Legal

Who We Are (Data Controller)

RealLearn ("RealLearn", "we", "us") is the data controller / data fiduciary responsible for the personal data described in this policy. For all privacy, data-protection, and grievance matters — including requests to exercise your rights under the GDPR, the California Consumer Privacy Act (as amended by the CPRA), or India's Digital Personal Data Protection Act, 2023 (DPDP Act) — you can reach our privacy contact and designated grievance officer at esamzai365@gmail.com. We aim to acknowledge grievances promptly and respond within the timelines required by applicable law.

1. What RealLearn Is

RealLearn is an AI-powered educational platform. Depending on the answer mode you choose, it generates either a quick single-part direct answer ("Fast" mode) or a 3-part learning journey (Foundation, Mechanism, Real World — "Explain" mode) for any topic you ask about. It is powered by Google's Gemma 4 open model: our primary inference provider is Cerebras Cloud (running Gemma 4 31B), with Cloudflare Workers AI (Gemma) configured as an automatic fallback so lessons can still be generated if the primary is slow or unavailable. This is designed to help students learn through interactive quizzes and structured content.

2. Information We Collect

We collect the following information to provide and improve our service:

• Account Information: Your email address and Clerk ID (provided by our authentication provider, Clerk).
• Usage Data: The questions you ask, your selected answer mode (Fast or Explain), language and learning level, quiz scores, and lesson progress.
• Device Information: Your IP address and browser User-Agent (for security, consent tracking, and rate limiting). Before an IP address is written to a stored consent record we anonymize it by truncation (the last part of the address is removed, e.g. 203.0.113.0), so stored records never contain your full IP address; the User-Agent is stored only as a salted one-way hash.
• Consent Records: Timestamps of when you accepted our Privacy Policy (version 2.8), Terms of Service (version 2.6), and cookie/analytics consent, together with the policy version, an anonymized (truncated) device IP, and a hashed User-Agent, kept as proof of consent.
• Cached Lessons (temporary, not linked to you): To make the Service faster, generated lessons may be temporarily cached on our servers, keyed by a one-way hash of the question text, language, level, and answer mode. Cached lessons contain no account information, are not linked to your identity, and expire automatically (typically within a few hours).
• Voice Input (optional): If you choose to use the microphone button, your speech is converted to text by your browser's built-in speech recognition. We never receive, record, or store your audio — only the resulting text appears in the question box, exactly as if you had typed it. See Section 16 for details.
• Read-Aloud Audio (temporary, not linked to you): If you use the "Listen" feature, the lesson text to be read aloud is sent to our server, which generates the audio using Microsoft's Edge text-to-speech service. The resulting audio may be temporarily cached on our server (for up to 24 hours), keyed only by a one-way hash of the text, language, and voice settings — never by your identity — so that repeated playback of the same text does not need to be re-synthesized. See Section 16 for details.
• Saved Lessons: Your learning journeys (chats) are stored locally on your device, split across two browser storage areas for performance: the full lesson content (lesson text and quizzes) of every journey is stored in your browser's IndexedDB, while a lightweight index (question, scores, dates, and part/quiz counts) is kept in localStorage. Both live only on your device and are never transmitted to or stored on our servers; re-opening a saved lesson loads it directly from your device.
• Optional Feedback (anonymous, not linked to you): Soon after you complete your first learning journey, RealLearn may invite you to leave an optional review: what you liked, what we should improve, and a 1–10 star rating. This feedback is completely anonymous. When you submit it, we store only the review text and rating — we deliberately strip and never include your IP address, Clerk ID, or email, and the request is sent with no account identity attached. The prompt is optional and never forced: you can skip it, ask to be reminded later, or dismiss it permanently. Once you have responded (or permanently declined), we record a single local flag in your browser so the prompt does not appear again — this "given" flag lives only in your device's localStorage and is never sent to our servers. You can clear it at any time with "Delete My Data".
• Learning Progress & Achievements (stored locally): To power our engagement features, we keep a record on your device of your experience points (XP) and level, your daily learning streak and any streak "freezes", your daily goal and progress toward it, an activity history of the days you studied (dates and how many parts you completed each day), the achievement badges you have earned, and aggregate counts such as lessons completed, quizzes passed, perfect scores, follow-up questions asked, and which languages and subjects you have explored. This information is stored only in your browser's localStorage. It is not transmitted to or stored on our servers, and clearing your browser data or using "Delete My Data" removes it.
• Personalization & Delight Data (stored locally): To make the app feel personal, we keep a small amount of information in your browser's localStorage only: (1) the date you first used RealLearn on this device, used to show a friendly "learning together for N days" counter; (2) simple once-per-day markers that record whether a seasonal or time-of-day greeting (a small "surprise" message) has already been shown today, so we never show it twice; and (3) optional learning preferences you can set after signing in — a checklist of learning-style choices (for example, simple language, step-by-step explanations, or visual analogies) plus free-text notes about how you learn best. These learning preferences are stored only on your device, can be changed or cleared anytime in Settings, and are not stored on our servers; they are simply included with each lesson- generation request so the AI can tailor its response. We cap the free-text notes at 500 characters. If you are signed in, your first name (provided by Clerk) may be displayed in an on-screen greeting — this happens entirely in your browser. None of this information is transmitted to or stored on our servers (except the learning preferences, which are sent only with the lesson request and then discarded), and clearing your browser data or using "Delete My Data" removes it.
• Moderation Logs: When a question you submit or an AI response is blocked by our safety filters, we record a moderation log entry containing the reason the content was flagged, the question that triggered the flag (limited to the first 500 characters), and a pseudonymous account identifier. These logs never contain your email, IP address, or other personal identifying information, and never contain internal error details. They are automatically and permanently deleted after 90 days by a database-level expiry rule, or immediately when you delete your account — whichever comes first.

