both storage areas.

We may retain limited data beyond these periods only where required by law or for the establishment, exercise, or defense of legal claims.

11. International Transfers

RealLearn relies on global service providers (including Clerk, Cloudflare, Microsoft, Google, MongoDB Atlas, Serper, Vercel, and Render), so your data may be processed in countries other than your own, including the United States. RealLearn is a small, independently operated service and does not negotiate bespoke data-transfer agreements of its own. Where personal data is transferred out of the EEA, UK, or other regions with transfer restrictions, we rely on the lawful transfer mechanisms our processors themselves publish and maintain — such as their standard data-processing terms (which typically incorporate the European Commission's Standard Contractual Clauses) and adequacy decisions where available. You may contact us to ask which provider processes a given category of data, and we will point you to that provider's published safeguards.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date. Continued use of the service after changes constitutes acceptance of the updated policy.

Version 3.4 (effective August 11, 2026). This update replaces the standalone "Find" page with an internal, quiz-driven personalization layer. RealLearn now builds a compact learning profile from your quiz results entirely on your device — no lesson content is uploaded and the profile is never stored on our servers. When you ask a question, a small, topic-relevant learning-context summary (short labels for concepts you are strong in, moderate in, or weak in, capped at a fixed length) is generated on your device and attached to that lesson request so the AI can personalize the answer; the summary is processed in memory and is not stored, logged with any identifier, or linked to you — only a one-way hash is used to key the shared, anonymous lesson cache. The separate "Find" page and its "discover related lessons" search have been removed; the optional learning-context summary replaces that data flow. No new categories of personal data are collected, and no additional data leaves your device beyond the summary described here. Because this is a material change to how your learning data is used, we are re-prompting all users to review and re-accept this Privacy Policy before continuing.

Version 3.3 (effective August 10, 2026). This update adds the new "Find" feature. Find builds a personalized map of the concepts you have proven you know (by passing lesson quizzes) entirely on your device — no lesson content is uploaded and the map is never stored on our servers. Find's optional "discover related lessons" search sends only your short goal text and coarse topic labels with a rough mastery strength to search our shared, anonymous lesson cache; that request is processed in memory to build your results and is not stored, logged with any identifier, or linked to you. No new categories of personal data are collected.

Version 3.2 (effective August 8, 2026). This update aligns the policy with the way the Service actually operates. (1) Email removed from consent records — our database no longer stores your email address on consent records (it is held only by Clerk, our authentication provider), and email fields written by older versions have been removed from all existing records. (2) Web-search scope narrowed — the Serper news-context service is now used only in Explain mode; Fast-mode questions are never sent to it. (3) Moderation-log clarification — we clarify that questions and personalization notes blocked by our safety filters are recorded in pseudonymous moderation logs (capped at 500 characters, auto-deleted within 90 days). (4) Right-sized commitments — as a small, independently operated service, we have rewritten the international-transfer, security-incident, and accessibility sections to describe only the safeguards and processes we actually maintain, rather than enterprise-level programs we do not. Because these are material changes, we are re-prompting all users to review and re-accept this Privacy Policy and the updated Terms of Service before continuing.

Version 3.1 (effective August 7, 2026). This update expands our children's privacy disclosures and parental controls, adds an explicit GDPR legal bases section, expands the DPDP Act rights list, strengthens the security section with specific technical and organizational measures, and adds a dedicated grievance-officer contact. Because these are material legal changes, we are re-prompting all users to review and re-accept this Privacy Policy and the updated Terms of Service before continuing.

Version 3.0 (effective August 7, 2026). This update discloses our hosting infrastructure providers — Vercel (serves the web app) and Render (hosts our backend API) — which transiently process network request data such as IP addresses to deliver the service. It also corrects where your email address lives (it is held by our authentication provider Clerk; our own database keys consent records to your account ID and stores no email), and reflects a data-minimization improvement: the app no longer transmits your email address with consent submissions. Because this changes our processor disclosures, we are re-prompting all users to review and re-accept this Privacy Policy.

Version 2.9 (effective August 5, 2026). This update adds NVIDIA NIM as the automatic AI fallback after Cerebras and moves Cloudflare Workers AI to a last-resort provider role. Because this is a material provider-routing disclosure change, we are re-prompting all users to review and re-accept this Privacy Policy and the updated Terms before continuing.

Version 2.7 (effective July 22, 2026). This update discloses the new optional learning personalization feature: signed-in users can choose learning-style preferences (for example, simple language, step-by-step explanations, or visual analogies) and add free-text notes about how they learn best. These preferences are stored only in your browser's localStorage and are included with each lesson- generation request so the AI can tailor its response; they are not stored on our servers. You can change or clear them anytime in Settings, and "Delete My Data" removes them. The free-text notes are capped at 500 characters. Because this changes our local-storage and data-processing disclosures, we are re-prompting all users to review and re-accept this Privacy Policy before continuing.

