Privacy Policy

Last updated: 31 October 2026

1. Who we are

Wyzer is a study app for iOS and Android, run by Nazif Mohamed Hanif, based in United Kingdom ("Wyzer", "we", "us"). We are responsible for the personal data described in this policy.

This policy covers the Wyzer app and this website. Questions about it go to wyzer-app@outlook.com.

2. What we collect

Your account

• Email address, if you sign in with a one-time email code. If you use Sign in with Apple and choose "Hide My Email", we get an Apple relay address instead of your real one.
• Sign-in identifiers from Apple or Google, if you sign in with them. We don't get your Apple or Google password.
• Name and profile photo, if you sign in with Google: your Google account name and a link to your Google profile photo. We use your name for the initials on your profile button, and suggest it as the name on your packs when you first publish one. It only becomes public if you keep it and publish.
• A user ID that we create for your account.

What you write and study

• Topics, sub-topics and notes you create.
• Voice notes: if you tap the microphone, your phone's speech recognition turns what you say into text: Apple's on iOS (on your device when it supports this, otherwise on Apple's servers) and Google's on Android. Wyzer doesn't record or keep the audio. Only the text you save becomes part of your note.
• Facts and questions made from your notes, including any you write or edit yourself.
• Review history: which questions you answered, when, how you rated them, and the answers you type.
• Revision packs you publish or save, and the name you choose to show on your packs.
• Reports you make about a pack (the reason and any details you add), and authors you block.
• Feedback you send from Settings: the type you pick, your message, and the app version, operating system and device model it was sent from. We email it to our support inbox with your account email address, so we can reply.

Settings

• Your time zone, daily review limits and reminder time.
• A push notification token for your device, if you turn on reminders.
• Your plan and how many AI features you've used this month (counts and token totals, not extra copies of your notes).

Usage and diagnostics

• Product analytics (PostHog): events such as opening the app, saving a note or finishing a review, with basic device and app information and your approximate location (country and city). PostHog works out the location from your IP address, then discards the IP address; it isn't stored with your events. Events are linked to your user ID, not your email address. We don't record your screen.
• Crash reports (Sentry): what went wrong, device model, operating system and app version, linked to your user ID. We've turned off Sentry's collection of personal details such as IP addresses.
• Bot protection (Cloudflare Turnstile): when you request an email sign-in code, the app opens a page on our website where Cloudflare Turnstile checks the request comes from a person. Usually this happens without you seeing anything; sometimes it asks you to tick a box. It processes your IP address, information about your device and browser, and how you interact with the check, and may store strictly necessary data on your device to do this, under Cloudflare's Privacy Policy and Turnstile Privacy Addendum.
• Server logs (Supabase): when the app talks to our servers, Supabase records your IP address, the time, and what was requested, in its sign-in and request logs. Our own server functions log your user ID and the IDs of notes and packs they work on, with any errors, but not the text of your notes. We use these logs to keep Wyzer secure and to fix problems.
• Website: our website host (Cloudflare) processes your IP address to deliver the site and protect it from attacks, and keeps standard request logs for a short time. The website loads its font from Google Fonts, so Google also receives your IP address. The website doesn't use analytics. Its only cookies are the ones Cloudflare Turnstile may set on the sign-in check page that the app opens, which are strictly necessary to detect bots.

On your device

The app keeps a copy of your data on your phone so it works offline and syncs when you're back online. Signing out or deleting your account clears it.

3. How we use it

• To run Wyzer: keep your account, sync your notes, schedule reviews, and show your progress.
• To make facts and questions from your notes, and to check typed answers (see AI processing).
• To run Discover: show published packs, check them against our community guidelines, and act on reports.
• To send messages you asked for: sign-in codes, daily reminders, and important notices about your account. We only send emails needed to run your account. We don't send marketing emails, and we'll only start if you agree to receive them.
• To keep Wyzer safe and fair: stop bots and abuse, and apply monthly limits on AI features.
• To fix and improve Wyzer: find crashes, see which features are used, and read and reply to feedback you send us.

We don't sell your personal data, share it for advertising, or use it to build advertising profiles.

If you're in the UK, the EU or another place with similar laws, our legal bases are: performing our contract with you (running the app and its features); our legitimate interests (security, preventing abuse, moderating public content, fixing bugs and understanding how the app is used); and legal obligations where they apply.