3. How We Use Your Information

• To generate personalized learning content for you.
• To track your progress and quiz performance.
• To power gamification and engagement features — experience points, levels, daily streaks, daily goals, and achievement badges — which are calculated and stored locally on your device to help you build a learning habit.
• To show friendly, personalized touches — a time-of-day greeting (optionally using your first name, rendered only in your browser), a local counter of how many days you have used RealLearn, and small once-per-day seasonal surprises — all computed and stored locally on your device.
• To tailor lesson generation using your optional, locally-stored learning preferences (learning-style checklist and free-text notes), which are sent with each lesson request and not retained on our servers.
• To analyze usage patterns through Google Analytics and improve our service.
• To comply with legal obligations and age-appropriate content rules.
• To improve our educational content quality and service experience.
• To communicate important service updates (if you provide contact consent).

4. Data Storage and Security

Your account data (email, consent records) is stored securely in MongoDB. Your saved lessons, preferences, and all learning-progress and achievement data (XP, level, streaks, daily goals, activity history, and badges) are stored in your browser's local storage areas on your own device — full lesson content in IndexedDB, and the history index, preferences, and progress data in localStorage — and never leave it. We use industry-standard security measures including Clerk for authentication with cryptographically verified session tokens, encrypted connections (HTTPS with HSTS), strict browser security headers, request rate limiting, size limits and validation on all input, and automated content moderation. However, no method of electronic storage is 100% secure, and we cannot guarantee absolute security.

5. AI-Generated Content

RealLearn generates content using Google's Gemma 4 open AI model. Our primary inference provider is Cerebras Cloud (running Gemma 4 31B); if Cerebras is temporarily slow or unavailable, the request automatically falls back to Cloudflare Workers AI (Gemma) so your lesson can still be generated. All lesson content (in both Fast and Explain modes), quizzes, and explanations are AI-generated and are not reviewed by humans before being shown. AI-generated responses may be inaccurate, incomplete, or outdated. You should verify important information with qualified professionals or authoritative sources. The Service is for educational purposes only and does not provide professional advice (medical, legal, financial, etc.).

