Privacy Policy

1.General information

This Privacy Policy explains which personal data Rekuro processes when you visit the website, create an account and use Rekuro to study.

Processing is carried out in accordance with the General Data Protection Regulation (GDPR) and the German Telecommunications Digital Services Data Protection Act (TDDDG). Your account and learning data are stored in a database in the European Union. Some of our service providers are based in the USA; sections 6 and 7 explain when data leaves the EU.

2.Controller

The controller responsible for data processing within the meaning of the GDPR is:

Levin Linsler
Buschweg 5
73087 Bad Boll
Germany
Email: contact@getrekuro.com

3.Data we collect

When you open Rekuro, our hosting provider automatically processes technical data needed to deliver the website and keep it secure:

• IP address
• Date and time of the request
• Page requested and HTTP status
• Browser, operating system and referrer URL

Visitor statistics without cookies. To see how many people visit Rekuro and how they find it, our server counts page views when it delivers a page. Nothing is stored on your device and no cookies are used. We store only daily totals: the page, the referring website (or the ref value in the link), the country (derived from your IP address) and the device type (phone, tablet or computer). To count a visitor only once per day, a one-way hash of IP address, browser and language is combined with a random key that changes every day; the key and these hashes are deleted the next day, so you cannot be recognized across days. Your IP address itself is not stored for this.

Protection against abuse. To protect sign-in, sign-up, uploads, AI features and other functions against automated attacks, we count requests per IP address and per account for a short time. The IP address is stored only as a one-way hash.

• Email address
• Display name (optional)
• Time zone, so that cards become due at the right time of day
• Groups you belong to and your role in them
• Sign-in and session data (e.g. time of last sign-in)

• Lectures, lessons and flashcards you create or import (CSV, Anki export)
• Your study settings, such as the lessons in your review cycle and "Ask in both directions"
• Your review history: ratings, timestamps and scheduling state used for spaced repetition (FSRS)
• Answers in extra practice, kept separately from your review history

PDF slides you upload and the text extracted from them, which is used to ask and grade questions about your slides.

• Questions the AI Lecturer asked you, with a model answer, so that your answer is graded against the same question
• Usage records for each AI request (time, feature, model, amount of text processed and cost), to enforce usage limits

Answers you type for the AI Lecturer are sent to our AI provider for grading (section 6), but we do not store them.

If you look around a semester with its invite code before creating an account, the code is checked on our server. The code and your lesson choice are kept only in your browser (see the Cookie Policy).

We send emails only for your account: to confirm your email address, to reset your password and to confirm a change of email address. For this we process your email address and the content of the email.

4.Purposes and legal bases

• Providing the website and keeping it secure, including protection against abuse (3a): Art. 6(1)(f) GDPR, our legitimate interest in a stable and secure service.
• Visitor statistics without cookies (3a): Art. 6(1)(f) GDPR, our legitimate interest in understanding how Rekuro is found and used. You can object at any time (section 9).
• Your account, learning features, AI features, group sharing, guest access and account emails (3b–3g): Art. 6(1)(b) GDPR, performance of the contract (our Terms of Use) or steps prior to entering into it.
• Optional cookies and similar technologies: Art. 6(1)(a) GDPR and § 25(1) TDDDG, your consent. Details are in the Cookie Policy.
• Legal obligations, e.g. retention duties: Art. 6(1)(c) GDPR.

We do not sell your data and do not use it for advertising.

5.Who can see your content

• Your personal lectures, cards and review history are visible only to you.
• Members of your groups can see your display name and the cards and decks you add to the group.
• Lecture slides are visible only to the members of the group they were uploaded to, or only to you for a personal lecture. Because slides may be protected by copyright, they are never public.

Access is enforced in the database itself (Row Level Security), not only in the interface.

6.AI features

For the AI Lecturer, AI card creation and the AI card check, we send the content needed for the task to the Claude API provided by Anthropic PBC, 548 Market Street, San Francisco, CA 94104, USA. Depending on the feature, this includes the relevant slide text, the question, your answer or the cards being created or checked. We do not send your email address or name.

Anthropic processes this data on our behalf to generate the response and stores it in the USA. The response itself may be computed in data centers in other countries (Anthropic's global routing). Under Anthropic's commercial terms, data sent through the API is not used to train its models. Anthropic deletes it within 30 days; if its automated safety systems flag a request as a possible violation of its Usage Policy, Anthropic may keep it for up to 2 years.

Because Anthropic is based in the USA, data is transferred to a third country. This transfer is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), which are part of Anthropic's Data Processing Addendum.

AI grades and suggestions are study feedback only. They do not lead to any decision with legal or similarly significant effect on you (Art. 22 GDPR).

Please do not put sensitive personal data (yours or anyone else's) into cards, answers or slides.

7.Service providers

We use the following processors, bound by data processing agreements under Art. 28 GDPR:

• Supabase (Supabase Inc., USA): database, sign-in and file storage. Our project is hosted in the EU (Paris, France).
• Vercel (Vercel Inc., USA): website hosting. Our server functions run in the EU (Frankfurt, Germany); pages are delivered through Vercel's worldwide network. Transfers to the USA are based on the EU-US Data Privacy Framework and/or the EU Standard Contractual Clauses.
• Anthropic (Anthropic PBC, USA): AI features, see section 6.
• Brevo (Sendinblue SAS, France): sending account emails (section 3g).

Beyond that, we only share personal data if we are legally obliged to do so.

8.Storage duration

• Server logs: deleted after a short period, usually within 30 days, unless needed to investigate a security incident.
• Visitor statistics: the daily hashes and the daily key are deleted the next day; the daily totals contain no personal data and are kept.
• Abuse protection: the hashed request counters are deleted after 2 days at the latest.
• Account and learning data: stored as long as your account exists. When you delete your account, we delete it right away: your account, profile, personal lectures and cards, learning progress and history, AI records and the slides of your personal lectures.
• Content you shared with a group: cards you added to a group deck and slides you uploaded to a group stay available to the group after you delete your account, but are no longer linked to you. If you were the only member, the group and its content are deleted. If you were the only owner, the longest-standing member becomes the owner. You can delete shared content yourself before deleting your account, or ask us to remove it.
• Backups: our database provider keeps backups for a limited time. Deleted data disappears from them when the backup expires, at the latest after 30 days.
• Lecture slides: stored until they are deleted by the uploader or a group owner, or until the group is deleted.

9.Your rights

You have the right to:

• Access your data (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Object to processing based on legitimate interest (Art. 21 GDPR)
• Withdraw your consent at any time with effect for the future (Art. 7(3) GDPR)

In your profile you can download a copy of your data ("Download my data") and delete your account ("Delete account") at any time. For everything else, contact us at the address above. You also have the right to lodge a complaint with a data protection supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg.

10.Security

We use technical and organizational measures to protect your data against loss, misuse and unauthorized access, including encrypted connections (TLS), access control at database level, limits on failed sign-in attempts and storage in the EU. Secret keys are used on the server only.

11.Changes

We may update this Privacy Policy when Rekuro's features or legal requirements change. The current version is always available on this page.