Privacy

WikiTitan privacy

We use your information to run an English learning beta for adults and eligible teenagers in guardian-managed profiles. Every TestFlight user must be at least 13 or meet any higher applicable local minimum, including when using a guardian’s device. Younger-learner support is being prepared for a future App Store release. We aim for worldwide availability; account access and AI features depend on applicable service, safety and country requirements. This notice covers our website, iPhone beta, browser learning app and support, as each becomes available.

Who we are

WikiTitan
De Tarp 40
1921 VB
Akersloot
Netherlands

Privacy: support@wikititan.com
Phone: +31 6 41114399

We are responsible for WikiTitan account and learning data. An adult opens and owns the account and meets the applicable adult age requirement. Eligible teenage learners use managed profiles after verified guardian permission; they do not get separate sign-in or purchase accounts. WikiTitan keeps an age band rather than a date of birth. We use a nickname and avatar for the learner. WikiTitan verifies guardian permission itself for this beta. After signing in again, the guardian reads a direct notice, chooses permissions and receives a request-specific form. The guardian signs it and privately uploads a scan or photo for manual WikiTitan review. Do not upload a passport, identity card, child’s photograph, child’s legal name or date of birth. A pending request does not create a learner or grant learning or AI access.

What we use and why

To provide the service you request, we use your email, invitation, account and session identifiers, eligibility declarations, profile choices, topics, optional goals, answers, progress, review history and test entitlements. We rely on our service agreement for the adult account and on verified guardian consent for the child learning purposes and optional permissions shown during verification. Required account and eligibility information is needed to open access. Guardians can choose learning without AI generation and review or withdraw permissions.

We use security metadata, coarse request country, rotating abuse-control identifiers, moderation results and reports to protect accounts, prevent misuse and control access and spending. We rely on our legitimate interests in a safe, reliable service, taking particular care with children’s interests and rights. Our edge provider sees your IP address; the rotating identifier is not anonymous. We do not receive or store raw GPS coordinates on our servers.

Support uses your messages to help you, investigate defects and handle privacy requests. We rely on our agreement for service requests, legitimate interests for general support, and legal duties for required rights handling. Accepting terms is not blanket privacy consent.

Optional nearby topics

When available for an adult profile, Nearby in Explore can suggest places to learn about. You can choose a city yourself or tap “Use my location” and grant foreground location permission on your device. WikiTitan resolves that location to a public city on your device. Raw device coordinates stay in memory on the device; they are not sent to WikiTitan’s servers or OpenAI, or saved in your account.

While Nearby is enabled and Explore is open in the foreground, the app refreshes approximately every five minutes and when you return to Explore. It stops refreshing when you leave Explore or put the app in the background. Turning Nearby off clears the current in-app choice. You can separately change location permission in your device or browser settings. A city choice is not retained after the current account/profile session ends.

Our API receives your profile identifier and the public city identifier to check access and return shared suggestions. It does not keep a per-user city history. For a missing or expired city cache, WikiTitan sends the public city center to English Wikipedia’s place search, without your profile, raw coordinates, IP address or sign-in information. Suggestions are shared by city, can be incomplete or outdated, and do not automatically generate AI content. Opening a source link uses that website under its own privacy notice. Choosing to create a lesson uses the normal AI controls and allowance. Public city data comes from GeoNames under CC BY 4.0.

AI and reference searches

When you request enabled AI generation, OpenAI receives the topic, difficulty, coarse age band, public source extracts, drafts and a pseudonymous safety identifier. Adult requests can also include an optional goal. Managed children choose only allowed curated topics; they cannot submit a free-text goal or open prompt. We do not deliberately send your email, nickname, raw account ID or full learning history. Your answers are scored by WikiTitan, not sent to OpenAI for scoring. Avoid secrets, sensitive details and other people's information in free text.

Adult and eligible older-teen AI can use OpenAI Global Standard processing outside Europe, after the applicable permissions and checks. This is not Zero Data Retention. AI for children under 13 or the applicable local digital-consent age stays disabled until the required Zero Data Retention approval and safeguards are in place. Reading an approved lesson library is a separate feature. API content is not used for training by default. Abuse-monitoring content can remain for up to 30 days, with legal/safety exceptions; relevant prompt caches can last up to 24 hours. We cannot promise immediate deletion from provider logs. See OpenAI data controls.

Where source search is enabled, Wikipedia/Wikimedia receives server searches using the selected topic, without the learner’s alias or guardian email. Following a reference opens that provider's own website and privacy notice.

