Your learning is yours.
The short version: we store the cards and reviews that spaced repetition needs. Four features send material to an AI — checking an answer, asking about a card, building a deck, and turning a recording into text — and each sends only what that specific job needs. We never sell your data or train models on it. The details are below.
Last updated August 13, 2026
Only what the loop needs to work.
Your account. Authentication is handled by Clerk. We hold the email address you sign up with and the identifier Clerk gives your account — enough to sign you in and tie your decks to you.
Your study content. The decks and cards in your account — prompts, reference answers, key points, hints, any source snippet, and any image or audio URLs — are stored so they can sync to your devices. Cards reach us three ways: written by your own AI agent through the MCP (that generation runs on your agent's subscription, and we receive the finished cards, not your conversations), written by the Deck Builder from a brief you type here, or written and edited by you.
Your reviews. When you review, we store the rating, the answer you gave (typed, or dictated and transcribed into the same field), and — for AI-checked cards — the score and feedback, plus lightweight signals (how long the recall took, whether a hint was shown) used to schedule the next review honestly.
Operational data. Standard request logs and abuse-prevention counters (rate-limit state keyed to your account, or to a short hash of your network address) needed to keep the service up and stop abuse. Those counters are transient and live in Upstash, apart from your study record. Your plan counters are ours and durable: your remaining free AI credits and built cards, and Pro's monthly totals, sit in our own database against your account. We use a privacy-respecting setup and do not run advertising trackers.
Four flows, and what each one sends.
Checking an answer. When you ask for a check, we send that one card — its prompt, the reference answer, the key points, and any source snippet — together with the answer you gave, to our grading model through the Vercel AI Gateway. That is the whole payload: one card, one answer, one judgment. We don't send your other cards, your review history, or your identity to the model, and the grader is instructed to judge only against the reference stored on the card.
Asking about a card. The tutor answers questions about one card, so it receives that card's own material and the follow-up you asked, plus the earlier turns of that same thread. The thread isn't written to our database — your browser holds it and hands it back for the next turn.
Building a deck. The Deck Builder sends the brief you write — the topic, and any correction you make to the plan it proposes — to a model that plans the course and then writes the cards section by section. The plan it produced travels with those section requests; nothing else from your account does.
Dictating an answer. If you answer by voice, the recording is sent to OpenRouter and transcribed by openai/whisper-large-v3-turbo; the text lands in the answer field for you to read before you submit it. The audio is used for that one transcription. We log the shape of a failure and the size of the clip in bytes — never the audio, never the transcript. That byte count also feeds a bound on how much audio one account or one browser can upload, which is anti-abuse rather than a study limit, and so is never shown to you.
Every account starts with free AI credits, and Pro buys a monthly allowance of the flows above — they are the parts with a per-use cost. Everything else is free and always was: self-rated review, imports, cards your own agent writes through the MCP, and sync send nothing to a model. Rate yourself instead of asking for a check and nothing leaves at all.
The preview, and the cookie that counts it.
On a public deck's try page a visitor with no account can have five answers checked — the same grader, the same tutor, the same microphone a signed-in learner gets, under the rules above. There is no account, no email and no profile behind that session, and the answers you type there are checked without being written to our database.
To count that preview once per browser we set one cookie, lr_anon: 16 random bytes as base64url, set by the server, http-only, and good for about 180 days. It is a name, not a record — it means nothing off our server and holds no count of its own. The counts live in Upstash under that id, beside the daily ceilings that stop scripted abuse, and those ceilings are keyed to a short hash of the network address rather than the address itself.
No selling. No training. No surprises.
We do not sell or rent your data. We do not use your cards, answers, recordings, or reviews to train our own or anyone else's models. Your study content is used to provide the service to you — to sync it, schedule it, check your answers, and answer your questions about a card — and for nothing else.
The services behind the service.
We rely on a small set of infrastructure providers, each handling a specific job, under their own security and privacy terms:
Authentication — your email and login.
Postgres database — your decks, cards, reviews, and the counters behind your free AI credits and monthly renewals.
Hosting, and the AI Gateway that routes checking, tutor, and Deck Builder requests to a model.
Receive one card + your answer at check time, one card + your question at tutor time, or your brief at build time — each for that one response.
Dictation — transcribes the audio you record. Nothing else is sent there.
Payments for Pro — our payment processor is the merchant of record named at checkout. Your card details go to them; we never see or store them.
Transient counters only: rate limits and abuse ceilings, the anonymous preview, and the dictation budget.
Access it, export it, or delete it.
Your cards and answers belong to you. You can view and edit your decks in the app and dashboard. Email us at support@learnreally.com to request a copy of your data or to delete your account. When you delete your account we remove your decks, cards, and reviews from our database; deleting at the auth layer cascades to all of your content. Backups roll off on their normal cycle.
How we protect it.
Every request is authenticated and scoped to your account in code — one user can never read another's cards. Traffic is encrypted in transit, secrets live only in server environments, your MCP API key is stored only as a salted hash (the plaintext is shown once, at creation), and inputs are validated at every boundary.
Not for young children.
LearnReally isn't directed at children under 13 (or the minimum age in your country), and we don't knowingly collect their data. If you believe a child has signed up, contact us and we'll remove the account.
If this policy changes.
If we make a material change, we'll update the date at the top and, for significant changes, give notice in the app. Continuing to use LearnReally after a change means you accept the updated policy.
Questions about your data?
Email support@learnreally.com and a human will answer.