Privacy policy

1. Who we are

LectureQuiz is provided by Seastack Labs LLC. Contact support@lecturequiz.com for support or privacy questions. LectureQuiz is an iPhone study app that converts PDF and TXT documents into flashcards and supports spaced repetition. You do not need a named LectureQuiz account. This does not mean that all information processed by the app is anonymous or that no personal information is involved.

2. Information we handle

Your library and study activity

Your source documents, topics, decks, flashcards, and review history are stored in the app’s on-device library. When iCloud sync is enabled, library information can also be stored and synchronised through your private Apple iCloud account. Apple manages your Apple Account and iCloud service.

Onboarding answers and settings

During setup you can tell us what to call you, your age range, and study details such as your country, school or university, subject, courses, next exam date, what you find hardest, and how you heard about LectureQuiz. On supported iOS versions, the app may ask Apple to share your age range instead of asking you. These answers, your choice about AI processing, and your reminder settings are stored on your device and in your private iCloud key-value storage, so they are available on your other devices signed in to the same Apple Account. LectureQuiz isn’t available to children under 13: if you tell us, or Apple’s age range shows, that you are under 13, setup ends there and none of your answers are stored or sent. With your permission, your study details (never your name or country) are sent once to our backend and OpenAI to write a short personalized study plan; our backend does not keep that request.

Generation, installation, and usage information

When you generate cards, we process your source material and the resulting cards, along with request identifiers, job status, technical errors, and usage information. We also process installation or other pseudonymous identifiers, authentication metadata, free-allowance information, subscription entitlement information, and generation usage records to operate the service, apply limits, prevent duplicate charges or processing, and help prevent abuse. To share your generation allowance and subscription across your own devices without an account, the app keeps a random credential in your iCloud Keychain and private iCloud database; our servers store only a one-way hash of it, and devices presenting the same credential share one allowance and one subscription customer identifier. We use Apple App Attest to check that requests come from a genuine copy of the app.

Purchases

Apple processes in-app purchases. We use RevenueCat to help validate and manage subscription entitlements. Purchase-related information can include transaction identifiers, product identifiers, subscription status, expiry dates, and pseudonymous customer identifiers. We do not receive your full payment card details.

App analytics and diagnostics

We use PostHog for product events associated with a random or anonymous identifier. Events contain counts and categories, such as generation or study activity, rather than document or flashcard text. PostHog also receives content-free backend logs and AI generation metrics, including model and token usage, processing times, outcomes, and cost monitoring. We do not enable session replay or automatic capture of taps and screens. Your age range and how you heard about LectureQuiz can be recorded as categories; your name and study details are not. We use Sentry for sanitised crash reports and technical diagnostics. Diagnostic information can include app and operating-system versions, device characteristics, error details, and technical context. Sanitisation reduces the information included; diagnostics and pseudonymous identifiers can still constitute personal information.

Notifications and tracking permission

Study, exam, and trial-ending reminders are scheduled locally by iOS on your device. The app may ask for permission under Apple’s App Tracking Transparency. We do not currently track you across other companies’ apps or websites, access your device’s advertising identifier, or share information with data brokers. If that changes, we will update this policy and the App Store privacy details first.

Support and website visits

If you email us, we receive your email address, message, and any attachments or other information you choose to provide. Website and infrastructure providers may process IP addresses, request information, and security logs when you access the website or app services.

3. What happens during generation

Your documents are sent for processing when you request flashcard generation. They pass through our backend, hosted with OVHcloud, and are provided to OpenAI to produce the cards. PDF uploads use a generic filename; TXT content is sent as text. The material itself may still contain identifying or sensitive information. We configure OpenAI requests with response storage disabled. We attempt to delete provider-uploaded files after processing and retry failed deletion attempts. These measures do not mean that all provider security logs, abuse-monitoring records, or backups are immediately deleted. Provider retention and applicable terms also govern that processing. Only upload material you are authorised to use and share for generation. Review the contents before uploading, particularly if a document includes another person’s information. Reviewing saved cards does not require sending your source document for generation again. Learn more at OpenAI’s business data page.

