Who is responsible for your data
Syllavi is operated by Megakad XD Ltd, the legal entity responsible for the product and this policy.
71-75 Shelton Street, London WC2H 9JQ, United KingdomInformation Syllavi processes
Depending on how you use the app, Syllavi processes the following categories:
Account and identity
Name and email made available through Apple or Google sign-in, authentication provider identifiers, linked Firebase identity, account identifiers and sign-in timestamps.
Profile and eligibility
Display name, username, locale, time zone, consent choices, a coarse age band and age-assurance status. Syllavi does not ask for or store your exact date of birth for the current age-gate flow.
Learning information
Your learning goal, current level, time commitment, intended outcome and preferences, together with generated outlines, lessons, quizzes, recall content, citations, course versions, downloads and certificates where those features are available.
Progress and responses
Lesson starts and completions, quiz and typed-recall responses, scores, review ratings, due dates, course state and adaptation decisions.
Billing state
Plan and entitlement state, free allowance usage and—when commerce is enabled—store product, transaction and renewal state from Apple and RevenueCat. Syllavi does not receive your full payment-card details.
Device, security and diagnostics
Platform, app version, device or session identifiers, push tokens, App Check signals, request identifiers, provider/model/region metadata, usage, latency, cost, validation results, service status and limited technical logs.
Current scope: Microphone and voice-answer processing are not included in the current public release scope. Syllavi will update this policy and request permission before a future voice feature collects audio.
The published App Store privacy labels cover Name, Email, Other User Content, User ID, Purchase History, Product Interaction, Other Diagnostic Data, Self-declared age band. Syllavi declares that these data are not used for tracking.
Why Syllavi uses information
- To authenticate you and maintain a secure account.
- To confirm age eligibility without requesting an exact date of birth.
- To turn your learning inputs into a structured course.
- To deliver lessons, quizzes, revision and progress tracking.
- To adapt future course material to your progress and responses.
- To manage free allowances and, if enabled, subscription entitlements.
- To detect misuse, protect the service and diagnose technical problems.
- To comply with legal obligations and respond to valid rights requests.
How AI processing works
Syllavi sends the learning inputs and course material needed for a generation task to configured AI service providers. Different stages can research a topic, create a structured outline, draft lessons and check the result. The service policy requires citations for factual claims and an independent verification stage before material is published to the learner.
Generated learning material can still be incomplete or wrong. Citations help you inspect sources, but they are not a guarantee. Use appropriate professional sources for medical, legal, financial or other high-impact decisions.
The production policy is designed to disable provider-side session persistence where supported and to keep limited encrypted raw diagnostics for a short debugging window. Syllavi does not describe generated material as human-authored.
Service providers and partners
Syllavi relies on specialist providers to operate the app and intended website:
Apple and Google
Sign-in identity and platform account authentication.
Google Firebase
Authentication and App Check signals used to protect app and API access.
OpenAI and Alibaba Cloud Model Studio
Course research, structured generation and verification when the approved generation route uses that provider.
Apple App Store and RevenueCat
Purchase and entitlement state when in-app commerce is enabled; checkout is currently disabled.
DigitalOcean
Intended API, database and private object-storage infrastructure.
Cloudflare
Intended delivery, security and reliability of this public website.
These organisations process information under their own terms or on Syllavi’s instructions, depending on the service and relationship. The App Store privacy answers must include the app’s practices and those of integrated third-party code.
Current production intent is EU regional processing with zero-data-retention controls for OpenAI, and Singapore processing with sanitised, non-identifying prompts and inference logging disabled for Alibaba Model Studio. These are deployment intentions, not unconditional final claims: production routing, provider approval and executed data-protection terms must be verified before launch.
Security
Syllavi uses TLS in transit, server-side authentication-token verification, Firebase App Check integration, server-only provider credentials, structured and redacted application logging, and private operational metrics. The policy and schema support encrypted raw AI diagnostics, but their production runtime and purge operation still require verification. Security controls reduce risk, but no online service can promise absolute security.
The current app does not integrate a general analytics or crash-reporting SDK, and its analytics adapter is a no-op. RevenueCat records purchase and subscription events when billing is used.
How long information is kept
The approved policy and database schema set a maximum 168-hour (seven-day) window for encrypted raw AI diagnostic payloads, followed by purge. Runtime encryption and purge operation still require production verification. This period does not apply to account, course, progress or billing records.
Other records—such as account, course, progress, assessment, billing and security records—are retained according to their operational and legal purpose. Their final periods have not yet been approved, so this policy does not claim a duration that the product cannot currently guarantee.
Your choices and rights
Depending on where you live, you may have rights to access, correct, delete or obtain a copy of your information; restrict or object to certain processing; withdraw consent where processing relies on consent; and complain to your local data-protection authority. In the UK, this may include the Information Commissioner’s Office.
The current codebase does not evidence working self-service account deletion or data export. You can email support@syllavi.com to ask about your information, but the operational rights-request workflow is still under review. A deletion request schema and a planned 30-day completion target exist; the deletion executor, status API and data-export API are not implemented, so automated completion is not promised.
Age eligibility
Syllavi is available to people aged 13 or over. The current age gate allows the bands 13–15, 16–17 and adult, and blocks users who declare that they are under 13. Syllavi uses the band and assurance status rather than storing an exact date of birth for this flow.
Younger users may have additional privacy rights and protections. The final launch review must confirm any consent or parental-authorisation rules that apply in each market where Syllavi is offered.
International transfers
Some service providers may process information outside your home country. Where required, Syllavi will use an approved legal transfer mechanism and appropriate safeguards. The final provider regions and safeguards remain under legal review and will be stated here before publication.
This website
This website has no account sign-in, advertising, analytics, contact form or marketing-data collection. Its hosting provider may process standard network and security information needed to deliver the pages, such as IP address, request time and browser details.
Contact and policy changes
For privacy questions, email support@syllavi.com. This is Syllavi’s verified canonical public support contact and is not represented as a designated Data Protection Officer address.
Syllavi may update this policy when the product, providers or legal requirements change. Material updates will be reflected by a new “last updated” date and, where appropriate, an in-app notice.