Privacy Policy

1. Who we are

Lernoa is operated by Corvidae Limited (New Zealand) ("we", "us", "our"). This Privacy Policy explains how we collect, use, disclose, store, and protect personal information when you use the Lernoa website and app (the "Service").

We are a New Zealand company and we comply with the New Zealand Privacy Act 2020 and its Information Privacy Principles. The short version of our whole approach: we collect the minimum we need to run a study app, we never sell your data or use it to train AI models, and you can export or delete everything in one tap.

2. What we collect

2.1 Information you provide

• Account details: Email address, display name, and a password (or a social sign-in via Google or Microsoft).
• Decks and cards: The decks and cards you create, import (from Anki or CSV), or generate with AI, including any images you add.
• Study activity: Your reviews, self-ratings, review schedule, streaks and progress: the data the spaced-repetition engine needs to schedule your next review.
• AI generation prompts: The topic, level and card count you enter when you generate a deck with AI. See section 4.
• Payment information: Payments are processed by Stripe. We receive limited billing details (such as which credit pack you bought and the last four digits of your card) but never your full card number. All purchases are one-off. We hold no recurring billing mandate.
• Communications: Messages you send via the contact form or support channels.

2.2 Information collected automatically

• Usage data: Features used and credit transactions (so we can show your balance and history).
• Device information: IP address (from which we derive your approximate country at sign-up and sign-in), browser type, operating system.
• Cookies and similar technologies: See section 9.

2.3 We keep it minimal

Your decks and study history belong to you. We collect only what the features need, we never sell your data, we never share it with advertisers, we don't build advertising profiles from it, and we don't use your content to train AI models. Lernoa is a study tool, not a medical or professional-advice service.

3. How we use your information

We use personal information to:

• Provide the Service: store your decks and cards, run the spaced-repetition engine, sync across your devices, and show your progress and stats
• Generate decks with AI from the topics you enter
• Manage your credit balance and process one-off purchases
• Send you service messages (receipts, security notices, support replies), not marketing, unless you opt in
• Respond to your inquiries and provide support
• Detect, prevent, and address technical issues, abuse, or fraud
• Comply with legal obligations

Where the law requires consent for particular processing (for example, non-essential cookies), we ask for it first, and you can withdraw it at any time.

4. AI features

When you generate a course or deck, chat about a course or document, or listen to a course, Lernoa uses AI services within Amazon Web Services: Amazon Bedrock (running Anthropic Claude models) for generation and chat, and Amazon Polly for audio narration. Here is exactly what happens:

• Per-request only: Your topic or the relevant text of your document/course is sent securely to the AI provider, which returns the draft course, deck, answer or audio. The provider processes the request in the moment and does not retain your content or use it to train its models.
• What we keep: The generated course or deck lives in your account, where you can edit or delete it. Narration audio is cached privately in your account's storage so it is only synthesized once, and is deleted with the course. You control it entirely.
• No training on your content: Your prompts, documents, courses, decks and study history are not used to train AI models, ours or anyone else's.
• Drafts are drafts: AI output can be wrong or incomplete. You can review and edit cards, and verify course content, before or after you study it.

5. ChatGPT and AI assistant integrations

You can choose to connect your Lernoa account to ChatGPT, Claude, or another AI assistant that supports the Model Context Protocol (MCP), through our server at api.lernoa.com/mcp. See our ChatGPT plugin help page for the full list of what it can and cannot do. In summary:

• You choose to connect it. The integration is off until you approve it, and you approve it through an OAuth consent screen that names the assistant and lists exactly what it can and cannot do.
• What it can request: only your own courses, decks, cards, subjects, chapters, course notes, materials, and study settings and progress, and only when the assistant calls a tool to fetch or change one of those categories in response to something you asked it to do.
• Task-relevant data only: each tool call returns only the data needed for that specific request, not a bulk copy of your account.
• No chat-history access: Lernoa does not receive your full conversation history with ChatGPT or any other assistant, only the specific inputs sent when a tool is called.
• Disconnecting: you can disconnect an assistant at any time from Settings, "Connected AI apps", in the Lernoa app, or from that assistant's own connected-apps settings. Disconnecting revokes its access immediately.
• Disconnecting does not delete your account. It only ends that assistant's access; your Lernoa account and content remain exactly as they were. Deleting your account is a separate action in Settings.

