Privacy Policy

1. Who is responsible

The controller responsible for data processing under the EU General Data Protection Regulation (GDPR) is:

Jason Holweg
Viktoriastraße 3a
24937 Flensburg, Germany
Email: hello@imatlearn.com

We have not appointed a Data Protection Officer, as we are not legally required to do so.

2. The Mito app

2.1 What stays on your device

The learning core of Mito runs on your iPhone: lessons, practice, tests, your study plan, your progress and your notes are stored in a database on your device and are never transmitted to us. In particular:

• No account, no registration, no login. We never ask for your name, email address, or any other identifier.
• No analytics, no tracking, no advertising. The app contains no analytics SDK, no advertising framework, no third-party tracking library, and no advertising identifier (IDFA).
• No crash or usage reporting to us.
• No transmission of your learning data. Your answers, progress, mastery estimates, notes and readiness estimates never leave the device.

We therefore hold no profile of you and cannot identify you. Deleting the app removes this data from your device. If your device backs up to iCloud, Apple's backup may include this app data; that backup is governed by Apple's Privacy Policy and is encrypted under your Apple Account.

Three feature groups do communicate with the internet, and only these: Mito (2.2), content reports (2.3), and purchases and codes (2.4). Everything else works offline.

2.2 Mito, the AI assistant

Mito answers your questions about the study material. To do that, what you type has to leave your phone — an assistant that never receives your question cannot answer it.

What is sent when you ask Mito something:

• The messages of that conversation — your questions and Mito's previous replies.
• The title of the concept you opened the chat from, as context (for example “Bond polarity and partial charges”).
• A fixed instruction text that defines Mito's role, identical for every user.
• A random device ID generated by the app. It contains no hardware, Apple Account or advertising identifier and is used only to enforce the free-message allowance and abuse limits.

What is never sent: your progress, your answers, your test results, your notes, your exam date, your name, email address or Apple Account.

Where it goes: the request travels to a proxy we operate on Cloudflare Workers, which forwards it to Anthropic PBC (San Francisco, USA), whose model generates the answer. The proxy exists so that no API key has to sit inside the app. Under Anthropic's commercial API terms, inputs are not used to train their models; their handling is described in Anthropic's Privacy Policy.

• Legal basis: Art. 6(1)(b) GDPR — performing the service you asked for by opening the chat.
• Recipients: Cloudflare, Inc. and Anthropic PBC as our processors.
• Transfer outside the EU: both process data in the USA, safeguarded by EU Standard Contractual Clauses.
• Allowances and rate limiting: to enforce the five-message free allowance, the proxy stores only a count under the random device ID. Short-term device and IP abuse counters are deleted within 48 hours. The counters hold no message content (Art. 6(1)(b) and (f) GDPR — providing the allowance and our legitimate interest in a functioning, affordable service).
• Conversation history: your chats are stored on your device so you can reopen them. Deleting a chat, or the app, removes them.

Please do not type personal information into the chat — names, contact details, health information. Mito needs none of it to explain a concept, and anything you send is transmitted as described above.

Mito is optional. If you never open the chat, nothing is ever sent.

2.3 Content reports

If you find a problem in a question, explanation or concept card, you can deliberately send us a report. The app sends the content source ID, the reason you choose, your optional report note, the reported question or card text as context, a random report ID, the app and content-pack version, and your language setting. It does not send your answer, progress, test result or account information. The request uses the same random app-generated device ID only for a 48-hour abuse counter; the report stored in the inbox contains no device ID.

Reports are stored in a database operated by us on Cloudflare so we can review and correct the affected content. They are not forwarded to Anthropic or another AI provider. The legal basis is Art. 6(1)(b) GDPR: processing the report you chose to submit. Open reports are retained until they have been reviewed; closed reports are automatically deleted after six months. Please do not include names, contact details or other personal information in the optional note.

2.4 Purchases and codes

The IMAT Pass is purchased through Apple in the App Store. Apple is the merchant of record: you enter your payment details with Apple, not with us. We never see or store your payment data, and we receive only anonymous, aggregated sales reports. Apple's handling is governed by Apple's Privacy Policy. Restoring a purchase works through your Apple Account. The iPhone app has no account of our own. The website study app does; that is described in section 3 and does not apply to the iPhone app.

If you redeem a discount or gift code, the app sends only that code to our Cloudflare Worker, which checks whether it is valid and whether a gift code has already been used. No personal data is transmitted with it (Art. 6(1)(b) GDPR).

2.5 Notifications

The app can send study reminders. These are local notifications, scheduled by the app on your device — no push server is involved and no device token is transmitted to us. Notifications are optional: you decide whether to allow them when asked, and you can change your mind at any time in iOS Settings.

3. This website and the web study app

This section covers imatlearn.com and app.imatlearn.com. It does not change section 2. The promise that learning stays on the device applies to the iPhone app only.