Lesson content is written in a natural, conversational, human-like style — but it is entirely AI-generated. Nothing in the Service is written or reviewed by a human tutor before you see it.

RealLearn does not use your data to train, fine-tune, or improve any AI model. Your questions are sent to our primary inference provider, Cerebras Cloud (which runs the Gemma model), for one-time inference only. If Cerebras is temporarily slow or unavailable, the same request falls back to Cloudflare Workers AI (also running Gemma) for one-time inference so the lesson can still be generated; the same "no training on your data" commitment applies to both providers. Safety moderation of your question and the generated lesson is performed locally on our own servers using rule-based pattern matching — your question is not sent to any third party just for moderation. We do not store your questions or generated lessons in a form linked to your account. To improve speed, a generated lesson may be kept in a short-lived server-side cache keyed by a one-way hash of the question text (not by your identity) and is deleted automatically when it expires. However, please note that your questions are transmitted to these providers' APIs, and their own terms may govern how they handle that data. We recommend reviewing Cloudflare's Privacy Policy and Cerebras's Privacy Policy for details on their data practices.

6. Cookies and Local Storage

We use browser localStorage to store your consent preferences, theme settings, your saved-lesson history index, your learning-progress and achievement data (XP, level, streaks, daily goals, activity history, and badges), and your personalization data (the date you first used RealLearn on this device, once-per-day markers for seasonal greetings, and optional learning-style preferences with free-text notes capped at 500 characters), and browser IndexedDB to store the full content of your saved lessons (chats). We use Google Analytics cookies (loaded only after consent) for service improvement. We do not use tracking cookies for advertising. Clerk, our authentication provider, uses essential cookies for session management. For more details, please see our Cookie Policy. You can clear your localStorage and IndexedDB at any time through your browser settings or by using the "Delete My Data" feature in the app, which clears both.

7. Your Rights

• Access: You can export all your data using the "Export My Data" feature.
• Deletion: You can delete your account and all associated data using the "Delete My Data" feature. This removes your MongoDB records, Clerk account, and all local data.
• Rectification: You can update your email through your Clerk account settings.
• Objection: You may decline consent, which will prevent us from storing new data, though previously stored data may remain until deletion.

8. Third-Party Services

We use the following third-party services:

• Clerk (clerk.com) — Authentication and user management.
• Cerebras Cloud (cerebras.ai) — Our primary AI content generation provider. Your question, chosen language, and difficulty level are sent to Cerebras' API (which runs Google's Gemma 4 31B open model) for one-time inference (lesson generation only — safety moderation runs locally on our servers and is not sent to Cerebras). No user identity is included in the API call. Cerebras' own data practices apply to API requests.
• Cloudflare Workers AI (cloudflare.com) — Our automatic fallback AI provider. Used only when the primary (Cerebras) is temporarily slow or unavailable, so lessons can still be generated. It runs Google's Gemma open model hosted on Cloudflare's network. When invoked, the same question, language, and difficulty level are sent for one-time inference with no user identity attached, and no user data is used for training.
• MongoDB Atlas (mongodb.com) — Managed database hosting. Stores your account record (Clerk ID, email), saved preferences, consent records, and feedback as described in Section 4, encrypted in transit and at rest. MongoDB acts as our storage processor and does not use your data for its own purposes.
• Google Analytics — Website analytics to understand usage patterns and improve our service. Loaded only after cookie consent.
• Serper (google.serper.dev) — Real-world news context fetching for the "Real World" part of Explain-mode lessons. Only your question topic and language are sent; Fast-mode answers do not use this service.
• Browser Speech Recognition (Web Speech API) — Voice input is provided by your own browser. Depending on your browser and device, speech recognition may be processed by the browser vendor's speech service (for example, Google for Chrome). RealLearn never receives or stores your audio; your browser vendor's privacy policy governs that processing.
• Microsoft Edge Text-to-Speech — The "Listen" (read-aloud) feature is generated by our server using Microsoft's Edge neural text-to-speech service. Only the lesson text to be read and the chosen language/voice settings are sent; no account identity, email, or IP address of yours is included in the request to Microsoft. Microsoft's own data practices apply to that processing — see Microsoft's Privacy Statement.

