Privacy policy
Applies to the Ellerni Android app (pl.ellerni.app) and the ellerni.app website.
Version of 8 September 2026
In short
Ellerni turns your notes into questions. To do that, a photo of the page has to reach our server and, from there, the OpenAI language model.
- We delete photos after 30 days. You can delete a page sooner.
- No ads, no profiling, and we sell your data to nobody.
- The app contains no analytics or advertising SDK at all.
- We do not collect your location, your contacts, or access to your photo gallery.
- You delete your account yourself, in the app. Deletion is immediate and cannot be undone.
The rest of this page spells that out in detail.
Who is responsible for your data
The data controller is Aleksander Rasek Software Engineer, a sole proprietorship registered in Poland, {{JDG_ADRES}}, tax ID (NIP) {{JDG_NIP}}.
The same entity publishes the Ellerni app on Google Play.
Contact for anything to do with your data: {{KONTAKT_EMAIL}}.
We are not required to appoint a data protection officer and we have not appointed one. You write to the controller directly.
What we collect, why, and on what legal basis
Below is everything that reaches our server. “Contract” means Article 6(1)(b) GDPR — processing needed for the service to work at all. “Legitimate interest” is Article 6(1)(f). “Consent” is Article 6(1)(a). “Legal obligation” is Article 6(1)(c).
E-mail address
Your login and the only channel we use to reach you: address confirmation, replies to reports, notice of a block. Basis: contract.
Password
We do not store your password. We store a hash of it (bcrypt, cost 12), from which the password cannot be recovered. Basis: contract.
Display name
Optional. Your friends see it in the app. The account works without it. Basis: contract.
Age
You state it once, at sign-up. We do not store it — we only check the threshold, and the number disappears with the request. Basis: legitimate interest together with Article 8 GDPR (checking whether you can agree to the service on your own).
Guardian's e-mail address
We ask for it only when you state an age below 16, and we send one message to it. We store neither that address nor the sign-up attempt itself. Basis: legitimate interest (informing the guardian).
Photos of your note pages
The heart of the service — questions are built from them. They sit on our server for 30 days. Basis: contract.
Text read from the photo
Your phone does this, not the server. The finished text travels with the photo and helps the model read handwriting. Basis: contract.
Questions, sets and review progress
When you answered, whether you were right, and when the question is due again. Basis: contract.
Answers you type or dictate
Needed to grade the answer. Basis: contract.
Your free recall in the “Tell me” mode
The whole text you write or dictate from memory. Basis: contract.
Tokens and the history of spending them
One token is one scanned page. Basis: contract.
Device token for notifications
Identifies your phone in Google Firebase Cloud Messaging. Without it there is no way to deliver a reminder. Basis: consent (a card in the app and a system permission; both can be withdrawn).
Friendships, invite codes, shares and transfers
Who is whose friend, what you shared with whom, and who downloaded it. Basis: contract.
Content reports
The reason, an optional message, the time, which content was reported and — when the reporter is signed in — the reporter's account id. Basis: legal obligation (Digital Services Act) and legitimate interest.
Deletion requests sent from the website
An e-mail address and an optional message. Basis: legal obligation (Article 17 GDPR).
Problem reports from the app
The text of the report, the app version, the device type and the account id. We say so plainly on the report screen. Basis: legitimate interest (fixing defects).
Sessions
A refresh token and when it was used — so you are not asked to sign in every time, and so sessions can be cut off if a token is stolen. Basis: contract.
Server logs
IP address, time, requested address and response code. They enforce rate limits, protect against abuse and help find outages. Basis: legitimate interest (security of the service).
Website statistics for ellerni.app
We count page views with Plausible running on our own server — no cookies, no stored IP address. That is why the site has no consent banner. The statistics do not cover the app. Basis: legitimate interest.
What we do not collect and do not do
- We do not collect your location.
- We do not read your address book or contacts.
- We do not ask for access to your photo gallery — the scanner uses the camera.
- We do not record audio and never receive any (see “Dictation” below).
- We show no ads and the app carries no advertising or analytics SDK.
- We do not profile you and make no automated decisions about you that produce legal effects.
- We do not sell, rent or trade data with anyone.
- We do not use your notes to train models.
Who receives your data
We use four providers. Each gets only what it needs for one specific job.
