Korepetitorius privacy policy
Korepetitorius is an app for macOS and Windows that explains school tasks you select on your screen. This policy explains what personal data we collect when you sign in, why, and what you can do about it.
Who is responsible
The controller is Liutauras Razma, Lithuania, the developer of Korepetitorius. Contact: liutauras.razma@soreachme.com.
What we collect
- Account: your email address. If you sign in with Google, also your Google account ID, name and profile picture link from Google. If you create an account with email, your password, stored only as a salted scrypt hash that cannot be turned back into the password.
- Devices: for each sign-in, the app version, the operating system and its version, your country and when it was last used.
- Country: worked out from your IP address with DB-IP's database on our own server (IP geolocation by DB-IP). Only the two-letter country code is kept; the IP address itself is never stored or sent anywhere.
- Usage statistics: which features you use (Learn or Quick check, hints, steps, showing the answer, practice, chat, marking answers, settings changes), the school subject and short topic of each task as identified by the AI (for example "math", "Pythagorean theorem"), how many questions a task had, which AI model answered, how long it took, and error codes.
- Website visits: when you open korepetitorius.0l.lt we count the page, its language, the site you came from (its name only), whether you use a phone or a computer, its operating system and browser language, your country, and download clicks. There are no cookies and your IP address is not stored. While a page is open and visible, it tells our server every 30 seconds that it is still open, so we can see how many people are on the site right now; this is kept in memory for a minute and never saved. To count a visitor once a day we use a code made from the IP address and browser together with a random value that changes every day and is never kept, so you cannot be recognised on another day.
- App online status: while the app runs and you are signed in, it checks in with our server every 2 minutes, so we can see how many people use it right now. This is kept in memory for 5 minutes and never saved.
- App sessions and performance: when the app is opened and closed, how long each step of a task takes (taking the screenshot, selecting, preparing the image, waiting for the answer), how long the task window stays open, the time and token counts of each AI request, cancelled or unanswered tasks, updates, and error messages from the app's own windows (their first 40 characters). Each app session and each task gets a random ID so its steps can be seen together.
What we never collect
Screen captures, the text of tasks, the answers and explanations, your chat messages and your API key never reach our server. Captures are sent directly from your computer to Google Gemini for analysis under Google's terms; we do not receive them.
Why, and on what legal basis
- To provide your account and sign you in: performing our agreement with you (GDPR Art. 6(1)(b)).
- To understand how the app is used and to improve it, for example which features help, which subjects need better answers, and which errors to fix: our legitimate interest in improving the app (Art. 6(1)(f)). We keep this to the minimum listed above. You can object at any time by deleting your account.
- To count website visits and see how people find the site: our legitimate interest in running and improving the website (Art. 6(1)(f)). These counts cannot identify you.
How long we keep it
- Usage statistics and website visits: 12 months, then deleted automatically.
- Sign-in records: deleted 30 days after you sign out or the session expires.
- Email codes: deleted after a day. Registrations whose email was never confirmed: deleted after 7 days.
- Account: until you delete it, or after 24 months without any use.
Who processes it
- Railway (Railway Corporation, USA) hosts our server and database in the Netherlands (EU) under its data processing agreement.
- Amazon Web Services (Amazon SES, USA) delivers the verification and password-reset emails under the AWS data processing terms.
- Google handles sign-in with Google. Your Google account itself is covered by Google's privacy policy.
Your rights
You can see what we hold, get a copy, have it corrected or deleted, and object to its use.
- Copy of your data: Settings → Account → Export my data.
- Delete everything: Settings → Account → Delete account. Your account and all its statistics are removed immediately.
Pupils under 14
If you are under 14, ask a parent or guardian before signing in.
Security
Data travels over HTTPS. Your sign-in token is kept on your computer in the settings file of the app, readable only by your user account, and our server keeps only a hash of it; signing out or deleting the account revokes it. Passwords are stored only as salted scrypt hashes. When you choose a password, we check that it has not appeared in a known data breach using Have I Been Pwned: only the first 5 characters of the password's SHA-1 hash are sent, never the password.
Changes
If we change this policy, we will update the date above and, for important changes, tell you in the app.