4. Why we use information and who receives it

We use information to provide generation and study features, synchronise your library when enabled, manage purchases and generation limits, keep the service reliable and secure, understand product usage, respond to support requests, and meet applicable obligations. The service providers involved include:

• Apple / iCloud: app distribution, payments, App Attest, age-range sharing when you allow it, and your private iCloud library, settings, and allowance credential.
• OpenAI: document processing, flashcard generation, and the onboarding study plan.
• OVHcloud: backend hosting and temporary generation processing.
• Neon: backend database hosting for operational records.
• Cloudflare: network ingress, security, and request delivery.
• RevenueCat: purchase validation and subscription entitlements.
• PostHog: pseudonymous product analytics, content-free backend logs, and AI generation metrics.
• Sentry: sanitised crashes and diagnostics.
• Vercel: website hosting and related delivery and security logs.
• Email service providers: delivery and handling of support correspondence.

We may also disclose information where required by law, to respond to lawful requests, to protect rights and safety, or in connection with a business transfer subject to applicable privacy requirements. We do not sell your document or flashcard content or use it for targeted advertising.

5. How long information is kept

Retention depends on the type of information and the reason it is processed:

• On-device and iCloud library: kept until you remove it through the available app or Apple controls. Device and iCloud backups may follow separate Apple settings and retention.
• Onboarding answers and settings: kept on your device and in your iCloud key-value storage until you delete the app’s data or your iCloud data.
• Temporary backend source material: scheduled for cleanup after generation completes or fails.
• Generated backend results: expire after 24 hours. Saved copies in your app library remain available separately.
• Expired authentication metadata: cleaned up after 7 days.
• Detailed settled-job metadata: cleaned up after 30 days.
• Minimal operational records: idempotency outcomes, installation records, free-allowance information, subscription records, usage records, and associated history are retained to operate the service, reconcile usage, prevent abuse, and meet applicable obligations. They do not all expire with a generation result.
• Analytics, diagnostics, infrastructure logs, and support: retained according to operational needs and applicable provider settings. Contact us about particular records.

Cleanup may be delayed by failures and retries. Deletion from active systems does not guarantee immediate removal from provider logs, backups, or records retained for legal, security, or accounting reasons.

6. Your choices and privacy requests

You can choose which documents to submit for generation, review saved cards offline, and use the app without a named LectureQuiz login. iCloud sync depends on the app’s sync availability and your Apple settings. Apple provides controls for iCloud storage and subscriptions, and iOS Settings controls notifications and tracking permission for LectureQuiz. You can change your name and reminders in the app’s Settings. You can remove library content using the app’s available controls. Removing local app data, deleting iCloud data, and requesting deletion of backend records are different actions; one does not necessarily perform the others. To ask to access, review, correct, or delete personal information associated with you, email support@lecturequiz.com. Depending on your location and applicable law, you may have additional rights, such as portability, restriction, or objection to certain processing, or the right to contact a privacy regulator. We may request information needed to verify the request and locate the relevant records. An email address alone may not identify an app installation. We will explain where records cannot be identified or where an exception limits a request. You do not need to provide your Apple Account password or payment card details.

7. Website cookies and tracking

This website does not use advertising cookies, website analytics, or session replay. It does not intentionally track your activity across third-party websites to build an advertising profile. Hosting and security services may still process request information, including IP addresses. We do not change the website’s behaviour in response to browser Do Not Track signals because we do not conduct that kind of cross-site tracking. App analytics and diagnostics are described above and are separate from this website. Links to Apple, OpenAI, or other external sites take you to services governed by their own policies. Visiting those sites may involve their own data collection.

8. Other details

International processing

Seastack Labs LLC is based in the United States. Our service providers may process information in the United States and other countries. Data-protection laws may differ from those where you live. Contact us if you need more information about the processing of your information.

Security

We use technical and organisational measures intended to protect information, including service authentication and limits on the information included in diagnostics. No storage or transmission method can be guaranteed completely secure.

Children’s information

LectureQuiz is not available to children under 13. If someone indicates during setup, or Apple’s age range shows, that they are under 13, setup ends with a message that the app isn’t available; their answers are not stored or sent, and the device keeps only a note that setup ended this way. If you believe a child has supplied personal information in circumstances requiring a parent or guardian’s permission, contact us so we can review the circumstances and take appropriate action.

9. Changes and contact

We may update this policy as the product or our processing changes. We will publish the updated policy here and revise the effective date. For material changes, we will provide additional notice through the app or other appropriate means where required. For a question about this policy or a privacy request, contact Seastack Labs LLC at support@lecturequiz.com.