9. Data Retention

We keep personal data only as long as needed for the purpose it was collected:

• Account & consent records (email, Clerk ID, consent timestamps, anonymized/truncated IP, hashed User-Agent) — for as long as your account is active, and deleted from our servers within 30 days of account deletion. Full IP addresses are never retained: they are truncated before storage, and records created before policy version 2.3 have been retroactively anonymized the same way.
• Moderation logs (pseudonymous account identifier, the reason a question or response was flagged, and the flagged question itself, capped at 500 characters) — retained for abuse prevention for a maximum of 90 days, after which they are deleted automatically by a database-level expiry (TTL) rule. They are deleted earlier if you delete your account. Unlinked/aggregate safety metrics may be retained longer.
• Cached lessons and read-aloud audio (not linked to your identity) — expire automatically, typically within a few hours (lessons) or up to 24 hours (audio).
• Locally-stored data (saved lessons in IndexedDB; history index, preferences, learning progress, and optional learning personalization in localStorage) — remains on your device until you clear it or use "Delete My Data", which removes both storage areas.

We may retain limited data beyond these periods only where required by law or for the establishment, exercise, or defense of legal claims.

10. International Transfers

RealLearn relies on global service providers (including Clerk, Cloudflare, Microsoft, Google, MongoDB Atlas, and Serper), so your data may be processed in countries other than your own, including the United States. Where personal data is transferred out of the EEA, UK, or other regions with transfer restrictions, we rely on lawful transfer mechanisms — such as the European Commission's Standard Contractual Clauses (and the UK Addendum), adequacy decisions where available, and the safeguards our processors themselves maintain. You may contact us to ask about the safeguards applicable to a specific transfer.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date. Continued use of the service after changes constitutes acceptance of the updated policy.

Version 2.7 (effective July 22, 2026). This update discloses the new optional learning personalization feature: signed-in users can choose learning-style preferences (for example, simple language, step-by-step explanations, or visual analogies) and add free-text notes about how they learn best. These preferences are stored only in your browser's localStorage and are included with each lesson- generation request so the AI can tailor its response; they are not stored on our servers. You can change or clear them anytime in Settings, and "Delete My Data" removes them. The free-text notes are capped at 500 characters. Because this changes our local-storage and data-processing disclosures, we are re-prompting all users to review and re-accept this Privacy Policy before continuing.

Version 2.6 (effective July 17, 2026). This update discloses the new optional, anonymous feedback feature: soon after a user completes their first learning journey, RealLearn may invite an optional 1–10 star rating plus free-text notes on what they liked and what to improve. The review is submitted with no account identity and we store only the rating and review text — never the IP address, Clerk ID, or email. The prompt is optional, never forced, and is suppressed once the user responds (or declines) via a local-only flag in localStorage. No new third parties and no change to analytics. We are surfacing this disclosure for transparency; the change does not re-prompt consent because no new server-side personal data is collected.

Version 2.5 (effective July 15, 2026). This update discloses new locally-stored personalization data introduced with our friendlier experience: the date you first used RealLearn on this device (shown as a "learning together for N days" counter), once-per-day markers that prevent a seasonal or time-of-day greeting from being shown twice in one day, and the on-device display of your first name (from your Clerk account) in a greeting. All of this lives only in your browser's localStorage, is never transmitted to or stored on our servers, and is removed by clearing your browser data or using "Delete My Data". No new server-side collection, no new third parties, and no change to analytics. Because this changes our local-storage disclosures, we are re-prompting all users to review and re-accept this Privacy Policy before continuing.

