Korepetitorius privacy policy
Korepetitorius is an app for macOS and Windows that explains school tasks you select on your screen. This policy explains what personal data we collect when you sign in and use the app, what happens to the tasks you send for an answer, why, and what you can do about it.
Who is responsible
The controller is SoReachMe MB (company code 307501789, registered address Žalgirio g. 92, Vilnius, 09303, Lithuania), which provides Korepetitorius. Contact: liutauras.razma@soreachme.com.
What we collect
- Account: your email address. If you sign in with Google, also your Google account ID, name and profile picture link from Google. If you create an account with email, your password, which we never store as it is: we keep only an irreversibly encrypted version, so nobody, including us, can see it.
- Devices: for each sign-in, the app version, the operating system and its version, your country and when it was last used.
- Country: worked out from your IP address with DB-IP's database on our own server (IP geolocation by DB-IP). Only the two-letter country code is kept; the IP address itself is never stored or sent anywhere.
- Usage statistics: which features you use (Learn or Quick check, hints, steps, showing the answer, practice, chat, marking answers, settings changes), the school subject and short topic of each task as identified by the AI (for example "math", "Pythagorean theorem"), how many questions a task had, which AI model answered, how long it took, and error codes.
- Website visits: when you open korepetitorius.0l.lt we count the page, its language, the site you came from (its name only), whether you use a phone or a computer, its operating system and browser language, your country, and download clicks. There are no cookies and your IP address is not stored. While a page is open and visible, it tells our server every 30 seconds that it is still open, so we can see how many people are on the site right now; this is kept in memory for a minute and never saved. To count a visitor once a day we use a code made from the IP address and browser together with a random value that changes every day. That value is kept only for its day and then deleted, so you cannot be recognised on another day.
- Suggestions: if you send an idea or a complaint from the app (Settings → Suggestions), we keep its text with your account, along with the time, the app's language and version, and the operating system, so we can read it and reply. It is deleted with your account and included in the data export.
- App online status: while the app runs and you are signed in, it checks in with our server every 2 minutes, so we can see how many people use it right now. This is kept in memory for 5 minutes and never saved.
- App sessions and performance: when the app is opened and closed, how long each step of a task takes (taking the screenshot, selecting, preparing the image, waiting for the answer), how long the task window stays open, the time and token counts of each AI request, cancelled or unanswered tasks, updates, and error messages from the app's own windows (their first 40 characters). Each app session and each task gets a random ID so its steps can be seen together.
- Built-in AI requests: for each request the built-in AI sends to Google for you, the time, the type of request (explanation, quick check, follow-up message, practice task or answer check), the AI model, the task's random ID, the number of tokens, what it cost us, any error code and how long it took. We use these numbers to apply the free daily limits and to keep our costs under control.
- Computer ID: with each built-in AI request the app sends a one-way code made from your computer's hardware ID (a salted SHA-256 hash). The hardware ID itself never leaves your computer, and the code can't be turned back into it. We keep it with the request record, so the free daily limits count per computer as well as per account.
- Purchases: if you buy Plus, what you bought, when, until when it works, the amount and currency, whether it renews, and the Stripe customer and subscription IDs. Card and payment details are entered on Stripe's page and never reach us.
Your captures and tasks
To answer, the AI needs to see what you selected. The capture, the task text and your chat messages pass through our server to Google Gemini, and the answer comes back the same way. Our server does not save or log them: they are only in its memory while the request runs, and captures are never written to disk. We use Google's paid Gemini API, under which Google's terms say Google does not use them to improve its products; Google may keep them for a limited time to detect abuse and to meet legal obligations.
Why, and on what legal basis
- To provide your account and sign you in: performing our agreement with you (GDPR Art. 6(1)(b)).
- To understand how the app is used and to improve it, for example which features help, which subjects need better answers, and which errors to fix: our legitimate interest in improving the app (Art. 6(1)(f)). We keep this to the minimum listed above. You can object at any time by deleting your account.
- To count website visits and see how people find the site: our legitimate interest in running and improving the website (Art. 6(1)(f)). These counts cannot identify you.
- To answer the tasks you send with the built-in AI: performing our agreement with you (Art. 6(1)(b)). To keep a record of each built-in AI request, so the free limits are fair and our costs stay under control: our legitimate interest (Art. 6(1)(f)).
- To count free use per computer, so one person can't multiply the free plan with many accounts: our legitimate interest in preventing abuse of the free plan (Art. 6(1)(f)).
- To sell you Plus and give you access to it: performing our agreement with you (Art. 6(1)(b)). Keeping payment records as accounting law requires: a legal obligation (Art. 6(1)(c)).
How long we keep it
- Usage statistics, built-in AI request records (with the computer code) and website visits: 12 months, then deleted automatically.
- Purchases: with your account. Stripe keeps its own payment records for as long as accounting law requires.
- Sign-in records: deleted 30 days after you sign out or the session expires.
- Email codes: deleted after a day. Registrations whose email was never confirmed: deleted after 7 days.
- Account: until you delete it, or after 24 months without any use.
Who processes it
- Railway (Railway Corporation, USA) hosts our server and database in the Netherlands (EU) under its data processing agreement.
- Amazon Web Services (Amazon SES, USA) delivers the verification and password-reset emails under the AWS data processing terms.
- Google (Gemini API) answers the tasks you send with the built-in AI, as our processor under Google's terms for the paid Gemini API. Google may process them outside the EU under its data processing terms.
- Stripe (Stripe Payments Europe, Ltd., Ireland) processes payments for Plus. The card and payment details you enter on Stripe's page are handled by Stripe under its own privacy policy; we only get the result (what was paid and for which account).
- Google handles sign-in with Google. Your Google account itself is covered by Google's privacy policy.
Your rights
You can see what we hold, get a copy, have it corrected or deleted, and object to its use.
- Copy of your data: Settings → Account → Export my data.
- Delete everything: Settings → Account → Delete account. Your account, all its statistics, its built-in AI request records and its purchases are removed immediately, and a monthly Plus subscription is cancelled.
Pupils under 14
If you are under 14, ask a parent or guardian before signing in or buying Plus.
Security
Data travels over HTTPS. Your sign-in token is kept on your computer in the settings file of the app, readable only by your user account, and our server keeps only an encrypted copy of it; signing out or deleting the account revokes it. Passwords are stored only irreversibly encrypted, so nobody, including us, can read them. When you choose a password, we check that it has not appeared in a known data breach using Have I Been Pwned: only a short piece of a code made from the password is sent, never the password itself.
Changes
If we change this policy, we will update the date above and, for important changes, tell you in the app.