Logo
☀️

Privacy Policy

This Privacy Policy describes how Lambdio ("we," "us," or "our") collects, uses, and protects your personal information. By using Lambdio, you agree to the collection and use of information in accordance with this policy.

Last Updated: September 7, 2026

1. Information We Collect

Account Information

  • Registration Data: When you create an account, we collect your username, email address, and password.
  • Google OAuth Data: If you sign in with Google, we collect your Google ID, email address, name, and profile picture (as provided by Google API).
  • Apple OAuth Data: If you sign in with Apple, we collect your Apple ID identifier and the email address you choose to share (which may be an Apple private-relay address if you use "Hide My Email"), and your name if you provide it.
  • Profile Information: Optional information you provide, such as your bio, timezone, and certificate display name.

Learning Data

  • Progress Tracking: We collect data on your XP points, current level, completed courses, and specific learning achievements.
  • Session Data: We track the dates, durations, and frequency of your learning sessions to provide heatmap visualizations and enforce refund eligibility limits.
  • Course Interactions: Detailed logs of courses started, completed, or currently in progress.
  • AI Tutoring Content: When you use AI-powered tutoring, we process the conversation messages, answers, and quiz responses you submit, together with the course content you are studying, to generate your tutoring sessions. If you provide them, we also use your learning preferences (academic level, major, hobbies) to personalize AI tutoring.

Payment and Subscription Information

  • Merchant of Record: Our order process is conducted by our online reseller, Dodo Payments. Dodo Payments is the Merchant of Record for all our orders.
  • Transaction Data: We do not store full credit card numbers, CVC codes, or bank account details. We store your Dodo Payments Customer ID and Subscription ID to manage your premium access.
  • Shared Data: We share your email address and name with Dodo Payments to facilitate tax calculation, fraud prevention, and invoice generation.

Technical Information

  • Usage Data: Information about how you interact with our platform, including pages visited, buttons clicked, and features used.
  • Device Information: Browser type, operating system, and device type for compatibility purposes.
  • Cookies & Local Storage: We use secure HTTP-only cookies for authentication and Local Storage for user interface preferences (e.g., theme settings).

2. How We Use Your Information

We use the information we collect for the following purposes:

  • To Provide and Improve Services: To operate the platform, manage your account, track your learning progress, and maintain the leaderboard.
  • To Process Transactions: To facilitate payments and subscription management via Dodo Payments.
  • To Personalize Experience: To customize learning paths and provide personalized content recommendations.
  • To Provide AI-Powered Tutoring: To generate AI tutoring conversations, quizzes, and review sessions using the third-party AI service described in Section 5 below. We ask for your consent before your content is shared with this provider, and you can revoke that consent at any time from Account → Settings.
  • To Enforce Policies: To verify eligibility for refunds (based on the 25-session limit) and prevent abuse of the free tier.
  • To Communicate: To send important updates about your account, security alerts, and changes to our policies.
  • Legal Compliance: To comply with applicable laws, regulations, and legal requests.

3. Google & Apple OAuth Integration

When you choose to sign in with Google or Apple, we use their authentication systems to verify your identity. You may link more than one sign-in method to your account and manage or disconnect them at any time from your Account settings.

  • Google Access Scope: We only request access to your basic profile information (email, name, profile picture).
  • Apple Access Scope: We only request your email address and name. If you use "Hide My Email," Apple provides us with a unique private-relay address instead of your personal email.
  • No Password Access: We do not have access to your Google or Apple account passwords or other sensitive account information.
  • Revocation: You can disconnect Google or Apple from your account at any time in your Account settings, and revoke access through your Google Account permissions or Apple ID settings.
  • Limited Use Disclosure: The use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. Data Storage and International Transfers

Lambdio is a business registered in Georgia. However, our technical infrastructure is located within the European Union to ensure high standards of data privacy and security.

  • Database Storage: Your personal data and learning progress are stored on MongoDB Atlas servers located in Stockholm, Sweden (AWS eu-north-1).
  • Backend Processing: Our API and application logic are hosted on Render in Frankfurt, Germany (EU Central).
  • Content Delivery: Our frontend is delivered via Vercel, which utilizes a global Content Delivery Network (CDN) to ensure fast access. While Vercel processes requests globally, it does not persistently store your personal data.

