Privacy Policy

This Privacy Policy explains how Pratfoundy ("Pratfoundy", "we", "us", or "our") collects, uses, shares, and protects personal data when you use the Pratfoundy mobile application, the website at https://pratfoundy.app, and related services (together, the "Service").

1. Who is responsible for your data

The Service is operated under the Pratfoundy brand by an individual operator based in Latvia. The operator is the controller of personal data processed for the Service.

Privacy and support contact: info@pratfoundy.app

You may use this address to ask questions, exercise privacy rights, or request account deletion if you cannot access the app. We have not appointed a data protection officer because we are not currently required to do so.

2. Scope

This Policy applies to personal data processed through the Service. It does not govern Apple, Google, or other third parties when they process data for their own purposes under their own privacy notices.

3. Personal data we collect

3.1 Account and authentication data

Depending on how you sign in, we may process:

• email address;
• internal user ID and authentication identifiers;
• authentication provider, such as email, Google, or Apple;
• session, login, verification, password-reset, and account-security metadata;
• display name or profile information supplied by an authentication provider.

Passwords are handled by our authentication provider and stored only in hashed form. We do not have access to your plain-text password.

3.2 Profile data

We process information you provide when creating or editing a profile, including:

• username;
• first and last name;
• date of birth;
• country;
• profile picture or avatar;
• selected learning interests, knowledge level, and daily learning goal;
• acceptance of the Terms, including the version and date of acceptance.

3.3 Learning and app activity

We process information needed to operate the learning experience, including:

• completed and unlocked lessons;
• answers and lesson results;
• XP, fuel, streaks, badges, topic progress, and daily activity;
• onboarding progress;
• premium-access status and related entitlement state;
• app settings and preferences stored locally or with your account.

3.4 Purchases and subscriptions

Purchases are processed by Apple App Store or Google Play. We do not receive or store your full payment-card details. We and RevenueCat may process:

• app user ID;
• product and entitlement identifiers;
• purchase, renewal, cancellation, expiration, and restore status;
• transaction and receipt-related identifiers supplied by the app store;
• country, currency, price, and store information where provided by the platform.

Apple and Google process billing information under their own privacy policies.

3.5 Advertising and consent data

The free version of the Service may display advertisements through Google AdMob. Depending on your device, region, consent choices, and platform permissions, advertising data may include:

• advertising identifier, such as IDFA or Android Advertising ID, when permitted;
• IP address and approximate location derived from it;
• device, operating-system, language, app-version, and advertising-SDK information;
• ad impressions, interactions, diagnostics, fraud-prevention signals, and consent status.

Where required, we request consent through Google's consent platform and request Apple's App Tracking Transparency permission before accessing data used for tracking. If permission or consent is not granted, we request non-personalized or limited ads where supported. Premium users are not intended to receive in-app advertising, although advertising consent status may remain stored on the device.

3.6 Analytics and diagnostics

We use Firebase Analytics and Firebase Crashlytics to understand app operation and improve stability. Depending on consent and platform settings, these services may process:

• app opens and screen views;
• feature and lesson events;
• app instance and pseudonymous user identifiers;
• device model, operating system, app version, language, and approximate region;
• crash reports, stack traces, performance information, and technical diagnostics.

We do not intentionally send passwords, lesson-answer text, or full payment details to analytics or crash-reporting services.

3.7 Notifications

If you choose to enable learning notifications, we may process:

• an Expo push token and a pseudonymous or hashed app-installation identifier;
• device platform, app version, locale, time zone, and notification-permission status;
• your notification preferences, including the master switch, enabled reminder categories, preferred reminder time, and quiet hours;
• recent app opens or foreground/background activity, learning-goal state, streak state, fuel availability, and unfinished lesson or question context used to decide whether and where to send a reminder;
• notification category and template identifiers, eligibility and suppression results, send attempts, Expo ticket and receipt status, provider error codes, delivery-related timestamps, and notification-open/deep-link events.

We use this information to deliver the notifications you request, avoid excessive or poorly timed reminders, continue an unfinished lesson, disable invalid tokens, measure operational delivery, and troubleshoot failures. Learning notifications are optional. You may deny the device permission request, choose Not now in a later in-app reminder, turn notifications off in the app, or change permission in your device settings.