Version 2.4 (effective July 14, 2026). This update changes where your saved lessons live on your device: the full content of every saved lesson (chat) is now stored in your browser's IndexedDB instead of localStorage, with only a lightweight history index (question, scores, dates) remaining in localStorage. All data still stays on your device only and is never sent to our servers; re-opening a saved lesson loads it locally instead of regenerating it. The "Delete My Data" feature clears both storage areas. Because this changes our local-storage disclosures, we are re-prompting all users to review and re-accept this Privacy Policy (and the updated Terms of Service) before continuing.

Version 2.3 (effective July 14, 2026). This update strengthens data minimization: (1) IP anonymization — consent records now store only a truncated network prefix (e.g. 203.0.113.0) instead of your full IP address, and all previously stored full IPs have been retroactively anonymized in the same way; and (2) tiered local lesson-history retention — your most recent journeys are kept in full on your device while older ones are condensed to lightweight summaries instead of being deleted. Because this changes our data-processing disclosures, we are re-prompting all users to review and re-accept this Privacy Policy before continuing.

Version 2.2 (effective July 13, 2026). This update clarifies our AI inference providers: our primary model provider is now Cerebras Cloud (running Google's Gemma 4 31B), with Cloudflare Workers AI (Gemma) as an automatic fallback, and updates the Third-Party Services disclosures accordingly. Because this is a material change to our data-processing disclosures, we are re-prompting all users to review and re-accept this Privacy Policy (and our Terms of Service) before continuing. If you do not re-accept, you can still browse, but lesson generation and account features that require current consent will be paused until you do.

12. Contact Us

If you have questions about this Privacy Policy or your data, please contact us at esamzai365@gmail.com or visit our website at reallearn.site.

13. GDPR (European Users)

If you are in the European Economic Area, you have the right to access, rectify, erase, restrict, or object to processing of your personal data. You also have the right to data portability and to lodge a complaint with a supervisory authority. Our lawful basis for processing your data is your consent and our legitimate interest in providing the educational service. You can exercise these rights through the "Export My Data" and "Delete My Data" features, or by contacting us.

14. Accessibility

We are committed to making our Service accessible to all users. We aim to conform to WCAG 2.1 Level AA standards. If you encounter any accessibility barriers, please contact us and we will work to address them.

15. Sharing Your Results

When you finish a learning journey, RealLearn lets you optionally share a result card. This card is generated entirely on your device and may include the question you asked, your quiz score, your level, and your current streak. Nothing is shared automatically — a share card is only created and sent when you tap the share or copy button. If you choose to share, the image and text are handed to your own device's share sheet, clipboard, or downloads, and any onward distribution (for example to a social network or messaging app) is controlled by you and governed by the privacy policy of the destination you select. RealLearn does not upload, store, or receive a copy of shared result cards.

16. Voice Features (Microphone & Read-Aloud)

RealLearn offers two optional voice features:

• Voice input (browser-based): The microphone is used only while you actively hold a voice-input session, and only after you grant your browser permission. Your speech is converted to text by the browser's built-in Web Speech API (or the browser vendor's speech service) and the resulting text is placed into the question box. We never receive, transmit, record, or store your audio on our servers. You can revoke microphone permission at any time in your browser settings; the feature is entirely optional and typing always works.
• Listen (read-aloud, server-generated): When you press the "Listen" button, the lesson text to be read is sent to our server, which synthesizes the audio using Microsoft's Edge neural text-to-speech service and streams the resulting MP3 back to your device. Only the lesson text and the chosen language/voice settings are sent to the speech service — no account identity is attached. To save bandwidth, the generated audio may be cached on our server for up to 24 hours, keyed by a one-way hash of the text and voice settings (never by your identity), and your browser may also cache it privately for up to 24 hours. The feature never records anything: it converts existing lesson text to audio; your microphone is not involved.

