Privacy Policy

This Privacy Policy explains how Galdr Study handles personal information when you use our mobile application, account services, learning content, and related support services (together, the “Service”). Galdr Study offers learning activities about Norse and Celtic mythology, cultural traditions, and related subjects. Your answers and learning progress are part of the information described in this Policy.

We explain below what we collect, why we use it, who receives it, how long we keep it, and the choices and rights available to you. This Policy is a notice about our practices. Reading it or accepting our Terms of Use does not, by itself, constitute consent to optional analytics or the processing of sensitive personal information.

1 Who is responsible for your information

The controller of personal information processed for Galdr Study is [CONTROLLER LEGAL NAME], trading as Galdr Study, at [FULL POSTAL ADDRESS AND COUNTRY] (“we”, “us”, or “our”). A controller is the person or organisation that decides why and how personal information is processed.

Privacy requests and questions: support@galdr.study.
General support: Galdr Study support.
Website: https://galdr.study.

[IF APPLICABLE, INSERT THE NAME AND CONTACT DETAILS OF THE EEA REPRESENTATIVE, UK REPRESENTATIVE, AND DATA PROTECTION OFFICER. REMOVE THIS PARAGRAPH ONLY AFTER CONFIRMING WHICH APPOINTMENTS ARE REQUIRED.]

Apple, Google, and other providers may also process information for their own independently determined purposes, such as operating your store account or sign-in account. Their own notices apply to those activities. Their role does not remove our responsibility for the processing that we control.

2 Information you provide and information we receive

Account and sign-in information

When you sign in with Google or Apple, we receive the information made available through that sign-in process. This can include a provider-specific identifier, your email address, your name or display name, and a profile image where supplied. If you use Apple’s private email relay, we may receive a relay address instead of your personal email address. We create or associate an internal account identifier, maintain sign-in sessions, and record account creation and relevant account changes.

We do not receive your Google or Apple password. Signing in does not give us general access to your email messages, address book, cloud files, or other unrelated account contents. Information supplied by a sign-in provider depends on the permissions requested and the choices you make during sign-in.

Learning information and saved answers

We process the answers you submit, whether they are selected options or text where text entry is available. We also process information needed to show your learning state, such as the lessons and courses you access, completed exercises, correct and incorrect responses, scores, progress, review history, timestamps, and learning preferences. Features such as streaks, achievements, or saved lesson positions use the corresponding activity information when those features are available.

Answers and progress may be stored on your device and, when associated with an account or synchronised through the Service, in our Firebase-backed systems. Saving an answer is not the same as publishing it. Your saved learning information is not made public merely because you complete a lesson.

Purchase and subscription information

For in-app purchases, we and our subscription service provider receive information needed to verify and manage access. This may include an app user identifier, store transaction identifiers, purchase tokens or receipts, product identifiers, purchase and renewal dates, subscription status, trial eligibility, expiry dates, refunds, and the store or country associated with a transaction. We do not receive your full payment-card number or card security code from the Apple or Google in-app purchase process.

Communications you choose to send

If you contact us, we receive your contact details, the content of your message, any attachments you include, and information needed to respond. Please send only the information needed for your request. If you choose to include an answer, screenshot, or personal experience in a message, we process that material to handle your enquiry and any follow-up you request.

3 Technical information and diagnostics

When the Service connects to our systems or service providers, technical information may be processed, including an IP address, request time, device and operating-system type, app version, language, connection information, installation or session identifiers, and security-related events. An IP address may indicate an approximate region; it is not precise GPS location. These records help deliver requests, keep accounts secure, investigate faults, and prevent misuse.

Crash reporting, when active in your version of the app, can process a crash identifier, device and app information, the time of a failure, stack traces, and diagnostic events surrounding the failure. The current crash-reporting configuration and provider are: [CRASH REPORTING STATUS AND PROVIDER]. Optional diagnostics are governed by the choices described in Section 7. Essential operational and security logging is treated separately.

We do not intentionally include the text of personal answers, sign-in secrets, or payment credentials in analytics events or crash logs. Diagnostic information is limited to what is needed for the stated purpose. If information is inadvertently included in a report, we use it only to investigate and resolve the issue and remove or redact it where appropriate.

4 Information that can reveal personal beliefs

Studying mythology does not, by itself, establish your religion or philosophical beliefs. However, an answer or message can reveal those beliefs, health information, or another category of information that receives special protection under applicable law. We do not require you to declare a religion or adopt any belief to use Galdr Study.

Please avoid including sensitive personal details or information about other people in ordinary learning answers. Where an optional feature is specifically designed to collect or store answers that reveal protected beliefs or other sensitive information, we will explain that processing and obtain separate, explicit consent before it occurs, unless a different lawful exception genuinely applies. Acceptance of these Terms, a general analytics choice, or the fact that you typed an answer is not a substitute for that consent.

