Privacy policy
Last updated 12 October 2026
Arti is a learning app for medical students. This policy explains what personal data we process when you use the Arti iOS app and its services, why, for how long, and which rights you have under the EU General Data Protection Regulation (GDPR) and Czech Act No. 110/2019 Coll. on personal data processing.
1. Who is responsible
The controller is Arti (operator details to be completed before launch), Prague, Czech Republic ("we"). Contact for anything about your data: privacy@learnarti.com.
2. What we process and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Account: anonymous learner id; if you sign in, your e-mail address, the name you choose, username and avatar; Apple or Google account identifier | Providing your account, signing in on several devices, keeping your progress | Art. 6(1)(b) contract |
| Onboarding answers: university, study stage, goals, daily goal, time zone and language | Personalising your learning plan, counting streak days in your local time | Art. 6(1)(b) contract |
| Learning activity: answers, scores, time spent, review schedule, XP, streak, quests, achievements, league and class standings | Running lessons, spaced repetition, streaks, leagues and classes | Art. 6(1)(b) contract |
| Social: people you follow, classes you join, invite codes | Friends, class leaderboards, invite rewards | Art. 6(1)(b) contract |
| Purchases: App Store transaction ids, product, dates and subscription status (never your payment card) | Granting and renewing Arti Vital | Art. 6(1)(b) contract; Art. 6(1)(c) accounting duties |
| Device push token, app version, notification settings | Reminders and league / streak notifications you allowed | Art. 6(1)(a) consent (iOS permission, revocable any time) |
| Product analytics: pseudonymous usage events (e.g. "lesson started"), app and OS version — no names, e-mail addresses, contacts, location or advertising identifiers | Understanding which features help learning, fixing friction | Art. 6(1)(f) legitimate interest in improving the app |
| Diagnostics: Apple MetricKit crash, hang and performance reports (device model, OS and app version, stack traces) | Finding and fixing crashes and performance problems | Art. 6(1)(f) legitimate interest in a reliable app |
| Feedback and support messages you send | Answering you, correcting content errors | Art. 6(1)(b) contract / 6(1)(f) |
| Problem reports you send ("Shake to report a problem" or Settings › Help & feedback): your description and its category, screenshots of the Arti app (the one taken when you shake your phone and any you add from your photos — you can remove any before sending) and technical context you can review before sending: the screen, lesson or exercise you were on, app and iOS version, device model, language, time zone, network type, pending sync count and a short list of recent in-app screens (never text you typed elsewhere) | Investigating and fixing the problem you report, correcting medical content | Art. 6(1)(b) contract / 6(1)(f) legitimate interest in a reliable app |
| Security logs: IP address and request metadata (kept briefly), rate-limit counters | Protecting accounts and the service against abuse | Art. 6(1)(f) legitimate interest in security |
We do not sell personal data, do not use it for advertising and do not track you across other apps or websites. Arti does not process health data about you: medical content is educational and the cases are fictional.
3. Recipients and processors
We use service providers bound by data-processing agreements under Art. 28 GDPR:
- Cloud hosting and database (EU region where available) for the Arti API.
- Cloudflare (Cloudflare Email Service) for sign-in e-mails.
- Object storage (Cloudflare R2 or Amazon S3, EU region where available) for screenshots attached to problem reports.
- Apple: Sign in with Apple, Apple Push Notification service, App Store purchases and MetricKit.
- Google: Google Sign-In, only if you choose it.
Other learners see only what you share in Arti: your display name, username, avatar, streak, league standing and class rank. Class lecturers see their class members' progress towards class goals.
4. Transfers outside the EU
Some providers (Apple, Google, Cloudflare) may process data in the United States. Transfers rely on the EU–US Data Privacy Framework where the provider is certified, otherwise on the European Commission's Standard Contractual Clauses with supplementary measures.
5. How long we keep data
- Account and learning data: while your account exists. When you delete your account it is erased after a 30-day grace period (signing in again within that period cancels the deletion).
- Anonymous guest accounts that are not used for 120 days are deleted automatically.
- Product analytics events: 180 days. Diagnostics reports: 90 days.
- Problem reports: screenshots are deleted 180 days after the problem is resolved; the report itself is kept while it helps us improve Arti and is de-linked from your account when you delete it.
- Sign-in codes: 24 hours after expiry. Delivered notifications: 30 days. Purchase records: as long as accounting law requires (up to 10 years).
6. Your rights
Under Articles 15–22 GDPR you have the right to access your data, to rectification, to erasure, to restriction of processing, to data portability, and to object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it at any time (e.g. turn off notifications in iOS Settings) without affecting earlier processing.
- Export (access / portability): in the app's Settings, "Export my data" downloads a
machine-readable JSON copy of all personal data we hold about you (API:
GET /v1/me/export). - Delete (erasure): in the app's Settings, "Delete account" (API:
DELETE /v1/me). Sign in with Apple authorisations are revoked as part of the deletion. - Correct: edit your profile in the app, or write to us.
- For anything else, e-mail privacy@learnarti.com. We answer within one month.
You may lodge a complaint with a supervisory authority, in the Czech Republic the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz, or with the authority of your EU country of residence.
7. Children
Arti is meant for university students and is not directed at children. You must be at least 16 years old to use Arti, or have the consent of a parent or guardian where national law requires it.
8. Security
Data is encrypted in transit (TLS) and at rest by our hosting provider. Passwords are never stored: you sign in with Apple, Google or one-time e-mail codes. Access tokens are short-lived and refresh tokens are stored only as hashes.
9. Changes
We will announce material changes in the app before they take effect. Questions: support@learnarti.com.