Privacy Policy
Last updated November 14, 2026
This explains what Gleaneum collects, why, who else handles it, and how you see, download or delete it. We never sell your data or show you ads. The rules for using the app are the Terms of Service.
Who we are
Gleaneum is run from Victoria, Australia. We decide how your personal data is used, so we are its controller.
Write to support@gleaneum.com about anything in this policy.
What we collect
- Your account: your email address, your name, your password in a form we cannot read, and the sign-in provider you used.
- From Google or Apple, if you sign in with one: the address of your profile picture and an account id.
- Your age and your agreement: your date of birth, and which versions of these documents you accepted and when.
- Your choices: the kind of learner you are, whether you have a private tutor or teacher, your language, and your time zone, which the app reads from your device.
- What you add: files, links, pasted text, photos, recordings, cards you write and files you attach in the tutor.
- What the app makes from it: flashcards, quizzes, exercises, notes, slide decks, video lessons, timelines and language sets.
- How you study: your answers, scores, review dates and the mastery of each concept, your goals and study sessions.
- Tutor conversations, the sentences you write in Language practice, and the answers you report to us.
- Your plan: which plan you are on, its dates and status, the credits you were given and spent, and how much of each limit you have used.
- Payments: Stripe holds your card details, and we never see the full number. If you cancel a plan, we keep the reason you choose and any note you add.
- Email: which kinds of email you chose to receive, a record of those choices, and whether an email to you bounced.
- Security records: requests to delete your account, with the IP address and browser that made them, and requests for a copy of your data.
- Sign-in records: the IP address and browser of each sign-in session, and a log of sign-ups and sign-ins, kept by our sign-in provider.
- Server logs: the address of each request to our servers, with your IP address and account id.
Why we use it
| What we do | Legal basis |
|---|---|
| Run your account, read the sources you add and make the study materials you ask for | Our contract with you |
| Answer your questions in the tutor and check your answers | Our contract with you |
| Schedule reviews from your answers (the mastery model) | Our contract with you |
| Check your age and keep a record of what you accepted | Legal obligation and legitimate interests |
| Keep accounts secure, stop abuse and hold each plan to its limits | Legitimate interests |
| Take payments and keep tax records | Our contract with you and legal obligation |
| Send the emails your account needs, like a deletion link | Our contract with you |
| Send product news, only if you switch it on and confirm it by email (from age 16) | Your consent |
| Keep a record of what you agreed to receive and when | Legal obligation |
We have no advertising, no analytics trackers and no data brokers. We do not use your material to train AI models.
An account needs an email address, a name, a date of birth, and a password or a Google or Apple sign-in. The app also asks what kind of learner you are and whether you have a tutor or teacher before it opens. Everything else you give us is your choice.
The mastery model
From your answers the app estimates how well you know each concept and when to show it again. That is automated processing of your data, and it only decides what to study next.
It has no legal effect on you, and nobody else sees it. Deleting a space deletes everything the model learned from it.
How the AI works with your data
When you add a source, we read it straight away. An AI model writes its summary and study map, and turns scanned pages and photos into text.
Recordings are transcribed, and a search index is built from the passages of every source.
When you ask for study materials or ask the tutor, we send the parts of your sources the request needs to an AI model. Your material is never used to answer another learner.
One thing is shared for a short time: the captions of a public YouTube video are cached, so the next learner who adds that video does not wait.
The tutor and the study materials are made by AI, and the app labels the tutor as AI. The voices that read aloud are made by a computer. AI can be wrong, so check what matters against your sources.
A picture in a slide deck is a figure from your source, an archive photograph from Wikimedia Commons or, for adults only, a picture drawn by AI.
Who else handles your data
These companies handle data so that the app can work. Each one is listed with what it does and what it receives.
| Provider | What it does | What it receives |
|---|---|---|
| Anthropic (United States) | The AI model that reads your sources, writes study materials and tutor answers, and checks answers | Your sources when you add them, then the parts a request needs: passages, tutor messages and attachments, and answers to be checked. It does not train on them. |
| Voyage AI, part of MongoDB (United States) | Turns text into search vectors | Passages of your sources, and the short texts the app searches or compares with: tutor questions, the focus of a note, concept names, and the cards, questions and claims being checked. Voyage AI does not train or improve its models on it. |
| Microsoft Azure (Australia) | Transcribes uploaded audio and video, reads cards, lessons and Language text aloud and reads pages the main model cannot | The recording, the text to be read aloud and the page it reads. |
| Supadata (Germany) | Fetches the captions of a YouTube video you add | The public link of the video, nothing about you. |
| OpenAI (United States) | Draws pictures for slide decks, never for learners under 18 | A few words describing the picture, and a code only our server can link to an account. OpenAI does not use it to train its models. |
| Wikimedia Commons (United States) | Finds archive photographs for slide decks | Search words taken from the deck, such as the name of a person or a place. Nothing about you. |
| Supabase (United States) | Database, sign-in, sign-in emails and profile photos | Your account, its sign-in records and everything you study. A profile photo can be opened by anyone who has its address. |
| Railway (United States) | Runs our servers, background jobs and short-lived caches | Requests as they pass through, server logs, and queued jobs and cached items for up to 40 days. |
| Cloudflare (Oceania) | Hosts the website and stores your files | Your files, and requests to the website. |
| Resend (United States) | Sends our emails | Your email address, the email, your account id, and whether it was delivered. |
| Microsoft 365 | Holds the mailbox you write to | The emails you send to our support address. |
| Stripe (United States and Ireland) | Takes payments | Your email address, account id, billing name and address, a tax ID if you give one, and the reason and note you give when cancelling. Stripe holds your card details. |
| Google, Apple | Sign-in, if you choose it | They tell us your name, your email address, the address of your profile picture and an account id. |
| YouTube | Plays a YouTube source when you open it | Your IP address. Its privacy-enhanced player may store data in your browser under Google’s policy. Our server also asks YouTube for a video’s page and title, and nothing about you goes with that. |
Stripe, Google, Apple and YouTube also use what they receive for their own purposes, under their own privacy policies.
