Privacy policy
In effect as of 8 August 2026.
LeitnerLoop works without an account and without a network. Nothing you write leaves your device, and the app asks for no name, no email address and no location.
Two qualifications, and they matter. First, you may choose to sign in so that your cards follow you from one device to another; what that puts on our servers is detailed below, and it can be deleted in one gesture. Second, on Android and iPhone the free version shows ads, and Google's ad network then collects information of its own — we do not. Buying the full version puts an end to the second; the first only exists if you ask for it.
The app is published by Réseau Inter-Système, a company established in Québec, Canada.
Your cards stay with you
Your sets, your cards and your review history are stored in a local database, on your device. As long as you do not sign in, they are transmitted to no one — not to us, not to a third party. We have no access to them, so there is nothing on our side to keep, to export or to delete.
To erase everything, uninstalling the app is enough: the local database goes with it. If you created a backup file, it belongs to you and sits wherever you put it; it contains your cards in the clear, and its fate is yours alone to decide. If you had signed in, uninstalling is not enough — see the next section.
The account, if you open one
Signing in is optional. The app only offers it in its settings, never at startup, and everything works without it. It serves one purpose: carrying your cards from one device to another.
You identify yourself with Google or Apple. We neither create nor hold any password. The provider hands us a signed token, which may contain your name and your email address — we do not keep them. Our server derives a one-way fingerprint from it and records two things only: that fingerprint, and the date the account was created.
In practice, we cannot identify you anywhere but on our own servers. We cannot ask Google or Apple who you are, nor find you in another service. If our entire account table leaked, there would be nothing in it that identifies you.
So that you do not have to sign in every time you open the app, it stores what is called a refresh token in the system vault: the keychain on iPhone and iPad, encrypted storage on Android, the credential locker on Windows. It serves only to obtain a new session, and nothing else — it gives access neither to your cards nor to anything else without going through our servers.
On our side, we keep only a one-way fingerprint of it and its creation date. It changes with every use: the one that has just served stops being valid immediately, so a copied token works once and gives itself away. Signing out erases it from the device and from our servers; deleting your account erases all of them.
Syncing
If you ask to sync, the app places an archive of your whole library on your account — your sets, your cards, your history. The server stores it as it is, without opening it: it does not read the cards, does not index the content, and uses it for nothing other than handing it back to you. One archive per account: each sync replaces the one before it.
Do not sync cards containing sensitive information that you would not want to leave your device. The archive is protected by your session, but it sits on our servers, and we would rather say so than let you work it out for yourself.
Deleting your account
In the app: Settings › Sync › Delete my account.
The effect is immediate and final. Your archive is erased from our servers, then your account; any session still open stops being accepted at once. We keep no copy, no trash bin, no grace period. What is on your device is untouched: your cards stay with you, and you can carry on without an account.
You may also simply sign out; in that case the account and the archive remain until you ask for their deletion. And since the question comes up: uninstalling the app does not delete your account. Do it from the app before uninstalling, or write to us.
How to delete your account — the procedure in detail, including if you no longer have the app.
Reminders
Study reminders are scheduled by your device itself. No notification passes through a server, and nothing you are reviewing is sent anywhere to trigger them.
Advertising, on mobile only
The Windows version shows no advertising and includes no analytics tool.
On Android and iPhone, the free version shows ads supplied by Google AdMob. In order to serve them, AdMob may collect information of its own — your device's advertising identifiers, its IP address and the approximate location inferred from it, the device type, and interactions with the ads. That information goes to Google, not to us: we neither see it nor receive it. Its processing is governed by Google's privacy policy.
Personalised ads
These ads may be personalised, that is, chosen according to an interest profile that Google associates with your device's advertising identifier, built from your activity in other apps and sites. That profile belongs to Google. It is fed by none of your card content: what you review never leaves your device and is never used to target anything.
Personalisation depends on your consent. Where regulation requires it, the app shows Google's consent form before loading a single ad. On iPhone, Apple's tracking prompt is added to it and you may refuse. If you refuse, the ads remain — they are what funds the free version — but they are no longer chosen from a profile; Google keeps receiving the technical minimum needed to display and count them.
Changing your mind
You can change your mind at any time, in either direction:
- in the app, Settings › Privacy options reopens the consent form, where it applies;
- on iPhone, Settings › Privacy & Security › Tracking lets you withdraw the permission;
- on Android, your device's Google settings let you reset or delete the advertising identifier.
No decision concerning you is made automatically from that profile: it serves only to choose an ad. Buying the full version removes the ads for good, and with them the collection that comes with them.
Purchases
Purchases go through the store where you obtained the app — Microsoft Store, Google Play or the App Store. That store handles the payment. We see no banking data, no name and no address: the store merely tells the app whether the purchase is active.
If you buy a card pack, we record its identifier and the purchase date on your account — nothing else. That is what allows a pack bought on Android to open on your iPhone: no store talks to another across platforms, so it falls to us to remember. We do not keep the receipt, nor the amount, nor the payment method. Deleting your account erases this list along with the rest.
Packs written by AI
The app can put together a deck of cards from a topic you write. This is the only feature in LeitnerLoop that sends text of your own writing to a third party, and it only runs when you ask it to.
What goes out: the topic you wrote, the deck size requested and the language. That is all. Neither your cards, nor your sets, nor your progress, nor your account identifier go with it — the model does not know who it is writing for.
The request goes through our server, never straight from your device, and then to a language model provider. We currently use Anthropic; we could substitute an equivalent provider, such as OpenAI, and this page would then be updated. Processing at the provider is governed by its own terms — Anthropic's for the current configuration.
We do not keep the packs produced. The server composes the deck, hands it to you, and forgets it. It keeps an accounting trace of the request — its date, your account identifier, the size requested — in order to count down your credits and cap our own spending. The topic you wrote is not part of it.
A pack that shocks you can be reported, from the set menu. The report then sends us the cards concerned and what you have to say about them — without that, we would have nothing to look at, since we do not keep what was produced.
What a model writes may be inaccurate. Generated cards are a starting point to be checked, not a source of authority.
Children
LeitnerLoop is not addressed to children under 13, is not intended for them, and asks no one their age. We knowingly collect no information concerning a child. A parent who finds that their child has opened an account may delete it from the app, or write to us.
This site
This site collects nothing either: no cookies, no analytics, no forms. The only requests that leave this site are the ones you trigger by following an external link. The language button is no exception: it changes the address, it remembers nothing.
If this policy changes
Any change will be published on this page, with its effective date. We have no way of writing to you — that is the price of collecting nothing — so this is where to look.
Contact us
A question about this policy? support@inter-systeme.ca