Version 2.6 (effective July 17, 2026). This update discloses the new optional, anonymous feedback feature: soon after a user completes their first learning journey, RealLearn may invite an optional 1–10 star rating plus free-text notes on what they liked and what to improve. The review is submitted with no account identity and we store only the rating and review text — never the IP address, Clerk ID, or email. The prompt is optional, never forced, and is suppressed once the user responds (or declines) via a local-only flag in localStorage. No new third parties and no change to analytics. We are surfacing this disclosure for transparency; the change does not re-prompt consent because no new server-side personal data is collected.

Version 2.5 (effective July 15, 2026). This update discloses new locally-stored personalization data introduced with our friendlier experience: the date you first used RealLearn on this device (shown as a "learning together for N days" counter), once-per-day markers that prevent a seasonal or time-of-day greeting from being shown twice in one day, and the on-device display of your first name (from your Clerk account) in a greeting. All of this lives only in your browser's localStorage, is never transmitted to or stored on our servers, and is removed by clearing your browser data or using "Delete My Data". No new server-side collection, no new third parties, and no change to analytics. Because this changes our local-storage disclosures, we are re-prompting all users to review and re-accept this Privacy Policy before continuing.

Version 2.4 (effective July 14, 2026). This update changes where your saved lessons live on your device: the full content of every saved lesson (chat) is now stored in your browser's IndexedDB instead of localStorage, with only a lightweight history index (question, scores, dates) remaining in localStorage. All data still stays on your device only and is never sent to our servers; re-opening a saved lesson loads it locally instead of regenerating it. The "Delete My Data" feature clears both storage areas. Because this changes our local-storage disclosures, we are re-prompting all users to review and re-accept this Privacy Policy (and the updated Terms of Service) before continuing.

Version 2.3 (effective July 14, 2026). This update strengthens data minimization: (1) IP anonymization — consent records now store only a truncated network prefix (e.g. 203.0.113.0) instead of your full IP address, and all previously stored full IPs have been retroactively anonymized in the same way; and (2) tiered local lesson-history retention — your most recent journeys are kept in full on your device while older ones are condensed to lightweight summaries instead of being deleted. Because this changes our data-processing disclosures, we are re-prompting all users to review and re-accept this Privacy Policy before continuing.

Version 2.2 (effective July 13, 2026). This update clarifies our AI inference providers: our primary model provider is now Cerebras Cloud (running Google's Gemma 4 31B), with Cloudflare Workers AI (Gemma) as an automatic fallback, and updates the Third-Party Services disclosures accordingly. Because this is a material change to our data-processing disclosures, we are re-prompting all users to review and re-accept this Privacy Policy (and our Terms of Service) before continuing. If you do not re-accept, you can still browse, but lesson generation and account features that require current consent will be paused until you do.

13. Contact Us

If you have questions about this Privacy Policy or your data, please contact us at esamzai365@gmail.com or visit our website at reallearn.site.

14. Accessibility

We try to make the Service usable by as many learners as possible and follow common accessibility practices where we can. As a small service, we do not represent or warrant conformance with WCAG or any other formal accessibility standard. If you encounter an accessibility barrier, please contact us and we will make reasonable efforts to address it.

15. Sharing Your Results

When you finish a learning journey, RealLearn lets you optionally share a result card. This card is generated entirely on your device and may include the question you asked, your quiz score, your level, and your current streak. Nothing is shared automatically — a share card is only created and sent when you tap the share or copy button. If you choose to share, the image and text are handed to your own device's share sheet, clipboard, or downloads, and any onward distribution (for example to a social network or messaging app) is controlled by you and governed by the privacy policy of the destination you select. RealLearn does not upload, store, or receive a copy of shared result cards.

16. Voice Features (Microphone & Read-Aloud)

RealLearn offers two optional voice features:

• Voice input (browser-based): The microphone is used only while you actively hold a voice-input session, and only after you grant your browser permission. Your speech is converted to text by the browser's built-in Web Speech API (or the browser vendor's speech service) and the resulting text is placed into the question box. We never receive, transmit, record, or store your audio on our servers. You can revoke microphone permission at any time in your browser settings; the feature is entirely optional and typing always works.
• Listen (read-aloud, server-generated): When you press the "Listen" button, the lesson text to be read is sent to our server, which synthesizes the audio using Microsoft's Edge neural text-to-speech service and streams the resulting MP3 back to your device. Only the lesson text and the chosen language/voice settings are sent to the speech service — no account identity is attached. To save bandwidth, the generated audio may be cached on our server for up to 24 hours, keyed by a one-way hash of the text and voice settings (never by your identity), and your browser may also cache it privately for up to 24 hours. The feature never records anything: it converts existing lesson text to audio; your microphone is not involved.

