Remilo: Privacy Policy

Effective date: August 3, 2026 Last updated: September 22, 2026

This Privacy Policy explains how Lukasz Ferdyn (“Remilo”, “we”, “us”) processes personal data when you use the Remilo mobile application, website, and Remilo Capture Chrome extension (the “Service”). We are the data controller for the processing described here. Contact: privacy@remilo.app.

The short version

Your study data lives on your phone. Cards, review history, scheduling state, streaks, and settings are stored locally on your device. The app works fully offline.
We only run servers for accounts, sync, purchases, and content delivery. Sync and backup data leaving your device is encrypted before upload.
Encryption keys are managed by us on your behalf. This means we can recover your data if you lose all devices — it also means our sync is not end-to-end / zero-knowledge encryption. We say this plainly because most apps don’t.
Optional Google Drive backup goes to your Drive, using the narrowest possible permission. We never see or store your Google files; the connection tokens never leave your device.
We don’t sell your data, don’t show ads, and don’t use advertising trackers.
The Chrome extension captures only what you ask it to. On capture it reads the highlighted word or selection, the surrounding sentence, and the page URL and title, then sends that to the Remilo backend you pair it with. Pairing details and an offline queue stay in local browser storage. Host access is granted only for that one HTTPS origin, at pair time.

1. Data stored only on your device

The following is stored in the app’s local database on your device and is not transmitted to us unless you sign in and enable sync or backup:

flashcards, decks, and imported content (including Anki imports)
review history and spaced-repetition (FSRS) scheduling state
streaks, statistics, study settings, themes, and notification preferences
media files attached to your cards

If you never create an account, this is essentially all your data, and it stays with you. Uninstalling the app deletes it.

2. Data we process on our servers

Processed via Clerk (our authentication provider): email address, name (if provided by your sign-in method), sign-in identifiers (Google/Apple account linkage), and a unique user ID. Legal basis: performance of contract (Art. 6(1)(b) GDPR).

2.2 Sync and backup data (when signed in)

To sync between your devices and protect against data loss, the app uploads:

review events and study presets, encrypted on your device before upload (XChaCha20-Poly1305 authenticated encryption), stored on our backend (Convex);
encrypted backup archives of your card database and media, where you use our backup features;
a per-install device identifier and device-slot records (which devices are actively syncing), used to enforce plan limits and coordinate sync;
timestamps and technical metadata needed to order and replay sync events.

About the encryption keys: each account has a random 256-bit encryption key generated server-side and stored in your account’s protected metadata at Clerk (accessible to our backend only, never to other users or client apps, cached in your device’s secure hardware keystore). Because we manage the key, we can restore your data if you lose every device — and, as a matter of technical honesty, we (or a party that compelled us) could technically decrypt sync data. We do not access your content except as needed to operate the Service or as required by law. If you require end-to-end encryption where the provider cannot access content, this Service does not currently offer it.

Legal basis: performance of contract.

We use RevenueCat to manage subscription state, keyed to your account ID. We receive subscription status, product, renewal/expiry, and store your entitlement level (“free”/“pro”) in your account metadata. Payments are processed entirely by Apple or Google — we never receive card numbers or full payment details. Legal basis: performance of contract; legal obligation (accounting records).

2.4 AI Course Creator input (Pro free-text feature)

When you type a free-text learning goal, that text is sent through our backend to a third-party AI model provider (currently accessed via OpenRouter) to translate it into a structured course specification. The AI provider processes your prompt to return the result; we apply monthly usage limits per account. Preset course templates run entirely on-device and send nothing. Do not include sensitive personal information in free-text goals. Legal basis: performance of contract.

2.5 Content delivery

Dictionary packs, course content, and in-app messages are downloaded from our CDN (Cloudflare). Cloudflare processes your IP address and request metadata to deliver content and prevent abuse, as any web server does. Legal basis: legitimate interest (delivering and securing the Service).

2.6 Website

Our marketing website is a static site hosted on Cloudflare Pages. It sets no marketing cookies and runs no advertising trackers.

2.7 Support

If you contact us, we process your message and contact details to respond. Legal basis: legitimate interest / performance of contract.

3. Browser extension (Remilo Capture)

Remilo Capture is a Manifest V3 Chrome extension. It is an optional client of the same Service. It sends data to the Remilo backend you already use with the app. It does not add processors beyond those listed in Section 6.

Pairing. You pair the extension to your phone with a short code and a Convex HTTPS server URL that you enter (your Remilo backend). Until you pair it, capture data is not sent to a server.

What is collected on capture. When you capture via the context menu or a keyboard shortcut, the extension reads from the active page:

the highlighted word or selection
the surrounding sentence
the page URL and title

This is for your own Remilo account and device flow. It is not sold and is not used for ads.

Where it is sent. After pairing, the extension queues captures locally and POSTs encrypted/sealed payloads to the Convex /api/mutation endpoint at the HTTPS origin you configured.