OpenAI (United States)
We send the photo of the page (inside the request), the text your phone read from it, the questions and model answers, and whatever you type or dictate when answering. Four uses: building questions from a page (model gpt-4o), a second opinion when grading an answer, a coverage judge for the “Tell me” mode, and variants of hard questions (model gpt-4o-mini). We do not send your e-mail address or display name. Under the OpenAI API policy, data sent through the API is not used to train models.
Google (Firebase Cloud Messaging)
Your device token and the content of the review reminder (set name, number of questions). Without this service the reminder cannot reach your phone.
OVH
Outgoing mail. It receives the recipient address and the body of the message: address confirmation, the message to a guardian, replies to reports.
Contabo (Germany)
The server that runs the application and the database. The provider does not look inside the data; it supplies the machine.
Beyond that, data may be handed to public authorities where they have a legal basis. Other Ellerni users see only what you share with them yourself.
Transfers outside the European Economic Area
One provider — OpenAI — is based in the United States. Page photos and answer texts therefore leave the EEA.
The transfer relies on the standard contractual clauses approved by the European Commission, which form part of the agreement with the provider, plus additional safeguards: the connection is encrypted and neither your e-mail address nor your display name travels with the photo.
The other providers (Google, OVH, Contabo) process data on servers in the European Union or under the same clauses.
Dictation and speech recognition
Dictation is handled by the speech recognition built into your phone. That is an Android system feature, not an Ellerni one.
We ask the system for on-device recognition, but on older phones the audio may be sent to Google servers — the system decides that, not us. You see the same sentence inside the app, on the “Me” screen.
Only the finished text reaches Ellerni. We do not store the recording and never receive it. The microphone turns on only when you tap the dictation button yourself.
How long we keep things
Photos of note pages
30 days from upload. After that the file and the read-out text disappear and the questions built from them stay. You can delete a page sooner, in the app.
Your account and everything in it
Until you delete it.
Database backups
14 days. Deleted data disappears from backups after that at the latest.
Address confirmation token
24 hours. A new one voids the previous.
Page transfers to friends
48 hours, or right away once every recipient has downloaded them.
Friend invite codes
7 days.
Gift codes with tokens
30 days; unclaimed codes return to the sender.
Session (refresh token)
30 days. Signing out ends it immediately.
Content reports
They stay even after the reported content is gone or the reporter deletes their account — they are the record that the case was handled. The reported content cannot be reconstructed from them.
Problem reports from the app
They stay, unlinked from a deleted account.
Server traffic logs
Rotated by the server; removed after 30 days at the latest.
Your rights
To use them, write to {{KONTAKT_EMAIL}}. We answer within one month at the latest.
- Access and a copy (Article 15 GDPR) — write to us and we will send everything we hold about you.
- Rectification (Article 16) — you can change your display name yourself in the app.
- Erasure (Article 17) — in the app: “Me” → “Delete account”. Without the app: the form on the “Delete account” page.
- Restriction of processing (Article 18).
- Data portability (Article 20) — we hand the data over in a machine-readable format.
- Objection (Article 21) to processing based on legitimate interest.
- Withdrawal of consent — you can switch notifications off in the app or in your phone's settings at any time. Withdrawal does not undo what happened before it.
You also have the right to complain to the supervisory authority: President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl.
Age and guardian consent
An Ellerni account can be created by a person aged 16 or over. In Poland that is the age from which you can agree to a digital service on your own.
If you state an age of 13–15, we ask for a guardian e-mail address and send one message to it. No account is created and nothing is stored — not even the guardian address. We have no mechanism through which a guardian could give consent by clicking a link.
We do not accept an age below 13 at all.
On Google Play the app is rated for ages 13 and over. That is a content rating, not an invitation to create an account below 16.
If you know that an account was created by someone below the threshold, write to {{KONTAKT_EMAIL}}. We will delete it.
How we protect your data
- All traffic goes over HTTPS, including page photo downloads.
- Passwords are hashed with bcrypt at cost 12 — they cannot be recovered.
- Someone else's scan or set returns “no such resource”, never “you are not allowed” — a refusal alone would confirm that something exists.
- Database passwords, provider keys and the session signing secret live only on the server, never in the code.
- Backups are made daily and checked by a trial restore.
No system is unbreakable. If a breach happens that puts your rights at risk, we will report it to the Polish supervisory authority within 72 hours and tell you about it.
Changes to this policy
The version date is at the bottom of this page. When we change something material we change the date and tell you in the app or by e-mail before the change takes effect.
We send earlier versions on request — write to {{KONTAKT_EMAIL}}.