Privacy Policy

This policy covers information processed by LogNormal through the app, website, support and privacy correspondence, earlier beta accounts, and TestFlight information and App Store crash reports Apple makes available to LogNormal. It does not govern Apple’s independent handling of App Store, Apple Account, payment, or TestFlight information.

“Personal information” means information that identifies, relates to, describes, can reasonably be linked with, or could reasonably be linked with a person or household. Aggregated or deidentified information that cannot reasonably be linked back to a person is not treated as personal information where applicable law allows.

LogNormal supports email and Sign in with Apple accounts, learner profiles, guardian-managed access, learning-history synchronization, and learner subscriptions. Signed-in devices send account and learning information to the account service so authorized learners can continue across devices. Offline work remains on the device until it can synchronize.

Without a signed-in account, local practice records are kept on the device. The app contains no advertising, cross-service tracking, product-analytics, or third-party crash-reporting SDK. It does not request location, contacts, microphone, photo-library, or health access. Apple diagnostics and any information you choose to send to support are described below.

The app stores app-generated installation, attempt, and session identifiers; exercises and modes used; checked outcomes, error categories, assistance and timing; session and progress summaries; resume checkpoints; settings; and mathematical work entered where an exercise needs it for restoration. LogNormal uses these records to operate exercises, resume work, preserve progress, and shape later practice.

The app maintains several separate reporting histories. When those histories are updated, learning-event records are pruned to the most recent 2,000 and records older than 365 days; session summaries are limited to 200; dashboard attempt summaries to 500; and failure signatures to 800. These are not global limits on every local record. Canonical attempt and checkpoint files, settings, an optionally enabled local telemetry queue, and some exercise-specific authored work do not currently have equivalent count or time limits. Optional telemetry is off by default and the reviewed implementation does not upload it.

Where available, “Reset All Progress” clears the selected learner’s learning history without deleting their account; see Privacy Choices for the full reset scope.

Removing the app clears its ordinary application container but may leave sign-in credentials in Keychain. Sign out when possible; account deletion and Apple subscription cancellation are separate actions.

When you sign in or restore an existing session, the app exchanges authentication tokens, account and learner identifiers, display names, country or region, coarse age band, account or guardian relationships, authorized-device details, parental course controls, and synchronized learning attempts and checkpoints. Requests also expose connection information such as IP address and request headers to the service.

Account records include an adult email or display name, household roles, learner relationships and permissions, device-registration state, entitlements, and notice, agreement or authorization records. These support authentication, learner governance, account security, access and privacy requests.

For Apple purchases, LogNormal processes signed transaction information, product and transaction identifiers, subscription price and term, renewal or expiry state, and the learner-seat and account links needed to grant or restore access. Apple handles payment-card and bank details; LogNormal does not collect those payment credentials.

Account profiles and learning history are retained while an account remains active so that a learner can preserve longitudinal progress across extended interruptions and return later. After seven years without meaningful learner or authenticated-account activity, LogNormal’s current lifecycle begins a twelve-month notice period before dormant-account deletion. The necessity and proportionality of that period for information associated with children remains part of final legal review.

When permanent account deletion is confirmed through an authorized process, access is revoked and deletion from the live account service begins immediately. There is no account-recovery window. Generated export packages expire within 24 hours. Certain minimized records remain temporarily: ended consent or agreement records may remain for up to 90 days; security and completed-deletion records for up to 30 days; and replicated restore-suppression records are scheduled for purge after 14 days. A suppression record that has not yet replicated is retained until replication succeeds.

Guardian notice, authorization and withdrawal records document whether a person may act for a learner. Access is restricted to the authorized account relationship. Withdrawal stops the authorization it covers; it is separate from deleting the learner or cancelling an Apple subscription. No fixed maximum retention period is promised here for every authorization record.

Deletion removes information from the live account service. Residual copies may remain in provider backups until those backups expire. The account service uses daily backups with point-in-time recovery disabled. The provider’s published daily recovery window is not a verified deadline for final erasure of every copy; LogNormal does not promise a strict seven-day or 168-hour purge. A disaster-recovery restore must reapply deletion-suppression records before restored account access is reopened.

See Account Deletion for the request process.

Information comes directly from an adult or eligible self-managed learner; from activity in the app; from the device and operating system; from an earlier authenticated account session; from Apple through TestFlight, shared app diagnostics, Sign in with Apple, or an App Store transaction; from a person who contacts LogNormal; and from infrastructure providers that operate the website or account service.

LogNormal uses information only as applicable to provide and secure the requested Services; authenticate accounts and authorized devices; create and govern learner profiles; preserve, synchronize, and display learning progress; restore work; administer subscriptions and entitlements; answer support and privacy requests; diagnose defects; prevent abuse; enforce agreements; comply with law; and protect users, LogNormal, and the Services.

