Privacy Policy
Version 2026-09-05 · Draft revision of 30 September 2026 (the version number changes when this is published)
Draft for review. This describes what the app actually does today. Have a lawyer check it against your jurisdiction before you publish.
The short version
- You can use Howology without an account. We do not ask for your name or email to start learning.
- We do not sell your data, and we do not track you across other apps or websites.
- You can export everything we hold, and you can delete your account from inside the app.
What we collect
| Data | Why | When |
|---|---|---|
| A device identifier we generate | To keep your progress on this device without an account | First launch |
| Email address | To sign you in and recover your account | Only if you create an account |
| Display name, avatar, interests, level, daily goal | To personalise your learning path and sync it to your other devices | Onboarding and settings |
| Learning activity: answers (including which option you picked), scores, quiz results, lessons completed, streak, XP, course ratings | To adapt difficulty, show your progress and mistakes, and restore it all on a new device | As you learn |
| How long you spend reading lessons and in quizzes | To show your study time and to improve lessons | As you learn |
| Your settings: theme, daily reminder time, sound and haptics, notification choices, phone language | To keep the app set up the way you like it on every device | Onboarding and settings |
| How many ads you were shown, and where | To run and measure the free tier. Kept as a running total for your account. | Only if you are shown ads (never under 13) |
| Search queries you type into Ask Anything | To generate the lesson, and to show trending topics | When you use Ask Anything |
| Age band (we ask for your birth year once, keep only the band, and do not keep the year) | To decide whether to show ads and whether analytics may be collected | Onboarding |
| Push token | To send reminders you have opted into | Only if you enable notifications |
| Purchase records | To verify a subscription and restore it | If you subscribe |
| App usage: when you open the app and for how long, the app version and phone model or system version, and which screens and features you use, including how far you get through sign-up and any purchase | To fix bugs and understand which features help | Only if you are 16 or over and say yes. Never under 16. |
| Which notifications we sent you and whether you opened them | To make sure reminders are useful and not too frequent | We record what we send; we record opens only if you allowed usage analytics |
We do not collect your contacts, photos, precise location, health data, or browsing history. We do not store your IP address; it is used only transiently to rate-limit abuse.
Artificial intelligence
Ask Anything and the tutor send the text you type to OpenAI, which generates the lesson or reply. We disclose this in the app before you use those features for the first time, and you must accept it to continue.
- Do not type personal or sensitive information into these features.
- Generated content can be wrong. It is labelled as AI-generated in the app.
- Generated lessons are cached and reused for other learners asking the same question, so your query may help someone else's lesson load instantly. The cache holds the topic and the lesson, not your identity.
Children
Howology is for general audiences and is not directed at children under 13. We ask for your birth year during onboarding and keep only your age band. If you tell us you are under 13, you are not shown ads and we record no ad information, we turn off analytics for your account, and we collect the minimum needed to run the app. Usage analytics are switched off for everyone under 16. Once set, your age band cannot be changed in the app; contact us if it is wrong. If you believe a child has given us personal information, contact us and we will delete it.
Advertising
Free accounts may see ads served by Google AdMob. We keep a count of how many ads each account was shown, and where, so we can run the free tier; we do not record which ads. In the European Economic Area and the United Kingdom we ask for your consent first, and we request non-personalised ads unless you agree otherwise. Learners under 16, and anyone who declines, only ever see non-personalised ads. Subscribers see none.
Who we share with
| Who | What for |
|---|---|
| OpenAI | Generating lessons and tutor replies |
| Apple / Google | Verifying subscriptions, sending push notifications |
| Google AdMob | Serving ads to free accounts |
| Our hosting and email providers | Running the service and sending account emails |
We do not sell personal information, and we do not share it for cross-context behavioural advertising.
How long we keep it
- Your learning history (quiz results, answers, ratings, study time per day) and your totals, including how many ads you were shown: for as long as your account exists.
- The individual records behind those totals (each ad shown, each reading of a lesson, each app session, usage events, notifications sent): 180 days. The totals stay.
- Search queries: 180 days.
- Expired sign-in tokens: 30 days.
- After you delete your account: 7 days, then everything is permanently erased.
Your rights
Wherever you live, you can:
- See your data — Settings, then Download my data, gives you a complete JSON file, including your quiz history, ads shown, and app usage.
- Delete your account — Settings, then Delete account. Access stops immediately. You have 7 days to change your mind by signing in again, after which erasure is permanent and irreversible.
- Correct your data — edit your profile in Settings.
- Withdraw consent — turn off analytics, ads personalisation, or notifications in Settings at any time.
If you are in the EEA or UK, our legal bases are contract (running the app), consent (analytics, ads, notifications, AI features), and legitimate interest (security and abuse prevention). You may complain to your local data protection authority.
Security
Traffic is encrypted in transit. Passwords are stored hashed with bcrypt and are never recoverable. Sign-in tokens are stored hashed, expire, and rotate on every use.
Contact
Questions or requests: Support.