Local storage. The pairing credential and the offline queue are stored in chrome.storage on your computer. Uninstalling the extension removes that storage.

Host permission. Optional host access is requested at pair time for that one HTTPS origin, so the extension can call your backend. It is not always-on access to all sites.

Legal basis: performance of contract.

4. Google Drive backup (optional, your cloud)

If you connect Google Drive, encrypted backup files are uploaded to a Remilo folder in your own Google Drive. Key facts:

We request only the drive.file scope: the app can see and manage only files it created — never your other Drive files.
The connection tokens are stored only in your device’s secure storage and never reach our servers. Uploads go directly from your device to Google.
Backups in Drive are encrypted with the same account key described in Section 2.2.
Disconnecting stops future uploads; you choose whether existing backup files are kept or deleted. Rotation keeps the most recent 7 backups; pruned files go to your Drive trash (user-recoverable).

Remilo’ use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. What we do NOT do

We do not sell or rent personal data.
We do not show ads or share data with advertising networks or data brokers.
We do not use your flashcards, review history, or free-text AI prompts to train AI models, and our contracts with AI providers prohibit training on this data.
We do not read your card content except where strictly necessary to operate a feature you invoked, to debug an issue with your consent, or where required by law.

6. Our processors and recipients

Provider	Role	Data	Location
Clerk	Authentication, account metadata (incl. encryption key, entitlement)	Account data, key material	USA
Convex	Backend: encrypted sync events, device slots, entitlement relay, extension captures	Encrypted study events, device IDs, capture payloads	USA
RevenueCat	Subscription management	Account ID, subscription state	USA
Apple / Google	App distribution, payment processing, sign-in (optional)	Per their own privacy policies (independent controllers for payments)	Global
Cloudflare	CDN, content hosting, website	IP address, request metadata	Global (EU edge available)
Google (Drive)	Your chosen backup destination (only if you connect it)	Encrypted backups, in your account	Per your Google account
[AI provider / OpenRouter]	Processing free-text course goals (Pro)	Prompt text, account-level usage counts

Where providers are outside the EEA/UK, transfers rely on adequacy decisions (including the EU–US Data Privacy Framework where certified) or Standard Contractual Clauses.

7. Retention

Local data: yours, on your device, until you delete it or uninstall.
Account and sync data: kept while your account exists; deleted when you delete your account (Section 8).
Extension local data: pairing credential and queued captures in chrome.storage, until you uninstall the extension. Once uploaded to your backend, the same retention as account and sync data applies.
Encrypted cloud backups on your Drive: yours; we keep nothing.
Purchase records: retained as required by tax and accounting law up to 10 years.
AI prompts: we retain usage counts; prompt retention by the AI provider is governed by its terms up to 30 days.
Support correspondence: up to 24 months after resolution.

8. Account deletion and your controls

Delete account (in-app: Settings → Account → Delete account). This permanently deletes your Clerk account (including your encryption key and entitlement metadata), your encrypted sync data on our backend, and wipes the app’s local data on that device. Backups in your own Google Drive are not deleted by us — they are in your Drive, under your control (and without the key, they become unreadable). Deletion is not reversible.

Sign out is different from deletion: signing out keeps your study data on the device.

Export. You can export your cards in Anki-compatible formats (.apkg) at any time, and a machine-readable data export is available in Settings.

9. Your rights

Depending on your location (GDPR/UK GDPR, CCPA/CPRA, and similar laws), you have the right to access, correct, delete, and receive a copy of your personal data, to restrict or object to processing, to withdraw consent, and to not be discriminated against for exercising rights. Most of these you can exercise directly in-app (export, deletion). For anything else, email privacy@remilo.app; we respond within the statutory deadline (one month under GDPR, extendable as permitted). You may lodge a complaint with your supervisory authority (the relevant data protection authority, or your local authority). We do not “sell” or “share” personal information as defined by the CCPA/CPRA.

10. Children

The Service is not directed at children under 13 (or the higher local age of digital consent, e.g. up to 16 in parts of the EU). We do not knowingly collect personal data from children below that age; if you believe a child has provided us data, contact us and we will delete it.

11. Security

Measures include: encryption in transit (TLS) for all network traffic; client-side authenticated encryption of sync and backup payloads before upload; per-account keys stored in backend-only protected metadata and, on-device, in hardware-backed secure storage (Keychain/Keystore); server-side entitlement and access enforcement (clients cannot read other users’ data or forge entitlements); secrets held only in server environments, never in the app. No system is perfectly secure; we will notify you and authorities of personal-data breaches as legally required.

12. Changes

We may update this Policy. Material changes will be announced in-app or by email with reasonable notice. The current version is always at https://remilo.app/privacy.

13. Contact

Data controller: Lukasz Ferdyn privacy@remilo.app