You can decline such optional processing or withdraw consent by using the relevant feature controls or contacting us. We will stop the affected processing and delete the information where required, subject to a lawful need to preserve limited information. We do not use personal answers to assign you a religious identity, create advertising audiences based on beliefs, or make decisions about your legal rights.

5 Why we use information

We use account and learning information to establish your account, recognise your sign-in, deliver lessons and feedback, save answers, calculate progress, restore your learning state, and synchronise supported information across your devices. For example, recording a completed exercise lets you resume the course without losing that progress.

We use purchase information to validate transactions, activate or restore paid access, reflect renewals and refunds, and resolve entitlement problems. We use contact information to answer support requests and send necessary service messages, such as notices about account security or material changes affecting an active service.

We use limited operational information to protect the Service, detect abuse, maintain reliability, and investigate errors. Where optional analytics is enabled with the required consent, we use usage events to understand which lessons and features are useful, where users encounter difficulties, and how the experience can be improved.

We also process information when necessary to comply with applicable obligations, respond to lawful requests, maintain required records, or establish, exercise, or defend legal claims. We do not use a broad reference to service improvement as permission to reuse personal answers for unrelated purposes.

6 Legal grounds for processing

Where the EU GDPR, UK data protection law, Serbian data protection law, or another law requiring a legal ground applies, our processing is based on the following grounds, as applicable to the particular activity:

• Providing the requested service. Account access, saving and synchronising learning information, delivering purchased content, and handling service requests rely on processing necessary to perform our agreement with you or take steps you request before entering it. Under the EU GDPR this is Article 6(1)(b).
• Legitimate interests. Proportionate security, abuse prevention, essential fault investigation, and the handling of legal claims support our interests in operating a safe and reliable service and protecting rights. We assess those interests against your rights and reasonable expectations and minimise the information used. Under the EU GDPR this is Article 6(1)(f).
• Legal obligations. We retain or disclose information where an applicable law requires it, such as required accounting records or valid regulatory requests. Under the EU GDPR this is Article 6(1)(c), where its conditions are met.
• Consent. We rely on consent for optional analytics and optional diagnostic collection, and for any other activity for which consent is required. Under the EU GDPR this is Article 6(1)(a). If protected sensitive information is processed on the basis of explicit consent, Article 9(2)(a) supplies the additional condition.

We do not treat all processing as consent-based. For example, withdrawing analytics consent does not prevent us from keeping the purchase record needed to provide a paid subscription. Where local device-storage or communications rules require consent, those rules apply in addition to the legal grounds above.

7 Optional analytics and your choices

Current product analytics status and provider: [ANALYTICS STATUS AND PROVIDER — CONFIRM BEFORE PUBLICATION].

When optional analytics is enabled, events may describe an app opening, a screen viewed, a lesson started or completed, an exercise result, a feature used, or a purchase flow reached. Associated properties can include event time, app version, device category, language, and a pseudonymous installation or user identifier. Pseudonymous information may still be personal information if it can be linked back to you.

Optional analytics and optional diagnostic reporting start only after the relevant permission has been given. You can refuse them without losing access to purchased features or ordinary learning functions. You can change your choice through [IN-APP PRIVACY CONTROL LOCATION], with withdrawal as straightforward as giving consent. Contact us if you also want previously collected identifiable information deleted.

The described analytics does not include recording your screen, replaying your session, capturing keystrokes, or sending the text of your personal answers. Those capabilities are not authorised by a general analytics choice. Any future introduction of materially different collection requires an updated explanation and the appropriate separate controls before collection begins.

We do not sell personal information, share it for cross-context behavioural advertising, or use it to build targeted advertising profiles. We do not combine your learning activity with unrelated advertisers’ data. Essential hosting, security records, account operations, and purchase validation continue when optional analytics is disabled because they serve separate operational purposes.

8 Local storage and cloud synchronisation

The app uses local storage for settings, cached course content, authentication state, and learning information needed on your device. Some local data can be synchronised to Firebase when a network connection is available. A local copy should not be assumed to be the only copy when cloud synchronisation is enabled.

Clearing app storage or uninstalling the app can remove device-only information. It does not automatically delete your cloud account or cancel a store subscription. Conversely, deleting a cloud account does not guarantee removal of files you exported yourself, screenshots you saved, or copies held in backups under your own Apple, Google, or device settings.

We use local identifiers and storage needed to provide the requested app functions. Optional analytics storage is subject to Section 7. Where a related website uses cookies or similar technologies for additional purposes, the notice and controls presented on that website explain those activities.

9 Providers and other recipients

Google Firebase

We use Firebase services for authentication and cloud data storage and, where enabled, related hosting, backend operations, security, and diagnostics. These services process the relevant account identifiers, saved learning information, technical requests, and operational records on our behalf. The Firebase products active in Galdr Study are: [CONFIRMED FIREBASE PRODUCTS]. Firebase service details are available at firebase.google.com/support/privacy.

Google and Apple sign-in

Google and Apple provide the sign-in methods described in Section 2. They process the sign-in request and provide the identity information needed for that process. Their operation of your Google or Apple account is subject to their own privacy notices: Google Privacy Policy and Apple Privacy Policy.

Apple App Store and Google Play

The store through which you purchase processes your payment and manages the store transaction under its terms and privacy notice. We receive the transaction and subscription information needed for access and support. A store may keep its own transaction records independently of our account deletion process.

RevenueCat

RevenueCat supports purchase verification and subscription entitlement management. We provide or receive relevant app user identifiers, store receipts or purchase tokens, subscription events, and technical information needed for this purpose. Its role is distinct from the store’s role in charging you. Details are available in RevenueCat’s privacy information and data processing addendum.

Optional analytics and diagnostic providers

Any active provider identified in Sections 3 and 7 receives only the categories described there for the specified purpose, subject to your choices. If PostHog is selected, it will process the configured usage events and identifiers for product analytics; enabling PostHog does not by itself authorise every feature it offers. Its privacy controls are explained at posthog.com/docs/privacy. We identify the actual active provider before the relevant collection begins.

Authorised people and necessary disclosures

Authorised personnel and contractors may access information where necessary for support, maintenance, security, or the other purposes in this Policy, subject to access restrictions and confidentiality obligations. We may also use providers that deliver support correspondence and professional advisers assisting with legal, accounting, or security matters.

We require providers processing information on our behalf to use appropriate protections and to process it for the agreed purposes under applicable contractual obligations. We may disclose limited information where legally required, to protect rights or safety in a justified case, or as part of a genuine business transfer. A business transfer does not create permission to disregard this Policy; any materially different use must have a lawful basis and the required notice.

10 International processing

Our operator location is identified in Section 1. Our providers may process information in other countries, including countries where their infrastructure, support teams, or subprocessors operate. Current primary cloud regions and relevant international access locations are: [CONFIRMED HOSTING REGIONS AND ACCESS COUNTRIES]. Choosing a European database region does not necessarily mean that every support or diagnostic operation occurs only in Europe.

Where applicable law restricts a transfer, we use a lawful transfer mechanism for that particular transfer. Depending on the destination and service, this may be a valid adequacy decision, applicable standard contractual clauses, a UK transfer instrument, or another legally available safeguard. The mechanisms applicable to our configured providers are: [CONFIRMED TRANSFER MECHANISMS].

We assess whether additional safeguards are needed and do not rely on a provider’s general compliance claim alone. You may contact us for information about the safeguards applicable to your information and a copy where available, with confidential or unrelated material appropriately removed.

11 How long we keep information

We keep identifiable information only for the period needed for its stated purpose, subject to applicable recordkeeping obligations and justified legal preservation. Our retention schedule is as follows:

Information	Retention period or criterion
Account information and cloud learning records	While your account remains active and the information is needed to provide your saved learning history. Following an accepted deletion request, removal from active systems is completed within [ACTIVE DELETION PERIOD], subject to lawful exceptions described below.
Device-only information	Until removed through app controls, device storage controls, or uninstallation, subject to device-managed backups and copies you create.
Optional identifiable analytics events	[ANALYTICS RETENTION PERIOD] from collection, or earlier where deletion is required. Removing an identifier without addressing linkable event data is not treated as full anonymisation.
Crash reports and technical logs	[DIAGNOSTIC AND LOG RETENTION PERIODS], unless a specific unresolved incident or legal obligation justifies limited longer retention.
Support correspondence	[SUPPORT RETENTION PERIOD] after the request is closed, unless needed for a continuing dispute or a legal obligation.
Purchase and financial records	While needed to verify active or restorable access, and for the applicable accounting, tax, refund, fraud-prevention, or claims period. The applicable retained record categories and statutory periods are [FINANCIAL RECORD RETENTION DETAILS].
Consent records and rights requests	For the period reasonably needed to demonstrate compliance and handle related claims: [COMPLIANCE RECORD RETENTION PERIOD].
Residual backup copies	Until overwritten or securely expired within [BACKUP EXPIRY PERIOD], with access restricted and no routine reuse of deleted information.

Any exception is limited to the information actually needed. A retained transaction record does not justify retaining all learning answers. If a backup is restored, applicable deletion requests are reapplied. We may retain statistics that have been genuinely anonymised so that individuals are no longer reasonably identifiable.

12 Deleting your account and information

You can initiate account deletion in the app through [IN-APP ACCOUNT DELETION PATH]. You can also request deletion without reinstalling the app through galdr.study/delete-data or by contacting the privacy address in Section 1.

We may ask for proportionate information to verify that the request concerns your account. After verification, we delete the account and associated personal information from the systems we control and instruct relevant processors to carry out the corresponding deletion, subject to the limited retention exceptions in Section 11. We explain any information we must retain and the reason.

Deletion includes the relevant cloud learning records and saved answers; simply disabling an account is not our substitute for deletion. Some information may remain temporarily in restricted backups until expiry. Data already anonymised so that it cannot reasonably be linked to you cannot normally be located for an individual deletion request.

Deleting your Galdr Study account does not delete your Google or Apple account. It also does not necessarily cancel an active store subscription. Manage or cancel renewal through the store used to purchase it. We do not require you to keep a subscription or make a payment to request deletion.

13 Your privacy rights

Depending on the law that applies, you may request access to your personal information, a copy, correction, deletion, restriction of processing, or portability of information you provided in a suitable electronic format. These rights have legal conditions and exceptions; for example, portability is generally linked to automated processing based on consent or contract.

You may object to processing based on legitimate interests, including related profiling, for reasons connected with your situation. We will stop that processing unless a legally permitted overriding ground or claims-related exception applies. You may object to direct marketing at any time if such marketing is undertaken.

You may withdraw consent at any time. Withdrawal does not make earlier processing unlawful, and it does not end processing independently justified on another applicable ground. To exercise a right, use the available app controls or contact us using Section 1. We will not retaliate against you for exercising a privacy right.

We may need to verify your identity or an authorised agent’s authority. We request only verification information proportionate to the risk. Under the EU GDPR, we normally respond within one month; where a permitted extension is necessary, we explain it within that initial period. Other applicable statutory deadlines apply where relevant. Requests are normally free, subject to exceptions allowed by law.

You can complain to a competent supervisory authority without first contacting us. EEA authority information is available through the European Data Protection Board. UK residents can contact the Information Commissioner’s Office. In Serbia, the authority is the Commissioner for Information of Public Importance and Personal Data Protection.

14 Automated learning functions

The Service can automatically check exercise answers, calculate scores and progress, and determine which lesson or review activity to show. These functions use your learning activity and the rules of the course. A score describes performance within the app; it does not establish a qualification, psychological characteristic, religious identity, or eligibility for an external service.

We do not use the described learning functions to make decisions producing legal or similarly significant effects on you. Contact support if you believe a recorded result or progress state is incorrect.

15 Security

We use technical and organisational measures appropriate to the information and risks involved. These include access controls, protection of network communications, authentication controls, and restrictions on administrative access. The safeguards applied to information on your device also depend on your device security and backup settings.

No internet service or storage system can be guaranteed completely secure. If we identify a personal-data breach, we assess it and notify the relevant authorities and affected people where applicable law requires. Please contact us promptly if you suspect unauthorised access to your account, and protect the Google or Apple account used to sign in.

16 Age requirements

Galdr Study is intended for people aged [MINIMUM USER AGE] and above. We do not knowingly collect personal information from children below that age through the Service. If you believe a child below that age has supplied personal information, contact us so we can investigate and take appropriate action, including deletion where required.

Where a user is permitted to use the Service but applicable law requires parental or guardian involvement, that requirement still applies. A store content rating does not, by itself, establish that a child can enter a contract or consent to every type of data processing.

17 Additional regional rights

Where an applicable US state privacy law or another regional law grants additional rights, those rights remain available. They may include confirmation of processing, access, correction, deletion, portability, an appeal of a refused request, or an opt-out of particular uses. You can submit a request or appeal through the privacy contact in Section 1, and we will explain the applicable process and decision.

We do not sell personal information or share it for cross-context behavioural advertising as described in Section 7. We do not use the information covered by this Policy for targeted advertising or solely automated decisions with legal or similarly significant consequences. We honour applicable legally recognised preference signals to the extent relevant to the processing and law concerned.

18 Changes to this Policy

We may update this Policy when the Service, providers, or legal requirements change. We publish the revised text with an updated date and give an appropriate additional notice for material changes, such as an in-app notice. We obtain a new permission where a new purpose or activity requires it. Continuing to use the app is not a substitute for consent that the law requires us to obtain separately.

You can contact us using the details in Section 1 for questions about this Policy or the handling of your personal information.