PopTutor Privacy Policy — How We Handle Your Data

PopTutor mobile app · Last updated: 13 April 2026 · Version 1.0

1. Who we are

The data controller for PopTutor is:

We are not legally required to appoint a Data Protection Officer (DPO), but the email above is monitored and you can use it for any privacy question or to exercise the rights described below.

2. What data we process

2.1 Material you upload

When you upload a photo, PDF, or pasted text to PopTutor and ask the app to generate questions, the file or text is transmitted to Microsoft Azure OpenAI Service for processing. Azure OpenAI extracts the text, categorises the content, and produces quiz questions, then returns the result to your device.

• The processing happens in the Sweden Central Azure region. Your material does not leave the EU.
• Microsoft does not use Azure OpenAI customer data to train its foundation models.
• We do not store your uploaded material on any server we operate. Once Azure OpenAI returns the result, we keep only the generated questions — and we keep them only on your device.

2.2 Data stored on your device

PopTutor stores the following locally in a SQLite database (poptutor.db3) inside the app's private storage area:

• Study groups, topics, and the questions generated from your material
• Quiz session history and your spaced-repetition schedule
• Your app preferences (theme, language, daily analysis quota counters)
• Local crash log files, used only for debugging if the app misbehaves on your device

This data never leaves your device. We have no access to it. If you uninstall PopTutor or clear the app's storage from your system settings, all of it is permanently deleted.

2.3 Advertising data

PopTutor displays interstitial and rewarded video ads through Google AdMob. AdMob may process technical identifiers (such as your mobile advertising ID, device type, OS version, IP address, and approximate location) in order to serve and measure ads. The exact data collected and how it is used depends on whether you consent to personalized ads — see Section 5 below.

2.4 What we do not collect

• No user accounts, no email addresses, no passwords
• No analytics or tracking SDKs (no Firebase, no Sentry, no third-party analytics)
• No contact list, microphone, or precise GPS location
• No payment information

3. Legal basis (GDPR)

Under the EU General Data Protection Regulation, we rely on the following legal bases:

• Performance of a contract (Art. 6(1)(b) GDPR) — to send your uploaded material to Azure OpenAI when you explicitly request a quiz to be generated. Without this processing, the core feature of the app cannot work.
• Legitimate interest (Art. 6(1)(f) GDPR) — to show non-personalized ads and to keep local crash logs for stability. Our interest is funding free distribution and maintaining a working app; the impact on your privacy is minimal.
• Consent (Art. 6(1)(a) GDPR) — for personalized ads. You can withdraw consent at any time from within the app's settings.

4. Children and age

PopTutor is suitable for school-age users and adults. The first time you open the app you will be asked to confirm your age. Based on that:

• If you are under 13, PopTutor will only show non-personalized ads. Google AdMob is configured with the "tag for users under the age of consent" (TFUA) flag so that no behavioural advertising profile is built.
• If you are 13 or older, you will be asked through Google's consent dialog whether you allow personalized ads. You can decline, and the app will still work normally with non-personalized ads.

We do not knowingly collect personal data from children that goes beyond what is described in this policy. If you are a parent or guardian and you believe your child has provided information to us that you would like removed, please contact privacy@poptutor.app.

5. Advertising and consent

Ads are served by Google AdMob, a service provided by Google Ireland Limited. When you first open the app (and again whenever required by law), you will see a consent dialog asking whether you agree to personalized advertising:

• If you consent, AdMob may use your mobile advertising identifier and other technical signals to show you ads relevant to your interests.
• If you decline (or are under 13), AdMob will only show non-personalized ads, which are based at most on coarse context such as the app and approximate region.

You can change your choice at any time from the app's settings. On iOS, ad personalization also depends on the system-level App Tracking Transparency permission. For details on how Google handles this data, see the Google Ads Privacy Policy.

6. Where your data is processed

• On your device — all study materials, questions, and progress.
• Microsoft Azure OpenAI, Sweden Central (EU) — temporary processing of uploaded material to generate questions.
• Google AdMob — ad serving infrastructure operated by Google. Data may be transferred outside the EU under the EU–US Data Privacy Framework and Standard Contractual Clauses.

7. Data retention

• Material sent to Azure OpenAI: processed in real time and not retained by us. Microsoft may retain prompts for up to 30 days for abuse monitoring under its standard Azure OpenAI terms.
• Data on your device: kept until you delete it from within the app or uninstall PopTutor.
• Local crash logs: automatically rotated after 14 days.
• Ad data: retained by Google according to its own retention policies.

8. Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you
• Ask us to correct inaccurate data
• Ask us to delete your data ("right to be forgotten")
• Object to or restrict processing
• Receive your data in a portable format
• Withdraw consent at any time
• Lodge a complaint with a supervisory authority — in Sweden this is the Swedish Authority for Privacy Protection (IMY)

Because PopTutor does not store any personal data about you on our servers, in practice many of these rights are exercised directly on your device: you can delete your data at any time by clearing the app or uninstalling it. For anything else, contact privacy@poptutor.app.

9. Security

Communication with Azure OpenAI is encrypted in transit (HTTPS/TLS). Local data on your device is protected by your operating system's standard app-sandboxing mechanisms. We do not transmit your study material to any other party.

10. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top will reflect the most recent revision. Material changes will also be communicated through the app.

11. Contact

For any privacy question, complaint, or request, contact us at privacy@poptutor.app or by post at the address in Section 1.

12. Website cookies

This website (poptutor.app) uses a single strictly-necessary functional cookie, .AspNetCore.Culture, to remember the language you pick using the language switcher in the page header. The cookie stores only the two-letter language code you chose (one of en, sv, es, de) — no identifier, no tracking, nothing else. It is set in direct response to your explicit click and falls under the "strictly necessary" exception in Article 5(3) of the ePrivacy Directive, so we do not ask for consent before setting it. The cookie expires after one year of inactivity. You can clear it at any time through your browser's site-data controls; if you do, the website will revert to detecting your preferred language from your browser's settings on your next visit.