Privacy Policy

CogRep (“we”, “us”) is a study platform. This policy explains what personal data we process and your rights under the GDPR. The data controller can be reached at admin@cogrep.com.

1. What we collect

• Username — the name you choose to identify your account.
• Password — stored only as a one-way argon2id hash. We never see or store your actual password.
• Security-question answer — used for password recovery, and also stored only as an argon2id hash (never in plain text).
• Preferences — your language and light/dark theme.
• Technical/logging — your IP address and browser user-agent, stored with your login sessions to keep your account secure and operate the service.
• Content you create — the decks, flashcards, notes, quizzes and study activity you add.

What we do not collect: we do not collect your real name, date of birth, email address, phone number, or any payment information.

2. Why we use it, and our legal basis

• To provide the service you sign up for — performance of a contract (Art. 6(1)(b)).
• To keep accounts secure and prevent abuse — legitimate interests (Art. 6(1)(f)).

We do not sell your data, show ads, use it for marketing, or carry out automated decision-making that has legal effects on you.

3. Cookies & local storage

We use a strictly-necessary cookie to keep you logged in, a small cookie to remember your language, and your browser’s local storage to remember your theme. We use no advertising or tracking cookies, so no cookie-consent banner is required.

4. Who else processes your data, and what they hold

• Supabase — our database and authentication backend, where your account lives (username, hashed password, hashed security answer, preferences, your study content, and login session records incl. the IP/user-agent above). Hosted in the EU (Ireland).
• Vercel — hosts and runs the application. It does not hold your account database; its infrastructure logs may temporarily include technical data such as your IP and request metadata.

We maintain data processing agreements with these providers where required under Art. 28 GDPR.

5. AI features and third-party AI providers

Most study material is generated on our own servers, with no AI provider involved. Some optional features may send text you choose to submit to one or more third-party AI providers to generate a result. When that happens, your data is processed securely via those providers’ APIs, is never used to train AI models, and is retained by the provider for at most 30 days — solely for security and abuse-prevention checks (and often not retained at all).

6. International transfers

Your account database (Supabase) is hosted in the EU. Vercel is US-based, so some operational/log data may be processed outside the EEA under appropriate safeguards such as the EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework.

7. How long we keep it

We keep your account and content while your account exists. When you delete your account, everything is permanently deleted immediately. Login sessions expire after 30 days. Provider infrastructure logs are kept only for those providers’ limited periods.

8. Your rights

You can access, correct, delete, restrict, object to, and port your data. You can delete your account and all its data yourself any time in Settings → Delete account, or contact admin@cogrep.com. You may also complain to the Swedish Authority for Privacy Protection (IMY).

9. Children

CogRep is intended for students. In Sweden the digital age of consent is 13; if you are younger, please use CogRep with a parent or guardian.

10. Security

Passwords and security answers are hashed (argon2id), all traffic is encrypted in transit (HTTPS), and database access is restricted to our server.

11. Changes

We may update this policy; the date above shows the latest version.

12. Contact

Questions or requests: admin@cogrep.com.