By using our service, you acknowledge that your information may be transferred to—and maintained on—computers located outside of your state, province, or country. However, we ensure that all major data storage and processing activities occur within jurisdictions that adhere to strict data protection standards (GDPR).

5. Data Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances:

  • Service Providers: With trusted third-party service providers who assist in operating our platform:
    • Dodo Payments: For payment processing and tax compliance (Merchant of Record) for website subscriptions.
    • Apple (App Store): For processing in-app subscription purchases on iOS, including payment handling, billing, and subscription management.
    • Google (Google Play): For processing in-app subscription purchases on Android, including payment handling, billing, and subscription management.
    • RevenueCat: For managing in-app purchases, subscription entitlements, and cross-platform subscription status synchronization.
    • MongoDB Atlas: For secure database hosting.
    • Render & Vercel: For application hosting and infrastructure.
  • Legal Requirements: If required by law, regulation, or legal process (e.g., a court order).
  • Business Transfers: In connection with a merger, acquisition, or sale of assets.
  • Public Profile: Your username, XP, level, and public achievements may be visible to other users on the leaderboard unless you opt-out in your account settings.

Third-Party AI Services (DeepSeek)

Lambdio uses a third-party AI service provider, DeepSeek (accessible via api.deepseek.com, operated by Hangzhou DeepSeek Artificial Intelligence Co., Ltd. and its affiliates), to generate the AI tutoring conversations, quizzes, review sessions, and open-ended grading used by the platform. DeepSeek acts as a data processor on our behalf.

What is shared: When you use AI features, the following is transmitted to DeepSeek to generate a response: the course content you are studying, your tutoring conversation messages and answers, your quiz responses, and — if you have filled them in — your learning preferences (academic level, major, hobbies). We do not send your name, email address, or password to DeepSeek.

Why and how it is used: This data is used solely to produce the personalized tutoring experience you request (generating explanations, questions, feedback, and study plans). We do not use DeepSeek to advertise to you.

Your consent: The Lambdio mobile app shows an in-app consent screen before any of this data is first shared with DeepSeek, and it identifies what is sent and to whom. You can revoke your consent at any time from Account → Settings ("AI Features & Data"), which disables AI features. Revoking consent does not delete data already lawfully processed.

Protections: We rely on DeepSeek to provide safeguards that are the same or equal to the protections described in this policy. DeepSeek processes the data only to provide the AI features, does not sell it, and retains it only as required to provide the service and comply with its own legal obligations. Please review DeepSeek's privacy policy for further details on its processing and retention practices.

6. Data Security

We implement appropriate technical and organizational measures to protect your personal information:

  • Encryption: Passwords are hashed using bcrypt before storage.
  • Secure Transmission: All data is transmitted via SSL/TLS (HTTPS) encryption.
  • Secure Cookies: Authentication tokens are stored in Secure, HTTP-Only cookies to prevent XSS attacks.
  • Access Control: Access to personal data is restricted to authorized personnel only.

7. Your Rights and Choices

You have the following rights regarding your personal information:

  • Access & Correction: You can access and update your profile information through your account settings.
  • Deletion: You can request the deletion of your account and associated data. Upon request, we will permanently delete or anonymize your personal data within 30 days.
  • Data Portability: You can request a copy of your learning data in a structured format.
  • Opt-Out: You can opt-out of non-essential email communications.
  • AI Consent: You can revoke consent to share your content with the third-party AI provider at any time from Account → Settings → "AI Features & Data". This disables AI-powered tutoring for your account.

To exercise these rights, please contact us using the information below.

8. Data Retention

We retain your personal information only for as long as necessary to provide our services and fulfill the purposes described in this policy.

  • Active Accounts: We retain data while your account is active.
  • Deleted Accounts: When you delete your account, we delete or anonymize your personal information within 30 days.
  • Legal Retention: We may retain certain transaction records (e.g., payment history) for a longer period as required by tax laws and accounting principles.

9. Children's Privacy

Lambdio is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13, we will take steps to delete such information immediately.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. We encourage you to review this Privacy Policy periodically.

11. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us:

Email: support@lambdio.com

Registered Address: Georgia, Tbilisi, politsiis I chikhi N5, 0162

We aim to respond to all inquiries within 48 hours.

← Back to Home