Who runs Lobyas
Lobyas is run by Behnam Azimi, an individual based in the Netherlands, who is responsible for your data. Questions or requests: support@lobyas.com.
What we keep
- Your email address and sign-in details.
- The terms and collections you add, and your study history: what you read, review and quiz, and your streak.
- Your settings, including a Telegram link and an AI key if you add one (stored encrypted).
- AI credit usage.
- If you asked for access, the email you used and when.
We use it to run the app and nothing else: no advertising, no selling, no profiling beyond the study scheduling you see.
Who can see it
Other members never see your progress or history, even in a shared collection. The admin can see basic account details to run the service and help you: your email, streaks, last activity, the provider and last four characters of an AI key if you added one, and how many collections you have. As the operator, I also have technical access to the database, and I use it only to run, secure and fix the service.
Why we use it
- Running your account: sign-in, storing your terms and study history, scheduling what you see next. Needed to give you the service.
- Security and abuse prevention: keeping accounts and the service safe. Our legitimate interest.
- Optional extras: Telegram reminders, your own AI key, and AI or spoken features. Only when you turn them on, and you can turn them off.
- Emails: invites, sign-in and password emails, and updates about collections you requested.
Cookies
Only what the app needs: your login session, your theme, and remembered choices like library filters, the collection you last studied and an unfinished quiz, kept in cookies or on your device. There's no analytics, advertising or tracking, so there's no cookie banner. The installable app also caches pages on your device so it works offline.
Who else handles it
These services process data on our behalf:
- Supabase: database and sign-in. Stores your account and everything you study.
- Vercel: hosts the app.
- Resend: sends invites and collection updates. Sign-up confirmation and password emails come through Supabase.
- Google and Anthropic: write AI quiz questions and Stories. Only when you use those features, and only the term content needed for the request. If you add your own key, requests go on your account with them.
- Murf and ElevenLabs: turn a term or story into spoken audio. They receive the text to be read aloud.
- Telegram: only if you link the bot. We keep your chat ID and send messages through Telegram.
- Google sign-in: only if you choose to sign in with Google.
Some of them are based outside the European Economic Area, mainly in the United States. Where that is the case, we rely on safeguards the GDPR accepts, such as the EU standard contractual clauses or the EU-US Data Privacy Framework.
How long we keep it
For as long as your account exists. When you delete your account in Settings, your account and its data are removed straight away. Copies in our database provider's backups disappear as those backups are replaced on their normal schedule. The text of anything already sent to an AI or voice service is handled under that service's own retention terms. If other people use one of your public collections, make it private first.
Your rights
Under the GDPR you can ask to see, correct or delete your data, or object to how it's used. Deletion is self-serve in Settings; for anything else, email us and we'll reply within a month. If you're unhappy with the answer, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Changes
If this changes, we'll update the date above.