Privacy Policy
This policy explains what Iterance collects, why, who helps us run the service, how long we keep things, and the rights you have. Iterance helps you find out what you really know: you save sources or pick a subject map, we make questions with AI, and you review them over time.
Iterance ("we") is responsible for your personal data. Questions, or a request about your data: privacy@useiterance.com.
1. What we collect
Your account. Your name, email address and password. We store your password only as a one-way hash, never the password itself.
What you save. Links, PDFs, YouTube videos, pasted notes, and notes or links you send from the browser extension. For each source we keep its title, our notes on it, its key ideas, and the short passages from it that support each question. We keep the full text only until its questions are made, then delete it.
What Iterance makes from it. Topics, concepts, questions and expected answers. Subject maps you draft or start from a ready-made map.
Your learning activity. Which concepts you say you know, your check and review results, the answers you type when you ask us to check them, your review schedule and your streak.
Sharing. If you share a map, the link and who has taken it. If you take a friend's map, when you finish they see your first name and how many concepts you showed (see section 5).
Settings. Your reminder choices (on or off, time, time zone, how often), review length, and the answers you give during onboarding.
Credits. Your balance and a record of each charge and refund.
Technical data. Your IP address, used for rate limits and security. Server logs of which part of the service was used and how long it took; these don't contain email addresses or what you saved. Error reports, collected without personal data. Basic device and browser information.
2. How we use it, and our legal basis
- To run your account and the service: saving sources, making questions, scheduling reviews, maps and sharing. Basis: performing our contract with you.
- To make notes, topics and questions with AI, and check answers you type. Basis: contract.
- To email you codes and account messages, such as sign-in codes, "your source is ready" and "someone took your map". Basis: contract. Sign-in and password codes are always sent. You can switch the other two off in Settings, and each of those emails has a link to stop them.
- To send review reminders, only if you turn them on. Basis: consent. Every reminder has a one-click link to stop them.
- To keep the service secure, prevent abuse and fix errors. Basis: legitimate interests.
- To understand how the app is used and ask for feedback through short in-app surveys. Basis: consent. This only starts after you choose Allow, and you can change your choice in Settings.
- To count visits without cookies on the website and app, through Vercel and, if you choose No thanks, PostHog. These counts aren't linked to you or your account. Basis: legitimate interests.
- To check and improve the quality of what the AI makes, by reviewing records of past AI requests. These records hold the text sent to the AI and what it returned, with an internal user number. We may copy a few into private test sets used to compare changes to the AI. Basis: legitimate interests.
- To meet legal obligations. Basis: legal obligation.
3. AI processing
We send what you save, the subjects of maps you draft, and the answers you ask us to check to our AI providers: Google (Gemini), OpenAI and Anthropic. The AI makes notes, topics, concepts and questions, and grades typed answers. We use these providers' paid APIs, so under their terms they don't use this data to train their models. They may keep it for a limited time to detect abuse. AI can be wrong, so you can edit or discard any question. We don't use AI to make decisions that have legal or similarly significant effects on you.
4. Who helps us run Iterance
We don't sell your data and we don't show ads. These providers process data for us, only to run the service:
- Database hosting: stores all account data.
- FastAPI Cloud: runs our server.
- Vercel: hosts the app and counts page views without cookies.
- Cloudflare: hosts this website and passes requests on to our server.
- Google (Gemini), OpenAI and Anthropic: AI processing of what you save, map subjects and answers you ask us to check.
- Comet (Opik): records of AI requests and responses, including the content in them and an internal user number, used to check AI quality. United States.
- PostHog: product analytics and in-app surveys: what you do in the app, linked to an internal user number once you sign in, and only if you choose Allow. It never receives what you save. EU (Germany).
- Sentry: error reports, without personal data.
- Better Stack: server logs, without email addresses or content.
- Mailtrap: sends our emails, so it receives your email address and each email's content.
- Upstash: a short-lived cache of your Progress figures, and our background job queue, which holds which source to process and your internal user number.
- tawk.to: live support chat, only if you open it. It sets its own cookies and receives what you type in the chat.
We may also disclose information when the law requires it, or to protect people's safety or the service's security.
5. Shared maps
When you share a map, anyone with the link sees its concepts, plus your progress if you choose to show it. They never see your answers or your sources, and your first name appears on the shared page. When someone takes your map, you see their first name and how many concepts they showed once they finish; we also email you that. You can stop sharing at any time, and the link stops working.
6. Cookies and similar storage
- Essential: sign-in cookies that keep you signed in and protect forms. We can't run the service without them.
- Preferences: small values in your browser, such as whether you've seen the tour and a map you tapped before signing in.
- Analytics: PostHog uses an identifier in your browser. It's only set after you choose Allow. If you choose No thanks, PostHog counts visits without cookies. Change your choice any time in Settings, under Your Data. Vercel's page counts use no cookies.
- Support chat: tawk.to sets its cookies only when you open the chat.
Our fonts are served from our own site, so loading a page doesn't contact any other company.
7. How long we keep it
- Your account and everything in it: while your account exists. Delete your account in Settings and we delete it from our database straight away.
- The full text of a source: only until its questions are made.
- Sign-in and password codes: they stop working after 10 minutes.
- The Progress cache: a few minutes.
- Database backups, server logs, error reports, email delivery records, analytics and AI request records: kept by the providers above for the limited time their service keeps them, then deleted automatically. We never use a backup to bring back an account you've deleted. Ask us for the current periods.
When you delete your account, we also ask PostHog and Opik to delete what they hold about you. Ask us and we'll also remove your requests from the AI test sets in section 2.
8. International transfers
The providers above store and process data in several countries, mainly the United States and the European Union, so your data may be processed outside the country where you live. We transfer it only to provide the service you asked for, and we rely on each provider's data protection terms, including standard contractual clauses where the law requires them. Ask us for details at privacy@useiterance.com.
9. Your rights
Depending on where you live, data protection law, such as the UK or EU GDPR, lets you:
- get a copy of your data; Settings also has Export your data
- correct it
- delete it; Settings has Delete account
- restrict or object to how we use it
- take it to another service
- withdraw consent at any time, for example by turning reminders off
Email privacy@useiterance.com and we'll reply within one month. You can also complain to the data protection authority where you live, such as the Information Commissioner's Office in the UK (ico.org.uk).
10. Children
Iterance is for adults: you must be 18 or over to use it. If you think someone under 18 has given us their data, tell us and we'll delete it.
11. Security
Data travels encrypted, passwords are hashed, and access to production systems is limited to the people who run Iterance.
12. Changes
If we change this policy we'll update the date above, and tell you in the app or by email before a change that matters.
13. The browser extension
The Iterance browser extension reads the address and title of the tab you're on only when you click its toolbar button. When you choose to save the page or a note, it opens Iterance in a new tab with that address or note, and nothing is saved until you confirm there. The extension doesn't read page content, doesn't run on pages by itself, doesn't track your browsing, and stores no data or credentials of its own.