3.8 Feedback, support, and communications

If you contact us or submit feedback, we may process your email address, user ID, message, feedback category, attachments you choose to provide, technical context, and our correspondence with you.

3.9 Website and network data

When you visit our website or use online features, our hosting, security, and content-delivery providers may process IP address, browser information, request timestamps, requested URLs, and security logs. We do not use the website to collect precise GPS location.

3.10 Data we do not intentionally collect

We do not intentionally collect special-category data such as health information, biometric identifiers, religious beliefs, political opinions, or precise geolocation. Please do not submit such information through feedback or support.

4. How we use personal data and our legal bases

Where the GDPR, UK GDPR, or similar law applies, we rely on the following legal bases:

• Performance of a contract: to create and secure accounts, authenticate users, provide lessons, save progress, operate purchases and premium access, restore purchases, provide support, and deliver requested features.
• Consent: for optional learning notifications, personalized advertising, tracking, and analytics where consent is required. You may withdraw consent through available in-app, device, or platform controls.
• Legitimate interests: to maintain and improve the Service, diagnose faults, prevent abuse and fraud, protect accounts, measure non-consent-based operational performance, and establish or defend legal claims. We balance these interests against your rights.
• Legal obligations: to comply with tax, accounting, consumer-protection, privacy, law-enforcement, and other legal requirements.

We may also use data to send essential service messages, such as security, account, purchase, or material policy notices. We do not currently use your account email for unrelated third-party marketing.

Learning reminders are separate from essential service messages. We use notification and engagement data only while notifications are enabled or as needed to record the preference, honor opt-out, secure the system, resolve delivery failures, and meet legal obligations.

5. How we share personal data

We do not sell personal data for money. We share data only as needed for the Service, with consent where required, or where permitted by law.

5.1 Service providers and platforms

We use the following categories of providers:

• Supabase: authentication, database, storage, server functions, and account management;
• Google Firebase: analytics and crash diagnostics;
• Google AdMob: advertising, consent management, measurement, and ad-fraud prevention;
• RevenueCat: subscription, purchase, receipt, entitlement, and restore management;
• Apple: Sign in with Apple, App Store distribution, purchases, subscriptions, Apple Push Notification service, and related platform services;
• Google: Google Sign-In, Google Play distribution, purchases, subscriptions, Firebase Cloud Messaging, and related platform services;
• Resend: transactional and support-related email delivery where used;
• Expo / EAS: app build and delivery, Expo Push Service, push tickets and receipts, and related technical infrastructure;
• Cloudflare: website hosting, content delivery, DNS, traffic security, and network logging.

Some providers act as processors on our instructions. Others, particularly Apple, Google, and advertising providers, may act as independent controllers for some processing. Their own privacy notices apply to that processing.

5.2 Legal and safety disclosures

We may disclose information if reasonably necessary to comply with law or valid legal process, enforce our agreements, investigate fraud or security incidents, protect users or the public, or establish and defend legal claims.

5.3 Business changes

If the Service is transferred, reorganized, or sold, relevant information may be transferred subject to applicable law and continued protection.

6. International transfers

Our providers may process data outside Latvia, the EEA, the UK, or your country of residence, including in the United States. Where required, transfers are protected by an adequacy decision, the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum or equivalent safeguards, together with supplementary technical and organizational measures where appropriate.

You may contact us for more information about applicable transfer safeguards.

7. Retention

We retain personal data only for as long as reasonably necessary for the purposes described above:

• account, profile, avatar, and learning-progress data are normally retained while your account remains active;
• after an account-deletion request is completed, account-linked data under our control is deleted, subject to limited legal, fraud-prevention, security, and backup exceptions;
• purchase and subscription records may remain with Apple, Google, RevenueCat, or accounting systems for periods required by platform, tax, fraud-prevention, and legal obligations;
• support and feedback records are retained only as long as needed to respond, maintain service history, prevent abuse, or meet legal requirements;
• active push-device and engagement records are retained while needed to provide enabled notifications; tokens are deactivated when you turn notifications off or when a provider reports them as invalid, and delivery/receipt diagnostics are retained only as long as reasonably needed for caps, troubleshooting, security, and legal obligations;
• analytics, advertising, crash, security, and network logs are retained according to operational need and the applicable provider's retention settings;
• residual copies may remain temporarily in encrypted backups until those backups are overwritten under normal retention cycles. Backups are not used to recreate a deleted account except where legally required or necessary for disaster recovery.

