Privacy Policy

• Account and identity data: email address, authentication identifiers, display name, and profile details you provide.
• Learning and personalization data: goals, subjects, exam type and date, study preferences, plans, progress, streaks, quiz answers and scores, flashcard activity, and notification settings.
• User content: topics, prompts, chat messages, feedback, and files or links you choose to provide, including text, PDFs, photos, audio, and YouTube or web links. We also store study materials generated from that content.
• Subscription and transaction data: product, entitlement, purchase status, renewal or expiry date, and store transaction identifiers. Apple or Google processes payment-card details; Capito does not receive full card numbers.
• Technical and usage data: device and operating-system information, app version, language, IP-derived request data, timestamps, feature and screen usage, diagnostics, crash reports, and pseudonymous analytics identifiers.
• Notification and support data: push token, notification preferences, support messages, contact details, and attachments you choose to send.
• Website data: authentication cookies and similar storage required to keep you signed in, plus page and performance measurements where analytics is enabled.

We receive data from you, your device, the app stores, and the service providers described below. We use it to create and secure accounts; ingest source materials; generate and deliver AI study tools; save and synchronize progress; personalize study paths and recommendations; manage subscriptions; deliver requested notifications; provide support; prevent fraud and abuse; diagnose failures; and improve Capito.

Depending on the context and your location, our legal bases include performing our contract with you, complying with law, protecting our legitimate interests in operating and securing Capito, and consent where consent is required. You may withdraw consent for optional processing without affecting processing already carried out lawfully.

Capito uses Google Gemini through Google Cloud Vertex AI and, when configured as a fallback, the Gemini API. Capito also uses Google AI services to create embeddings used for source-grounded retrieval.

When you use an AI feature, we may send Google your prompt, relevant conversation history, selected learning settings, and relevant excerpts from uploaded or linked source material. The returned output is stored when needed to provide your notebook, lesson path, chat history, or generated study material. Capito does not sell this content or use it to train its own general-purpose AI model. Google processes the data under the applicable Google service terms and Capito configuration.

AI output can be inaccurate or inappropriate and must not be treated as professional medical, legal, financial, or emergency advice. Avoid submitting personal or sensitive information that is not necessary for the learning task.

Capito uses progress and quiz data to personalize educational content. It does not use automated decision-making that produces legal or similarly significant effects about you.

We do not sell personal data and do not share personal data with third-party advertisers. We disclose only what is reasonably necessary to processors that help operate Capito, to comply with law, or to protect users and the service.

• Supabase: authentication, database, private file storage, server functions, and backups.
• Google Cloud and Google Gemini: AI generation, embeddings, and related processing.
• RevenueCat, Apple App Store, and Google Play: purchases, entitlement status, subscription management, and fraud prevention.
• Sentry: crash diagnostics and performance monitoring. Capito sends a user ID for correlation but does not intentionally send your email address.
• PostHog: product analytics, feature flags, and app lifecycle events. Mobile session replay is disabled unless Capito later provides a dedicated consent control.
• Expo and platform push services: delivery of notifications you permit.
• Vercel and website analytics providers: website hosting, security, and aggregate performance or page measurements.
• Support and email providers: delivery and management of messages you send to us.

We keep account, learning, and user-content data while your account is active and for as long as needed to provide Capito. Deleting a notebook removes its associated files from active user storage. Diagnostics, security events, support records, and analytics are retained according to operational need and provider settings.

In the mobile app under Profile → Personal Details → Delete Account, you may schedule permanent deletion after a 30-day recovery period or choose immediate permanent deletion. You may also use the external account-deletion page linked below.

A scheduled account is disabled immediately. Its data is retained only to support restoration during the 30-day recovery period and is not used for product development or AI training. Signing in before the displayed deadline lets you cancel the request. After the deadline, an automated deletion process removes the authentication account, learning records, chats, generated materials, and files associated with it.

We may retain limited records when required for tax, accounting, payment disputes, fraud prevention, security, or another legal obligation. Store and processor transaction records remain subject to Apple, Google, and RevenueCat retention requirements. Residual encrypted backups may remain for a limited period until overwritten or expire under the provider's backup cycle.

Deleting a Capito account does not cancel a subscription billed by Apple or Google. Cancel the subscription in the applicable store before deleting the account if you want to prevent future renewal.

Capito uses encryption in transit, access controls, private storage buckets, signed URLs, row-level security, authentication controls, and monitoring intended to protect data. No method of storage or transmission is completely secure, so we cannot guarantee absolute security.

Our providers may process data in Türkiye, the European Economic Area, the United States, or other countries where they operate. Where required, we rely on adequacy decisions, standard contractual clauses, contractual safeguards, or another recognized transfer mechanism. We do not claim that all processing occurs only in the European Union.

Depending on your location, you may have rights to access, correct, delete, restrict, object to processing, receive a portable copy, withdraw consent, or complain to a supervisory authority. You can change notification permissions in Capito or device settings and can request help using the privacy email below. We respond within the period required by applicable law; GDPR requests are generally handled within one month and KVKK applications within thirty days, subject to lawful extensions or exceptions.

Capito is an education service and may be used by students. Where local law requires parent or guardian authorization, that authorization must be obtained before a child provides personal data. If you believe a child supplied data without authorization required by law, contact us so we can investigate and delete it where appropriate.

We may update this policy when Capito, our providers, or legal requirements change. We will update the date above and provide additional notice when a material change requires it.

Data controller and service operator: Capito App (Xar Tech). Privacy requests: privacy@getcapito.com. General support: support@getcapito.com.