17. Automated Content Generation & Moderation

Lessons are produced by an automated AI system, and both your inputs and the generated outputs pass through automated, rule-based (pattern-matching) safety filters that run on our own servers — not a third-party AI classifier — before or shortly after content is shown. These processes are used solely to generate educational content and to keep the Service safe — they do not make legal, financial, or similarly significant decisions about you, and no automated profiling is used for advertising. Because the filters are automated and rule-based, they are imperfect and may occasionally over- or under-block; you remain responsible for verifying AI-generated information (see Section 6).

18. Security Events and Incident Response

We maintain technical safeguards such as token verification, strict input validation, rate limiting, and hardened security headers. If we confirm a personal data breach affecting your information, we will investigate, take reasonable containment and remediation actions, and provide notifications to users and regulators where and as required by applicable law.

19. Children's Privacy

RealLearn is intended for learners aged 13 and older. We do not knowingly create accounts for, or collect personal data from, children under 13. If your jurisdiction sets a higher minimum digital-consent age (for example, 16 in parts of the EEA, or 18 under India's DPDP Act for certain processing without verifiable parental consent), the same age-gating and parental-involvement requirements apply.

• Age gating: During onboarding we ask for your date of birth, and users who tell us they are under 13 cannot accept the consents required to use RealLearn — the Service is blocked for them. We store only an age bracket (under 13, 13–17, or 18+), never your exact date of birth.
• Parental approval for minors: If you are 13–17, you must check a box confirming that a parent or legal guardian has reviewed and approved your use of RealLearn. This is a self-attested confirmation; we do not currently require independent identity verification of the parent or guardian.
• What data we collect from minors: We collect the same limited categories described in Section 2. We do not knowingly collect precise geolocation, government identifiers, or other sensitive personal data from children beyond what is necessary to provide the Service.
• No ads or behavioral tracking: We do not serve targeted advertising to children and do not sell or "share" children's personal information for behavioral advertising. Analytics cookies are loaded only with consent.
• Parent/guardian controls: A parent or legal guardian may review the personal data we hold about a minor, revoke consent, request correction or deletion of the minor's account and data, or raise any concern by contacting us at esamzai365@gmail.com. We will respond promptly and take reasonable steps to verify the requestor's relationship to the child before acting.
• If a child under 13 signs up: If we learn that we have collected personal data from a child under 13 without appropriate parental consent, we will delete that data promptly. Parents or guardians who believe a child has provided us personal data without proper consent may contact us at the email above.

This section supports our obligations under laws such as the U.S. Children's Online Privacy Protection Act (COPPA), the GDPR provisions on children's data, and the parental-consent requirements of India's DPDP Act.

20. Your California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect, to access and delete it, to correct inaccuracies, and to limit the use of sensitive personal information — and the right not to be discriminated against for exercising these rights. The categories of personal information we collect are described in Section 2 (identifiers such as email and Clerk ID; internet/device information such as an anonymized/truncated IP and hashed User-Agent; and usage/education information such as questions, scores, and preferences), collected for the purposes in Section 3.

We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising, as those terms are defined under the CPRA. We use Google Analytics only with your consent and with IP anonymization enabled. Because we do not sell or share personal information, there is nothing to opt out of in that sense; you can nonetheless withdraw analytics consent at any time from Settings → Privacy, and we honor browser-based opt-out signals such as the Global Privacy Control (GPC) as a valid request to not sell or share.

You (or an authorized agent) may exercise these rights using the in-product "Export My Data" and "Delete My Data" tools or by contacting us; we will verify requests through your authenticated account.

21. India — Digital Personal Data Protection Act, 2023

If you are in India, we process your personal data as a Data Fiduciary on the basis of your consent and for the legitimate uses permitted under the DPDP Act. The DPDP Act grants you the following rights:

• Right to access: obtain confirmation and a copy of the personal data we process about you.
• Right to correction: request correction of inaccurate or misleading personal data.
• Right to erasure: request deletion of your personal data, subject to applicable exceptions.
• Right to grievance redressal: raise a complaint with our grievance officer if you are unhappy with how we handle your data.
• Right to nominate: nominate another person to exercise your rights in the event of your death or incapacity.
• Right to withdraw consent: withdraw your consent at any time, with the ease of doing so being comparable to the ease of giving consent.

Grievance Officer: you may raise any grievance regarding the processing of your personal data by writing to our grievance officer at esamzai365@gmail.com. If your concern is not resolved, you may escalate it to the Data Protection Board of India. The DPDP Act requires parental consent for users below 18: RealLearn requires users aged 13–17 to confirm during onboarding that a parent or lawful guardian has reviewed and approved their use of the service (see Section 19), and we do not undertake tracking, behavioral monitoring, or targeted advertising directed at children.

22. Grievance Officer

For users in India and any other jurisdiction that requires a designated grievance officer, our grievance officer is the privacy contact listed in Section 13. You may contact the grievance officer at esamzai365@gmail.com. We will acknowledge your grievance promptly and use reasonable efforts to resolve it within the timeframes required by applicable law. If you are not satisfied with our response, you have the right to escalate the matter to the relevant data-protection regulator or supervisory authority.