6. When we share information

We do not sell your personal information, and we do not share your decks or study history with advertisers. We disclose personal information only in these situations:

• Service providers: Trusted third parties that run parts of the Service under confidentiality and security obligations:
  • Amazon Web Services (AWS): hosting, database and file storage
  • AI generation and chat (Amazon Bedrock, running Anthropic Claude models): per-request only; no retention, no training on your content
  • Audio narration (Amazon Polly): per-request synthesis of your course text; no retention, no training on your content
  • Amazon SES: account and notification emails
  • Stripe: one-off payment processing
  • Cloudflare Turnstile: bot and abuse protection
  • Google and Microsoft: optional social sign-in; analytics and ad measurement only where enabled and consented (see section 9)
  • OpenAI: ad measurement (the ChatGPT Ads pixel) only where you have agreed or where consent is not required (see section 9)
• Legal requirements: When required by law, court order, or governmental authority.
• Business transfers: In connection with a merger, acquisition, or sale of assets (you will be notified).
• Protection: To protect our rights, property, or safety, or that of our users.

Data location: The Service is hosted on AWS in the Asia-Pacific region (New Zealand and Australia). Some providers (for example, Stripe, Google, and Microsoft) operate globally. When personal information is disclosed overseas, we take reasonable steps to ensure it receives protection comparable to the NZ Privacy Act 2020, as Information Privacy Principle 12 requires.

7. Security and retention

• Data is encrypted in transit and at rest
• Access controls and authentication protect our systems
• AI generation prompts are processed per-request and not retained by the AI provider (section 4)
• Your decks and study history are kept while your account is active so your schedule and progress work

When you delete your account (one tap in Settings), your personal information is deleted. We may retain limited records where the law requires it (for example, tax records of purchases). No method of transmission over the Internet is 100% secure, but we work hard to protect your information.

8. Your rights: export and delete in one tap

Under the NZ Privacy Act 2020 you have the right to access and correct your personal information. We go further and build the controls in:

• Export: Download your complete decks and account data in a structured, machine-readable format, one tap in Settings.
• Delete: Permanently delete your account and all your data, one tap in Settings, no email ping-pong, no retention dark patterns.
• Access & correction: Your decks and cards are fully visible and editable in the app at all times.
• Complaints: Contact us first at [email protected]. If you are not satisfied, you can complain to the Office of the Privacy Commissioner (privacy.org.nz).

9. Cookies and similar technologies

We keep tracking to a minimum. Strictly necessary cookies and browser storage (the ones that keep you signed in or remember a preference) need no consent. Everything else falls into two optional categories, Analytics and Advertising, and you decide about each one separately.

• In the EEA, the UK or Switzerland, or if we can't tell where you are: both categories are off until you switch them on. A banner asks on your first visit, with "Accept all" and "Reject all" side by side, and nothing is requested from Google, Microsoft or OpenAI until you agree.
• Everywhere else: both start on (Advertising stays off if your browser sends a Global Privacy Control signal), and you can switch them off at any time.
• Changing your mind: use "Cookie settings" in the footer of this site, Settings → Privacy & cookies in the app, or the link on the sign-in page. Withdrawing takes effect immediately, and the cookies we set for that category are removed.
• Your choice is remembered in one cookie shared by lernoa.com and app.lernoa.com, so you are asked once for both. It is stored only in your browser, and we ask again after 6 months or when we add a new category or provider.