Where information must be retained, we restrict it to the minimum necessary and delete or anonymize it when the retention purpose ends.

8. Account deletion

You can submit an account-deletion request directly in the app:

Settings → Account → Delete Account

After you submit the request, we review it and normally complete deletion within 14 days. The app confirms when the request has been received. During the review period, the account may remain accessible until deletion is completed.

You may also request deletion at https://pratfoundy.app/delete-account/ or by emailing info@pratfoundy.app if you cannot access the app. We may need to verify your identity before processing an external request.

Deletion removes the account and associated profile, avatar, learning progress, activity, badges, notification devices and preferences, account-linked delivery records, feedback, and other account-linked records under our control, except information we must retain as described above.

Deleting your Pratfoundy account does not automatically cancel an Apple App Store or Google Play subscription. Cancel the subscription in your Apple or Google account settings to prevent future renewal. Deleting the app from your device also does not cancel a subscription.

9. Your privacy rights

Depending on your location and applicable law, you may have rights to:

• access personal data and obtain a copy;
• correct inaccurate or incomplete data;
• delete personal data;
• restrict processing;
• object to processing based on legitimate interests or to direct marketing;
• receive certain data in a portable format;
• withdraw consent at any time, without affecting earlier lawful processing;
• lodge a complaint with a supervisory authority;
• appeal a refusal to act on a privacy request where applicable.

To exercise a right, email info@pratfoundy.app. We may request information needed to verify your identity and protect the account.

If you are in Latvia, you may complain to the Data State Inspectorate (Datu valsts inspekcija): https://www.dvi.gov.lv.

10. Advertising and consent controls

You can control tracking through your device privacy settings. On iOS, you can change tracking permission in Settings → Privacy & Security → Tracking. On supported devices and regions, the app may provide a Google privacy-options form for advertising consent. You may also reset or restrict your device advertising identifier through platform settings.

Withdrawal of consent does not affect processing already performed lawfully. Some strictly necessary fraud-prevention, security, and contextual-ad processing may continue where permitted by law.

10.1 Notification controls

When you first enter the Welcome screen and notification permission has not yet been decided, Pratfoundy may request permission through the iOS or Android system dialog; Home is a fallback entry point. If permission is not granted, the app may show an in-app reminder after seven days on Welcome or Home, and then every fourteen days after Not now. The prompt schedule is stored on the installation. You can always use the notification master switch in Pratfoundy Settings or change notification permission in system settings.

Turning notifications off does not remove access to lessons or other core features. A device or provider may delay or prevent a notification because of connectivity, power-saving settings, focus modes, platform rules, or other conditions outside our control.

11. Security

We use technical and organizational safeguards designed to protect personal data, including TLS encryption in transit, access controls, role-based database permissions, row-level security, restricted privileged functions, secure credential handling, logging, and dependency maintenance.

No service can guarantee absolute security. Please use a unique password, protect your device, and notify us if you suspect unauthorized account access.

12. Children

The Service is not directed to children under 13, and users under 13 may not create an account. Where local law requires a higher age for valid consent or contracts, a parent or legal guardian must provide any required authorization. We do not knowingly use personalized advertising for users we know are children.

If you believe a child has provided personal data contrary to this section, contact info@pratfoundy.app so we can investigate and delete it where appropriate.

13. Automated decision-making

We do not use personal data to make solely automated decisions that produce legal or similarly significant effects within the meaning of GDPR Article 22.

14. Changes to this Policy

We may update this Policy to reflect changes in the Service, providers, or law. We will publish the updated version and change the date above. If a change materially affects your rights or how we use personal data, we will provide additional notice where required.

15. Contact

For privacy questions, requests, or complaints:

Email: info@pratfoundy.app Website: https://pratfoundy.app