Learning records may be used to choose or adapt later practice for that learner. LogNormal does not use them to make decisions producing legal or similarly significant effects, and the reviewed implementation does not use them for advertising or cross-service tracking.

The website is hosted by Infomaniak, a Swiss hosting provider. Its servers process the connection and request information needed to deliver and secure the website, including your IP address and requested URL. Infrastructure access and error logs follow the hosting service’s settings and terms. The website has no advertising pixels, advertising cookies, or external analytics provider. Read the Infomaniak Privacy Notice.

When you first open the homepage without a language-specific URL, the site can use your browser’s language preferences to select English or Russian. Choosing a language with the site’s selector stores only “en” or “ru” locally in your browser to remember that choice. This preference is not used for analytics or advertising.

The adult question form records your email address, optional name, message, language, request time, and notification status in private website tables in Supabase. Resend sends a notification to LogNormal’s receiving Proton Mail mailbox so we can reply. This is correspondence, not a marketing subscription. Do not include passwords or unnecessary information about a child.

The adult launch form stores your email address, consent wording and version, language, request time, and confirmation status in private website tables in Supabase. Resend sends a confirmation email; you join only after confirming. Launch messages include an unsubscribe option. Earlier launch emails sent through Brevo can still use the confirmation and unsubscribe service. These records are separate from app accounts and learner records. The website does not process payment cards or App Store transactions.

Question records and support correspondence are retained for 12 months after resolution, then deleted unless an active dispute or legal obligation requires longer. Unconfirmed launch requests are removed by the next hourly cleanup after seven days. Confirmed addresses are kept until you unsubscribe or the launch list closes. At that point, the address is removed from the launch table; a keyed suppression hash and minimal consent history are kept for two years, then removed by scheduled cleanup. Hosting and email-provider logs and backups have separate handling.

Submission protection uses global and per-email short-lived counters in Supabase. Email counter keys use keyed hashes rather than the raw address. Counters expire within 24 hours. Optional website analytics is a separate choice and is never required to submit a form.

Optional first-party analytics stays off until you choose Accept analytics. Continuing without analytics does not restrict the website, questions, or waitlist. We measure public page views, selected form and App Store links, referral domains, language, and bounded campaign labels to understand website use. Analytics records never contain email addresses, names, question messages, raw IP addresses, user-agent strings, full referring URLs, or account and learner records.

After you accept, the browser stores a random daily identifier and sanitized first-touch referral and campaign labels until the next UTC midnight, within 24 hours. The server stores daily keyed hashes and hourly aggregate counts, not an individual event log. Daily hashes expire after 32 days; hourly aggregate counts are kept for 13 months. Your consent preference stays in your browser until changed or cleared. No analytics identifier is created or analytics event sent before opt-in.

Use Analytics preferences in the footer or on the Privacy Choices page to withdraw consent at any time. Withdrawal stops further analytics and removes the browser identifier. It does not erase already aggregated counts. Global Privacy Control and Do Not Track keep optional analytics off. Clearing browser storage resets your choice.

LogNormal uses Apple’s crash reports to diagnose app failures. TestFlight shares crash reports automatically; App Store reports depend on the device’s diagnostic-sharing settings.

If a development build is delivered through TestFlight, Apple automatically collects and may make beta-testing data available to Apple and LogNormal. Depending on how the tester was invited and what occurs, this can include the tester’s name or email, installation and session activity, crash and performance information, build and device identifiers, hardware and operating-system details, networking information, and information about use of the beta app. Optional feedback may include comments and screenshots a participant chooses to send.

LogNormal uses beta-testing data to diagnose and improve the app. Do not include unnecessary information about a child in feedback or screenshots. Apple controls its own TestFlight and diagnostic records. Reports or feedback you send directly to LogNormal are handled as support correspondence; Apple’s separate terms and privacy notice apply to Apple-held information.

Infomaniak hosts the website in Switzerland. Supabase provides the account database, authentication and related services; the Production account database is configured in the US West (Oregon) region. Separate private website tables in Supabase hold website questions, launch-email preferences, and opted-in analytics records in the same Production database. Resend delivers website notifications, launch confirmations, and account verification and recovery email and processes recipient addresses, message content and delivery information. Its configured sending region is US East (N. Virginia). Open and click tracking are disabled for account verification and recovery emails. Proton Mail receives support and privacy correspondence. Apple provides distribution, purchases, Sign in with Apple and diagnostics.

Provider agreements, subprocessors, locations, transfer safeguards, retention and security terms govern their respective services. A database or sending-region setting does not mean every provider log, backup or support operation stays in that region. No fixed provider-wide retention ceiling is promised here for Resend or residual backup copies. This policy does not claim that unfinished verification is complete.

Third parties with whom LogNormal shares personal information must provide the same or an equivalent level of protection as this policy and Apple’s App Review Guidelines require. We use providers subject to data-protection, confidentiality and security obligations, limit sharing to the purposes described here, and remain responsible for how we select and use those providers. Their separate terms do not reduce the protections we promise in this policy.