3.1 Pages that do not need an account

The marketing pages, the syllabus, the guides and the free diagnostic do not require an account. They embed no third-party fonts, videos or social widgets, and they do not use a third-party analytics service. Until you sign in, these pages set no cookie of our own.

3.2 The diagnostic

The free diagnostic on this website runs entirely in your browser. Your answers are never transmitted to us — there is no endpoint to send them to. The questions are delivered as a static file from this same website, exactly like an image or a stylesheet, and everything after that happens on your device.

So that reloading the page does not throw away a test you are halfway through, your answers are kept in your browser's session storage while the test is running. This is strictly necessary to provide the feature you asked for (§ 25(2) no. 2 TDDDG), which is why it needs no consent banner. It is not a cookie, we never receive it, and we do not use it to recognise you: the entry belongs to a single browser tab and is normally discarded when you close that tab. Some browsers offer to restore a session after a crash or a restart, in which case the entry can survive that long — it stays on your device either way. You can clear it yourself at any time through your browser's settings, or by choosing “Take it again” at the end of the test.

We do not receive which option you chose. If you want to keep the full result, take a screenshot before you close the tab — we cannot restore the questions or your answers, and we could not identify them as yours even if you asked.

Before the test starts, you can choose to share statistics. That is optional, and skipping it does not change the test. If you confirm, we store a random id for that attempt, when it started and finished, how many answers were correct, wrong or skipped (including a count per subject), and whether you then opened the App Store page or the web study app. We do not store your answers, your account, or your name with that record. You can stop sharing for the rest of the session from the result screen. Shared counts are kept for up to a year and then deleted. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it for future tests by choosing Skip the next time; counts already stored stay in the aggregate and are not tied to an account we could use to pick yours out.

3.3 Server logs

The website is hosted by Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA). Like every web server, Cloudflare's infrastructure processes technical connection data when you open a page — typically your IP address, the requested file, date and time, referrer, and browser and operating system version. This is technically necessary to deliver the website and to protect it from attacks.

• Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in operating a functioning, secure website.
• Recipient: Cloudflare acts as our processor under a data processing agreement (Art. 28 GDPR).
• Transfer outside the EU: Cloudflare may process data in the USA. The transfer is safeguarded by the EU Standard Contractual Clauses and Cloudflare's certification under the EU–US Data Privacy Framework.
• Retention: Cloudflare retains such logs only briefly, for security and troubleshooting purposes.

3.4 Contacting us by email

If you write to us, we process your email address and the content of your message solely to answer you (Art. 6(1)(b) and (f) GDPR). We delete such correspondence once it is no longer needed and no retention obligation applies.

3.5 The web study account

Lessons, practice and mocks on the website run in an account. You create it with an email and a password, or with Google. The same login works in another browser and on another device. That is the point of it: a purchase and your progress are not trapped in one browser.

Creating the account is not optional if you want to use the web study app. The registration form asks you to agree to the Terms of Use and to this policy, including the storage and use of your learning activity described here. We do not pre-tick that box. Continuing with Google is the same agreement: the button works only after you tick it.

What we store for a web account:

• Your email address, and, if Google sends one, your name.
• A password hash and salt, if you chose a password. We do not store the password itself. A Google-only account has no password.
• If you use Google: Google's account identifier (the sub claim), so we can recognise the same Google account next time.
• The time you agreed, and the time the account was created.
• A session token, stored on our side only as a hash, in an HttpOnly cookie on your browser. It lets you stay signed in. It is not an advertising identifier.
• Your learning progress: which concepts you marked as read, answers, time taken, unfinished sittings, finished sittings and the repair that follows a sitting.
• Product events: account created, sign-in, a lesson opened, a mock or practice set started or finished, and a purchase. The event names the lesson or mock. It does not contain the question text.
• What you bought: the product (the IMAT Pass, a mock pack, or a single mock), the amount, the time, and the Stripe checkout reference.

We do not use a third-party analytics or advertising SDK on this website. The activity above is stored in our own database so we can run the account and see which lessons, questions and mocks need work. We do not sell it, and we do not use it to advertise to you on other sites.

3.6 Why, and the legal basis

• Running the account, syncing progress, and unlocking what you bought — Art. 6(1)(b) GDPR. This data is required to provide the web study app you signed up for.
• Using activity to improve the lessons, the questions and the web app — Art. 6(1)(a) GDPR. You agree to this when you create the account. It is a condition of the web study app, because improving the material from how it is actually used is part of the service we offer there. It does not apply to the iPhone app, which does not send this activity.
• Keeping a purchase record — Art. 6(1)(c) GDPR, where tax and accounting law requires us to retain it, and Art. 6(1)(b) for providing the access you paid for.
• Security of the account — Art. 6(1)(f) GDPR, our legitimate interest in preventing abuse of sign-in and checkout. We do not add your IP address to the learning record. Connection logs are the ones in section 3.3.