Who receives information

Supabase provides our primary database, sign-in and private files in Frankfurt, Germany. Cloudflare delivers pages and the enabled API edge, and sends sign-in mail through Supabase using no-reply@auth.wikititan.com. Google Cloud provides backend and recovery services; Google Workspace handles support. RevenueCat handles account UUIDs and Apple test transaction/entitlement data. Apple provides sign-in, TestFlight and sandbox services, including testing diagnostics and submitted feedback under its notice. Expo builds app binaries; we do not intentionally supply its build service with learner records. WikiTitan reviews guardian consent forms itself. The form contains the adult’s name, signature and date, the request reference, coarse learner age band and selected purposes. Private form images and review records use our existing storage/backend providers; they are not sent to an AI model for verification. Only authorized operators can review the image. Historical verification-provider records, if any, keep their separate privacy and deletion obligations; new verification does not require k-ID.

These providers can process information outside your country or the EEA, including the US. Applicable provider data-processing agreements, standard contractual clauses or adequacy decisions safeguard processor transfers. Ask us for details or a copy of the relevant safeguards, with confidential material protected. A Frankfurt database does not make all processing Europe-only.

Storage and tracking

The iPhone app keeps sign-in secrets in protected device storage and learning data on your device. Browser sessions and ordinary drafts stay in their tab. Encrypted sign-in continuation can cross tabs for 10 minutes, and invitations for one hour; expired encrypted copies may remain until the browser next cleans them up. Logout clears applicable local session and continuation data.

We have no advertising or third-party advertising analytics and do not sell personal data. We do not enable third parties to track your activity across other websites/apps for advertising. Listed service and platform providers still receive the information above under their own applicable notices. Browser Do Not Track signals do not change this beta's processing because we do not run cross-site advertising tracking. Necessary sign-in storage still operates.

How long we keep data

Guardian form requests expire after 72 hours. Uploaded images become due for deletion at the earlier of request expiry or 24 hours after a review decision; cancellation makes the image due immediately. The cleanup job checks every five minutes when the service is available. Failures can delay removal and require operator follow-up. Unused, terminal request metadata is deleted after seven days once live-image absence is verified. A completed learner permission keeps only the minimal decision record, including the form hash, notice and purpose versions, permissions, review time, method and outcome, subject to the rights and retention rules below.

Raw signature images are excluded from new WikiTitan encrypted recovery archives and are never restored from older archives. Completed decision hashes can remain in database backups. Provider-managed replicas or recovery copies follow the provider's retention; we cannot promise immediate removal from every underlying copy. Our reviewer tool removes its managed local image copies after review or expiry, but an offline operator device can delay that cleanup. Copies you deliberately save or keep on your own device remain under your control. Withdrawal and learner/account deletion have their own rights-handling steps.

We keep account and learning records while needed for your account, then apply deletion. Invitations expire when shown; redeemed access/test-billing evidence stays while needed for access, reconciliation or disputes. Support, security and rights records stay until the issue and justified follow-up are resolved, with minimal evidence retained for legal duties or claims. There is no promised automatic inactivity purge.

Export download access expires after 24 hours; stored copies follow cleanup and backup cycles. Additional encrypted recovery archives, when enabled, follow their configured expiry; deletion records must be reapplied before restored data is used.

Account deletion includes a seven-day cancellation window, followed by application/provider work and sign-in deletion last. A guardian can separately export or delete one child’s data while keeping their own account and other profiles. Child-only deletion has the same cancellation window and does not delete the guardian’s sign-in or billing account. Withdrawing permission stops the affected learning or AI access; it is separate from requesting erasure. Minimal consent and rights evidence may be retained where justified or legally required. This does not delay statutory rights or response deadlines. Support also handles unfinished accounts. Uninstalling or leaving TestFlight does not erase your account; device copies may need local removal.

A note for younger learners

Your parent or guardian chooses your profile and permissions. Some lessons can be made with AI, which can make mistakes. Do not share your name, address, passwords or private details in a lesson or report. Ask a trusted adult for help and report anything upsetting or incorrect. You do not need to buy anything yourself.

Your choices and rights

Contact us for access, correction, deletion, restriction, portability, objection or withdrawal of any consent, as applicable. We may verify identity proportionately and protect other people's data. Ask support to reconsider an automatic admission, funding or learning error. You can complain to your data authority, including the Dutch Autoriteit Persoonsgegevens. We will publish material changes and seek consent where required. Updated 26 October 2026.