Where your data is stored
Your account, your study data and our servers are in the United States. Your files are stored by Cloudflare in Oceania.
Recordings are transcribed in Australia, YouTube captions are fetched through Germany, and the other providers work in the United States.
Moving data out of the EU or the UK is covered by standard contracts written for that purpose: the European Commission’s Standard Contractual Clauses and the UK addendum to them.
Where a provider is certified under the EU-US Data Privacy Framework, that certification applies as well.
You can ask us for a copy of these safeguards.
How long we keep it
| Data | Kept for |
|---|---|
| Your account and everything in it | Until you delete it, or delete the account |
| A new account that holds nothing, when its email address is never confirmed or the age question is never answered | 30 days, then deleted |
| Files of a deleted account | Removed from storage within an hour of the deletion |
| A copy of your data you asked for | 7 days, then the file is deleted |
| Security records | 2 years, then deleted. They stay after an account is deleted. |
| Sign-in records | Sessions go with the account. The log of sign-ups and sign-ins stays with our sign-in provider after an account is deleted. |
| Which emails we sent you, without their content | 1 year, then deleted. They stay after an account is deleted. |
| Your email choices and their record | Until you delete the account |
| Short-lived server caches | Up to 40 days |
| Server request logs | 7 days |
| Payment and tax records | As long as tax law requires, held by Stripe |
When an account is closed because its holder is under the minimum age, we keep a security record that it was closed, without the birth date, beside the records above that stay after any account is deleted.
Your rights
You can ask to see your data, correct it, delete it, take a copy, limit how we use it or object to its use. Where we rely on your consent, you can withdraw it.
- Download a copy of your account from Settings, under Security. It holds your data and the files you added, and is kept 7 days.
- The copy leaves out only what the app made from your data and can make again: the search index, read-aloud audio, deck pictures, and the PDF, Word and PowerPoint files you exported.
- Delete your account from Settings, under Security. We email a link first, and the deletion removes your spaces, study materials, conversations and files.
- If you have a plan that renews, cancel it before you delete the account.
- Edit your name, photo and language in Settings.
- For anything else, write to support@gleaneum.com. We answer within one month.
You can also complain to your data protection authority. In Australia that is the Office of the Australian Information Commissioner, and in the UK the Information Commissioner’s Office.
If you are in the UK and complain to us first, we acknowledge your complaint within 30 days.
If you live in the United States, we do not sell your personal information or share it for advertising. You have the rights listed here, and you can appeal a decision by writing to support@gleaneum.com.
We do not track you across other sites, so there is nothing for a Do Not Track signal to switch off.
Learners under 18
Gleaneum is for learners 13 and over and is not directed to younger children. The app asks for a date of birth before it opens. If you are under 18, the Terms ask for a parent’s or guardian’s permission to use it.
With an email sign-up we ask before the account is made. With Google or Apple the account exists first, and we ask before the app opens.
If we learn that an account belongs to someone under 13, we delete it with everything in it. A parent or guardian who thinks this has happened can write to support@gleaneum.com.
- No ads, no selling data, no public profiles and no messaging between learners.
- The tutor says it is an AI and follows safety rules written for teenagers, and any answer can be reported to us.
- Learners under 18 never get pictures drawn by AI, and nothing about them is sent to OpenAI.
- Product news is offered only from age 16.
Security
Data is encrypted in transit and at rest. Each account’s data is kept apart by database rules, and you can add two-step sign-in in Settings.
If a breach puts your data at risk, we tell the authorities within 72 hours where the law requires it. We tell you without delay when the risk to you is high.
Changes to this policy
When this policy changes, the date at the top changes too. For a change that matters, we email you at least 30 days before it applies and ask you to accept it in the app.
Contact
Gleaneum, Victoria, Australia. Email support@gleaneum.com.