3.7 Google sign-in

If you choose “Continue with Google”, your browser goes to Google and comes back to us. We receive the email address Google verifies, your name if Google provides it, and Google's account identifier. We use them only to create or open your account. We do not receive your Google password, and we do not post to your Google account.

Google is a separate controller for the sign-in page. Google's Privacy Policy describes that step. The legal basis for our use of what Google sends back is Art. 6(1)(b) GDPR.

3.8 Payments

Web purchases are taken by Stripe. You enter the card on Stripe's page. We do not receive the card number. Stripe tells us whether the payment succeeded, the amount, the product, and an email address for the receipt. We store the product, the amount, the time and Stripe's checkout reference against your account, and we unlock that product on the account.

A web purchase unlocks the website study app only. It does not unlock the iPhone app. The iPhone app remains an Apple in-app purchase, described in section 2.4. Stripe may set cookies on Stripe's own pages. Stripe's handling is described in Stripe's Privacy Policy.

3.9 The session cookie

After you sign in we set one cookie, mito_session. It is HttpOnly, SameSite=Lax, and on the production site it is Secure and scoped to .imatlearn.com so imatlearn.com and app.imatlearn.com share the login. It lasts 30 days, or until you sign out or delete the account.

The cookie is strictly necessary to keep you signed in to the account you asked for (§ 25(2) no. 2 TDDDG). It is not used to track you across other websites, and there is no advertising cookie. That is why the marketing pages do not show a cookie banner.

3.10 How long we keep web-app data

• Account, progress and product events — for as long as the account exists.
• Session — 30 days from sign-in, or until you sign out. Deleting the account deletes its sessions.
• After you delete the account — we delete the login, the progress, the product events and the unlocks. Access ends. A purchase row (email, product, amount, date, Stripe reference) is kept for as long as German accounting rules require, which can be up to 10 years, and is then deleted. That row does not restore the account.
• You can also ask by email if you cannot sign in. Write to hello@imatlearn.com from the address on the account.

3.11 Who receives web-app data, and transfers

• Cloudflare hosts the site and the database (D1). Cloudflare is our processor (Art. 28 GDPR). Details and the transfer safeguard are in section 3.3.
• Google receives the sign-in request only if you choose Google. See section 3.7. Google may process that request in the USA under its own safeguards, including the EU–US Data Privacy Framework where it applies.
• Stripe receives the checkout. Stripe may process payment data in the USA. The transfer is safeguarded by the EU Standard Contractual Clauses and, where applicable, Stripe's certification under the EU–US Data Privacy Framework.

We do not pass your learning progress to an advertising network, a data broker, or the iPhone app.

4. Your rights

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21). Where we rely on consent, you may withdraw it. Because that consent is a condition of the web study account, withdrawing it means deleting the account; it does not switch the web app into a no-tracking mode. To exercise these rights, use Delete account in the web study app, or write to hello@imatlearn.com.

For the iPhone app, we still hold no learning profile. Deleting the app removes what it stored on the device. The only potentially personal data from the iPhone app on our side is text you deliberately submit through Mito or a content report, plus the rate-limiting counters in sections 2.2 and 2.3. The random device ID is not connected to a name, to a web account, to an advertising profile, or to data from other services.

For the web study app, we can identify the account by the email address. A copy of the progress stored for that account is available on request. Deletion is described in section 3.10. A purchase record kept for a legal retention duty is the exception to erasure for that period (Art. 17(3)(b) GDPR).

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), for example the data protection authority of your country or of our registered office.

5. Users outside the EU

We apply the same standard worldwide. For residents of California: we do not sell or share personal information within the meaning of the CCPA/CPRA, and we do not use it for cross-context behavioural advertising. Web-app activity is used to operate the account and to improve the product, as described in section 3. iPhone-app data is limited to sections 2.2 through 2.4.

6. Children

The service is aimed at people preparing for a university admission test, who are typically 17 or older. It is not directed at children under 13. The web study account asks you to confirm that you are at least 16. If you are under 16, do not create one. If a younger child's data has been stored, write to us and we will delete the account.

If you are a minor under the law of your country, please read the Terms of Use regarding parental consent for purchases, and take particular care not to type personal details into the Mito chat or an optional report note.

7. Changes to this policy

We will update this policy when the product changes. The version in force is always the one published here, with the date shown at the top of this page. The web study app and the iPhone app are described separately on purpose. A change to one does not silently change the other.

8. Independence

Mito - Learn IMAT is an independent exam preparation platform and is not affiliated with, endorsed by, or associated with the Italian Ministry of University and Research (MUR), CINECA, Cambridge University Press & Assessment, or any participating university.