17. Legal Bases and Regional Rights

Where required by law, we process personal data under one or more lawful bases: your consent (for optional analytics and policy acceptance records), our contract with you (to provide account access and learning features), and our legitimate interests (to keep the service secure, prevent abuse, and improve reliability). Depending on your region (including the EEA/UK and California), you may have rights to access, delete, correct, port, or restrict processing of your personal data, and to appeal where legally available. You can exercise available rights using in-product tools ("Export My Data", "Delete My Data") or by contacting us.

18. Security Events and Incident Response

We maintain technical and organizational safeguards such as token verification, strict input validation, rate limiting, and hardened security headers. If we confirm a personal data breach affecting your information, we will investigate promptly, take containment and remediation actions, and provide legally required notifications to users and regulators within applicable timelines.

19. Children's Privacy

RealLearn is intended for learners aged 13 and older, and our content covers school-level topics. We do not knowingly create accounts for, or collect personal data from, children under 13 (or under the minimum digital-consent age in your jurisdiction — for example, 16 in parts of the EEA, or 18 for certain processing under India's DPDP Act without verifiable parental consent).

• If you are below the applicable minimum age, please use RealLearn only with the involvement and consent of a parent or legal guardian.
• For learners aged 13–17, we require an explicit confirmation during onboarding that a parent or guardian has reviewed and approved their use of RealLearn. This is a self-attested confirmation — we do not currently operate an independent identity-verification process for parents.
• We do not knowingly serve targeted advertising to children and do not sell or "share" children's personal information.
• Parents or guardians who believe a child has provided us personal data without proper consent may contact us to have it reviewed and deleted, and we will act promptly.

This section supports our obligations under laws such as the U.S. Children's Online Privacy Protection Act (COPPA), the GDPR provisions on children's data, and the parental-consent requirements of India's DPDP Act.

20. Your California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect, to access and delete it, to correct inaccuracies, and to limit the use of sensitive personal information — and the right not to be discriminated against for exercising these rights. The categories of personal information we collect are described in Section 2 (identifiers such as email and Clerk ID; internet/device information such as an anonymized/truncated IP and hashed User-Agent; and usage/education information such as questions, scores, and preferences), collected for the purposes in Section 3.

We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising, as those terms are defined under the CPRA. We use Google Analytics only with your consent and with IP anonymization enabled. Because we do not sell or share personal information, there is nothing to opt out of in that sense; you can nonetheless withdraw analytics consent at any time from Settings → Privacy, and we honor browser-based opt-out signals such as the Global Privacy Control (GPC) as a valid request to not sell or share.

You (or an authorized agent) may exercise these rights using the in-product "Export My Data" and "Delete My Data" tools or by contacting us; we will verify requests through your authenticated account.

21. India — Digital Personal Data Protection Act, 2023

If you are in India, we process your personal data as a Data Fiduciary on the basis of your consent and for the legitimate uses permitted under the DPDP Act. You have the right to access, correct, and erase your personal data, to withdraw consent, to nominate another person to exercise your rights in the event of death or incapacity, and to a readily available grievance-redressal mechanism.

Grievance Officer: you may raise any grievance regarding the processing of your personal data by writing to our grievance officer at esamzai365@gmail.com. If your concern is not resolved, you may escalate it to the Data Protection Board of India. The DPDP Act requires parental consent for users below 18: RealLearn requires users aged 13–17 to confirm during onboarding that a parent or lawful guardian has reviewed and approved their use of the service (see Section 19), and we do not undertake tracking, behavioral monitoring, or targeted advertising directed at children.

22. Automated Content Generation & Moderation

Lessons are produced by an automated AI system, and both your inputs and the generated outputs pass through automated, rule-based (pattern-matching) safety filters that run on our own servers — not a third-party AI classifier — before or shortly after content is shown. These processes are used solely to generate educational content and to keep the Service safe — they do not make legal, financial, or similarly significant decisions about you, and no automated profiling is used for advertising. Because the filters are automated and rule-based, they are imperfect and may occasionally over- or under-block; you remain responsible for verifying AI-generated information (see Section 5).