4. AI processing

Wyzer uses OpenAI's API for three things:

• Fact extraction: when you save or edit a note, its text is sent to OpenAI to produce facts and questions. Notes written as question :: answer lines are not sent.
• Answer checking: when a typed answer is close but not an exact match, the question, the expected answer and your answer are sent to OpenAI to decide whether it's right.
• Moderation: the text of a revision pack is checked by OpenAI's moderation service before it appears on Discover, and again when it changes.

OpenAI doesn't use data sent through its API to train its models. It may keep it for up to 30 days to monitor for abuse, then deletes it. We don't send your email address or name with these requests.

AI-made facts can be wrong. Check them, and don't put sensitive personal information (such as health details or passwords) in your notes.

5. What other people can see

Your notes, facts and progress are private to your account, unless you publish a revision pack.

When you publish a topic as a pack, everything in it (its sub-topics, notes, facts and questions, including notes you add later) is visible to every Wyzer user, along with the name you chose for your packs (or "Wyzer user" if you didn't choose one). Other users can save the pack, which keeps it up to date with your changes, or make their own copy. You can unpublish a pack at any time. Copies other people already made stay theirs.

Other users never see your email address, your review progress, or your private topics.

6. Services that process your data

Services that work for us

These companies process data on our behalf, under contracts that limit what they can do with it.

Services that use data for their own purposes

These companies also decide for themselves how they use the data they receive, for example to run and secure their own services. Their own privacy policies apply to that use.

Wyzer uses Cloudflare Turnstile to protect email sign-in. Using it is subject to Cloudflare's Privacy Policy and Turnstile Privacy Addendum.

We may also share data if the law requires it, to protect the safety of users or the public, or if Wyzer is sold or merged, in which case this policy continues to apply to your data.

7. Where your data is stored

Our database is hosted by Supabase in Central EU (Frankfurt). OpenAI, PostHog, Sentry and some of the other services above process data in the United States. Where data leaves the UK or the EU, we rely on the safeguards those services provide, such as the European Commission's Standard Contractual Clauses with the UK International Data Transfer Addendum, or the UK–US data bridge for certified US companies.

8. How long we keep it

• Your account and study data: until you delete your account. Deleting a note, topic or pack in the app deletes it from our database straight away.
• When you delete your account: your account and everything linked to it (notes, facts, review history, settings, packs you published, reports, blocks and feedback) are deleted from our database straight away. People who saved your packs lose access to them; copies they made stay theirs. Database backups are kept for a short period, then overwritten.
• Analytics: deleted automatically when you delete your account. PostHog removes the events within about a week.
• Server logs: Supabase deletes them automatically after 1 day. They aren't deleted early when you delete your account, but they expire on the same schedule.
• Emails we send: Resend, which sends our emails, keeps a copy of each one (your email address and the message) for 30 days, then deletes it.
• Crash reports: kept by Sentry for its standard retention period, linked only to your user ID.
• Data sent to OpenAI: up to 30 days at OpenAI, as described above.

9. Your choices and rights

• Delete your account: in the app, go to Settings → Delete account. If you can't use the app, email us from the address on your account.
• Edit or delete content: edit or delete any note, topic or pack in the app at any time.
• Notifications: turn reminders off in Settings or in your phone's settings.
• Get a copy of your data, or ask us to correct it: email us.

Depending on where you live, you may have further rights: to access, correct, delete or export your data, to object to or restrict how we use it, and to complain to your data protection authority (in the UK, the ICO). Email us to use any of them; we'll reply within one month. We won't treat you differently for using your rights.

10. Security

Data is encrypted in transit. Access to each user's data is enforced in the database itself, so one account can't read another's private data. Keys for the AI and other services stay on our servers and never ship in the app. No system is perfectly secure, but we work to protect your data and will tell you if a breach affects it, as the law requires.

11. Children

You must be at least 13 to use Wyzer, or older if the law in your country requires it (for example, 16 in some EU countries without a parent's consent). We don't knowingly collect data from children below that age. If you believe a child has given us data, email us and we'll delete it.

12. Changes to this policy

We'll update this page when the way we handle data changes, and change the date at the top. If a change is significant, we'll tell you in the app or by email before it takes effect.

13. Contact us

Email wyzer-app@outlook.com with any question or request about your data.