Provider information: Infomaniak, Supabase data processing terms, Resend, Proton, and Apple.

LogNormal is mathematics software intended for a broad audience of learners from age 6 through adult. It is not offered in Apple’s Kids Category, but that designation does not determine whether a children’s privacy law applies and does not remove obligations concerning children’s information. Founding Families correspondence and App Store purchases for minors are handled by adults.

A guardian-managed learner profile can contain a learner display name, coarse age band, country or region, authorized family relationships, learning progress and the notice or authorization evidence needed to govern access. The learner does not need independent email/password or Apple credentials.

The approved launch design requires a learner under 13—or otherwise below the applicable jurisdictional threshold—to use a guardian-managed profile. Before LogNormal collects, uses, or discloses personal information online from or about that learner through the app, account service, TestFlight, website, or another provider acting for LogNormal—including profile or progress records and device, network, or online identifiers—the design requires direct notice and verified guardian authorization, except only for a specific activity that qualified counsel has documented may lawfully occur without prior authorization and only within that exception’s purpose and limits. The design does not give that learner independent email/password or Apple credentials or ask the learner for payment details. Teen self-management is available only where a versioned jurisdiction rule permits it; unresolved eligibility fails closed. The public launch is not release-qualified until the signed release flow, enabled territories, direct guardian notice, authorization, withdrawal, access, and deletion behavior are verified together.

LogNormal asks a parent or guardian to send correspondence concerning a child and to include only what is needed for the request. An authorized guardian may request access, correction, export, withdrawal or deletion through the contact address below. If LogNormal learns that a child submitted personal information outside an authorized process, it will review and delete it where required.

The Children & Family Privacy notice gives further detail about family-account data, guardian authorization and learner choices.

LogNormal discloses information to service providers only for the operational purposes described above; to Apple when a person chooses an Apple service or an App Store transaction requires it; to an account holder or guardian only when the account relationship authorizes access; and to professional advisers bound by appropriate duties when reasonably necessary.

LogNormal may also disclose information when reasonably necessary to comply with law or legal process, protect a person or the Services, investigate fraud or abuse, establish or defend legal claims, or complete a financing, merger, acquisition, reorganization, or sale of assets subject to appropriate confidentiality and successor obligations.

LogNormal does not sell personal information through the reviewed app or website, share it for cross-context behavioral advertising, use it for targeted advertising, or exchange it for a financial incentive. They contain no advertising network or cross-service tracking technology. Final release statements must also be checked against company operations and provider agreements, not only repository code.

Depending on where a person lives and subject to lawful exceptions, they may have the right to know or access personal information; obtain a portable copy; correct inaccurate information; delete information; withdraw consent or stop future collection; object to or restrict certain processing; opt out of sale, sharing, targeted advertising, or qualifying profiling; and appeal a denied request. A person will not receive discriminatory treatment for exercising a privacy right.

LogNormal does not sell or share information for targeted advertising. Global Privacy Control and Do Not Track also keep optional website analytics off. You can withdraw analytics consent separately from a launch-list subscription or a support request.

An authorized agent may submit a request where law permits. LogNormal may verify identity, account relationship, residence, or guardian authority using information proportionate to the request, and will not ask for a password or authentication token. If a request is denied, the response will explain any appeal method required by applicable law. A requester may also contact the competent privacy or consumer-protection regulator.

Use the receiving inbox for access, correction, export, deletion, guardian authorization or withdrawal, and any legally required appeal. In-app account controls also provide profile correction, export and permanent deletion. We verify authority before acting on a request.

contact@lognorm.al

Launch territories have not yet been finalized. If LogNormal offers account services in a jurisdiction that requires a particular legal basis, local representative, privacy officer, transfer safeguard, child-consent rule, or complaint process, that requirement must be in place before the territory is enabled.

Where applicable, LogNormal expects to process information as necessary to perform its contract with the account holder, based on consent for processing that requires consent, to comply with legal obligations, and for legitimate interests such as security, support, and improving a requested service where those interests are not overridden by a person’s rights. This paragraph is not a claim that every territory-specific launch requirement has been completed.

The app uses iOS-protected local storage and Keychain credential storage, authenticated service access, and encrypted network transport. Access to synchronized learner records follows account and guardian permissions. These safeguards do not eliminate every security risk.

No storage or transmission method can be guaranteed completely secure. If you believe an earlier account or correspondence has been compromised, review the Support page for current channel status.

We may update this policy when the product, providers, law, or data practices change. The effective date identifies the current version. Material changes will receive notice or consent when required, and prior versions should be retained so the applicable disclosure can be reconstructed.

Contact LogNormal at the receiving inbox below. The public operator and mailing details identify who handles these requests.

contact@lognorm.al