Strictly necessary (always on)

• lernoa.identity: keeps you signed in. A first-party, HttpOnly cookie that lasts up to 7 days.
• lernoa_consent: remembers your cookie choice above. Lasts 6 months.
• lernoa_country: the country our server works out from your IP address (the address itself is not kept in it). It tells us whether consent is required and lets us show prices in your currency. Lasts 24 hours.
• lernoa_lang: the language you pick in the language menu, so this site and the app open in it next time. Lasts 1 year. Until you pick one we show the language your browser asks for, or failing that the main language of the country above; nothing is stored for that guess.
• lernoa_ref: the invite code from a friend's link, so you both receive the referral credits when you sign up. Lasts 30 days.
• Storage on your device: your language, theme and currency, your study progress and offline review queue, course bookmarks, and short-lived items such as an invite code or where to return to after signing in. It stays on your device until you clear it.
• Cloudflare Turnstile: protects the sign-up, sign-in and contact forms from bots.
• Stripe: when you buy credits you go to Stripe's own checkout page, which sets its own cookies under Stripe's policies.

Analytics (optional)

• Google Analytics 4: counts visits and page views so we can see what is used. Sets _ga and _ga_<id> (up to 2 years), with IP anonymisation on.
• Microsoft Clarity: records how pages are used (clicks, scrolling and navigation) as session replays and heatmaps, and sets _clck (1 year) and _clsk (1 day). Inside the app all on-screen text is masked, so the content of your decks, materials and chats is not captured. Microsoft processes this data under its own privacy statement.
• Where you found us: if another website, a search or a campaign link brought you to Lernoa, the cookie lernoa_src keeps the name of that site, the page of ours you landed on and any campaign tag for up to 30 days. If you then create an account we record it on the account, so we can tell which channels are worth our time; it is never combined with your decks, materials or study history.

Advertising (optional)

• Google Ads: sets _gcl_au and _gcl_aw (about 90 days) so we can tell whether an ad click led to a sign-up.
• OpenAI (ChatGPT) Ads pixel: tells OpenAI that a sign-up followed an ad on ChatGPT, so we can measure that campaign. OpenAI sets its own identifiers under its own privacy policy.

• No ad tracking of your study data: Your decks and study history are never used for advertising, and we never send them to these providers.
• Fonts: we host our fonts ourselves, so opening Lernoa does not send a request to Google Fonts.

10. Children's privacy and educational use

The Service is not intended for individuals under 16 years of age. We do not knowingly collect personal information from children under 16. If you believe we have, please contact us immediately.

The ChatGPT and AI assistant integration described in section 5 is built to be appropriate for a general audience, including users aged 13 to 17, and is not aimed at or marketed to children under 13. This is separate from the minimum age to hold a Lernoa account: because the integration only ever operates within an existing, authenticated Lernoa account, and creating that account already requires you to be at least 16 (see our Terms and Conditions), no one under 16 can use the integration in the first place.

• Progress is not an official grade. Course completion, quiz scores, and study statistics shown in Lernoa or returned through an AI assistant are self-assessment only. They are not an accredited grade, qualification, or result from any school, university, or examination body.
• No guarantee of exam success. Lernoa is a study aid. We do not guarantee any exam, test, or assessment outcome from using it.
• Academic integrity. Lernoa and its AI assistant integration are designed to support learning, for example by explaining material, building study aids, and organising revision. They must not be used to complete graded coursework, assignments, or controlled or live assessments on a student's behalf, or otherwise to misrepresent someone else's work as the student's own.
• Copyright and takedown. If you believe content stored in a Lernoa account infringes your copyright, contact [email protected] with a description of the work and its location, and we will review and act on the request; see our Support page for details.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new policy on this page and updating the "Last updated" date. We will never quietly downgrade your privacy: material changes to how we handle your decks or study data will be announced in the app.

12. Contact

Questions, concerns, or requests about this Privacy Policy or our data practices: