This Privacy Policy explains how Custodia Learn ("we", "our", "the app") collects, uses, and protects information about people who use the Custodia Learn mobile application. By using the app you agree to the practices described below.
Companies and roles
Custodia Learn is the owner and operator of the Service, including all intellectual property, brand assets, source code, and user data, and is solely responsible for the operation and content of the application. Custodia Learn is the data controller for the purposes of this Privacy Policy.
TOP HOUSE SOLUTIONS S.R.L. acts solely as an authorized publishing and distribution partner of Custodia Learn for the purpose of App Store and Google Play distribution. TOP HOUSE SOLUTIONS S.R.L. does not own the Service, the brand, or any user data, and bears no responsibility for the content or operation of the Service beyond its role as a technical distribution partner.
- Data Controller: Custodia Learn
- Publishing Partner: TOP HOUSE SOLUTIONS S.R.L.
- Payment Processor (App Store): Apple Inc.
- Payment Processor (Google Play): Google LLC
For all questions regarding the Service, data privacy, content, or support, please contact: custodialearn@gmail.com.
1. Who we are
Custodia Learn is the owner and operator of the Custodia Learn application and the related backend services (collectively, the "Service"). Custodia Learn is solely responsible for the operation, content, and user experience of the Service, and acts as the data controller for all personal data described in this Policy. You can reach us at custodialearn@gmail.com for any privacy-related question, including data export and deletion requests.
2. What data we collect
We collect only the data needed to operate the learning experience.
- Account & identity data (provided by you during sign-up and onboarding):
- Email address
- Display name
- Selected avatar (one of six pre-supplied illustrations — no uploaded photos)
- Selected learning goal, level, subjects, daily-time target, and reminder window
- Preferred app language (en / ru / kz / uz)
- Learning activity data (generated as you use the app):
- Enrolled courses, lesson views, lesson completions, completion timestamps
- XP earned, daily streak, leaderboard rank
- Booked teacher sessions
- Free-form questions you send to the in-app AI assistant ("Custy")
- Device & diagnostic data:
- Operating system, OS version, app version, device model
- Crash and error logs generated by the runtime
- Push notification token:
- Issued by Apple Push Notification service or Firebase Cloud Messaging and stored on our backend, paired with your account, so we can deliver study reminders and session alerts. You can revoke this at any time in your OS notification settings.
We do not collect: location, contacts, calendar entries, microphone audio, camera images, photo library content, browser history, or advertising identifiers. The app does not request these permissions.
Onboarding data. Before you create an account, the app guides you through an onboarding flow during which you provide your name, avatar choice, learning goal, subjects, level, daily time target, and reminder preference. This data is stored locally on your device only and is not transmitted to our servers at any point during onboarding. It is uploaded to our backend only when you complete registration and create an account. If you exit the app before finishing registration, this data is discarded automatically and never reaches our backend.
3. How we use the data
- Provide the service: authenticate your account, sync progress between devices, render personalized content (recommended courses, AI roadmap, leaderboard).
- Personalize your learning path: your goal/level/subject choices are sent to our AI roadmap service to generate milestones.
- Send notifications: local and remote reminders for daily study time and upcoming live sessions, only after you grant notification permission at the OS level.
- Diagnose problems: crash logs and error events help us identify and fix bugs.
- Communicate with you: respond to support requests and, where required, send service-related messages (e.g., a privacy policy update).
We do not use your data for advertising, retargeting, or marketing communications. We do not sell or rent your personal data to anyone.
4. Third parties that process data on our behalf
The following third parties process limited data strictly to deliver the service. Each is bound by a data-processing arrangement.
- Railway — hosts our backend API in the United States. Receives all account, learning-activity, and AI-question data described above.
- Apple Push Notification service / Firebase Cloud Messaging — delivers push notifications. Receives only your push token and the notification payload.
- Expo / Expo Application Services (EAS) — used for building, signing, and distributing the app binary. Does not receive runtime user data.
- OpenAI (via our backend) — processes the text of questions you send to the AI assistant in order to generate a reply. Questions are not used to train OpenAI's models. We do not send your email, name, or device identifiers along with the question.
- Sentry (sentry.io) — receives crash reports and error logs (stack traces, OS version, app version, device model, anonymous installation ID). No account email, name, learning content, or AI-chat text is sent to Sentry. Used solely to diagnose and fix bugs.
We do not use third-party advertising or analytics services.
5. Data retention
- Active accounts: we retain your account and learning data for as long as your account is active.
- Account deletion: request deletion by emailing custodialearn@gmail.com from the address on file. We will permanently delete your account and associated learning data within 30 days. Backups containing your data are purged on a 60-day rolling schedule.
- Crash and diagnostic logs: retained for 90 days, after which they are deleted.
- Legal retention: if a longer retention is required by Kazakhstani law, we will retain only the specific records required and delete the rest.
6. Your rights
You have the right to:
- Access your data — email us for a machine-readable export.
- Correct inaccurate data — most fields are editable in the Profile screen; for anything else, email us.
- Delete your data — email us as above.
- Withdraw notification permission at any time via your OS settings.
- Restrict or object to specific processing — email us with the request.
If you reside in the EU/UK, the GDPR applies and our lawful basis for processing is contract performance (delivering the service you signed up for) and our legitimate interest in operating and securing the service. You may lodge a complaint with your local data-protection supervisory authority.
7. Children
Custodia Learn is intended for users aged 16 and older. We do not knowingly collect data from anyone under 16. If you believe a child under 16 has provided us with data, contact us and we will delete it.
8. Security
- All traffic between the app and our servers is encrypted with TLS 1.2 or higher.
- Authentication tokens are stored on your device using the platform secure-storage API (
expo-secure-store, which uses iOS Keychain and Android EncryptedSharedPreferences). - Backend access is restricted to authenticated administrators with audited logs.
No system is perfectly secure. If we ever discover a breach affecting your data, we will notify you within the timeframes required by applicable law.
9. International transfers
Our backend is hosted in the United States. By using the app from outside the United States, you understand that your data will be transferred there for processing. We rely on standard contractual clauses or equivalent safeguards for transfers from the EU/UK.
10. Changes to this policy
We may update this policy from time to time. The "Last updated" date at the top reflects the current version. For material changes we will notify you via in-app notice or email before the change takes effect.
11. Contact
For all questions, requests, or concerns regarding the Service or your data, contact Custodia Learn at custodialearn@gmail.com.
TOP HOUSE SOLUTIONS S.R.L. is the authorized publishing and distribution partner only and does not handle user data, support, or service operation. Please do not address Service-related questions to TOP HOUSE SOLUTIONS S.R.L.