Privacy Policy
Effective date: July 27, 2026 Last updated: July 27, 2026
1. Who we are
Reeforma is a mobile learning application published by Kyrylo Khmelevskyi, an independent developer based in Ukraine ("we", "us", "our").
For the purposes of the EU and UK General Data Protection Regulation, Kyrylo Khmelevskyi is the data controller for the personal data described in this policy.
- Email: support@reeforma.app
- Postal address: available on request — email support@reeforma.app
2. The short version
- We collect what the app needs to work: your account and your learning progress. The app has no free-text field, so there is no writing of yours for us to store.
- We do not use advertising networks, analytics SDKs, or cross-app tracking of any kind.
- We do not sell or share your personal data, and we do not use it to build advertising profiles.
- You can delete your account and all associated data from inside the app, at any time, without contacting us.
The sections below explain this in full.
3. What we collect
3.1 Account information
When you create an account, we receive and store:
| Sign-in method | What we receive |
|---|---|
| Your email address. We send a one-time code to it; we never store a password. | |
| Sign in with Apple | An Apple user identifier and an email address. If you choose "Hide My Email", Apple gives us a relay address instead of your real one, and that is all we ever see. Your name only if you choose to share it. |
| Your email address, your name, and your profile picture URL, as provided by Google. |
We do not store passwords for any sign-in method. Authentication is handled by our backend provider (see section 6).
3.2 Learning data
Everything the app needs to remember your progress across devices:
- experience points (XP), gem balance, current and longest streak, streak freezes
- which lessons, courses, and path nodes you have completed
- courses you have saved or unlocked, and big courses you have purchased with gems
- minutes of study per day, and which videos in the Feed you have liked
- your answers to the onboarding questions: chosen topics, self-assessed level, preferred time of day, learning goal, and preferred content format
3.3 No free-text content
Reeforma has no field where you write your own text. Tasks that follow a lesson are completed with a single tap — you never type anything, so there is nothing of your own writing for us to store, read, or analyse.
3.4 App settings
Your interface language, light or dark theme, animation preference, chosen mascot, and your daily reminder time.
3.5 Technical data
Our backend provider records standard server logs when your device contacts our servers: IP address, timestamp, and basic request metadata. These logs exist for security, abuse prevention, and diagnosing faults. They are retained for a short period — no more than about a week and are not combined with your learning data to profile you.
3.6 Purchases
Purchases of PRO subscriptions and gem packs are processed entirely by Apple through the App Store. We never receive or store your card number, billing address, or any other payment details. We receive only the outcome from Apple: whether a purchase completed and whether a subscription is currently active.
4. What we do not collect
To be explicit, the app contains no code that collects any of the following:
- advertising identifiers (IDFA), and no advertising networks of any kind
- third-party analytics, attribution, crash-reporting, or product-telemetry SDKs
- your location, contacts, photos, calendar, microphone, or camera
- your health data, financial data, or browsing history
We do not track you across apps or websites owned by other companies. Because we carry out no tracking as Apple defines it, the app does not present an App Tracking Transparency prompt.
We do not sell your personal information, and we do not share it for cross-context behavioural advertising, as those terms are used in California and other US state privacy laws.
5. Notifications
The daily reminder is scheduled locally on your device by iOS. No device push token is generated, and nothing about your reminders is sent to us or to any third party. Turning the reminder off in the app, or revoking notification permission in iOS Settings, stops it entirely.
6. Who processes data for us
We use a small number of service providers. They act on our instructions and are bound by contract to protect your data.
| Provider | Role | What it handles |
|---|---|---|
| Supabase | Backend, database, authentication | Account, learning data, server logs. Data is stored in Frankfurt, Germany (EU). |
| Apple | Payments, Sign in with Apple, notifications delivery | Purchase processing and Apple-based sign-in. |
| Sign-in only | Only if you choose to sign in with Google. |
Video content. Videos in the Feed are streamed from a third-party content delivery network. Loading a video reveals your IP address to that network, as it would with any video on the internet. We do not send your account information or your progress to any video provider.
If your personal data is transferred outside your country, we rely on the transfer mechanisms offered by these providers, including the European Commission's Standard Contractual Clauses where applicable.
7. Why we are allowed to process your data
For users in the EEA and the UK, our legal bases are:
| What | Legal basis |
|---|---|
| Creating your account, syncing progress, delivering purchased content | Performance of a contract with you |
| Server logs, security, and abuse prevention | Our legitimate interest in keeping the service running and secure |
| Sending you a daily reminder | Your consent, given through the iOS permission prompt, withdrawable at any time |
8. How long we keep data
- Your account and everything attached to it: until you delete your account.
- After deletion: removal is immediate and cascades across our database. Backups made before the deletion are overwritten on their normal rotation, within 30 days at most.
- On your device: progress is also stored locally. Deleting the app removes it.
- Server logs: a short period, no more than about a week.
9. Your rights
Depending on where you live, you have some or all of the following rights: to access your data, to correct it, to delete it, to receive a copy in a portable format, to restrict or object to certain processing, and to withdraw consent you have given.
Deleting your account is built into the app: Profile → Settings → Delete Account. This removes your account and your progress immediately. It cannot be undone, and it does not cancel an active App Store subscription — see the Subscription Terms for how to cancel that.
For any other request, email support@reeforma.app. We will respond within 30 days. We do not charge for this, and we will not treat you differently for exercising a right.
If you are in the EEA or the UK and you believe we have handled your data improperly, you may lodge a complaint with your national data protection authority. We would appreciate the chance to address it first.
10. Children
Reeforma is not directed to children under 13, and we do not knowingly collect personal data from them. In parts of the EEA the minimum age is 16 unless a parent consents. If you believe a child has created an account, write to support@reeforma.app and we will delete it.
11. Security
Data in transit is encrypted with TLS. Data in our database is protected by row-level access rules, so one account cannot read another account's data, and by our provider's encryption at rest. Access to production data is limited to Kyrylo Khmelevskyi.
No service can promise perfect security, and we do not. If a breach affects your personal data and poses a risk to you, we will notify you and the relevant authority as the law requires.
12. Changes to this policy
If we change this policy we will update the date at the top. If a change materially affects your rights — for example, if we ever begin collecting a new category of data — we will tell you in the app before it takes effect.
13. Contact
Kyrylo Khmelevskyi available on request — email support@reeforma.app support@reeforma.app