Who we are
Alle is a learning app for making and studying flashcards. It is run by its founder, Rodrigo, as an independent project based in Brussels, Belgium. For the purposes of the EU General Data Protection Regulation (GDPR), we are the controller of the personal data described here.
In short: we only collect what we need to run Alle and answer your messages. We don't sell your data, we don't show ads, and the website only uses analytics cookies if you agree to them.
What we collect
When you create an account
Your email address, an encrypted version of your password, and basic account records such as when you signed up and last signed in.
What you add to Alle
Your decks and cards, the links to the Google Sheets you import, deck settings such as colours and names, and your study progress, such as which cards you got right and when they're due again.
When you send us feedback
The message you write, the topic you choose, and the page you sent it from. Your name, your email and any screenshots or files are optional, and we only receive them if you add them.
How you use the app
Simple events inside the app, such as opening it, adding a deck, starting and finishing a study session and how long it took, or choosing light or dark mode. They're stored with your account in our own database and never shared with analytics companies.
To run and improve Alle, we look at these together with basic account details. That includes, per account: your name and email, when you signed up and were last active, how many decks you have, their names and where they came from (for example a ready-made deck, a Google Sheet or AI), and how much you've studied. We don't read the cards inside your decks. Only Alle's owner can see this, in a private dashboard.
Technical information
Like any website, our hosting provider automatically receives technical data when you visit, such as your IP address, browser type and the pages requested. This is used to deliver the site and keep it secure.
Why we use it
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Running your account and saving your decks and progress | Account and learning data | Performing our agreement with you (Art. 6(1)(b)) |
| Reading and replying to feedback, fixing bugs and improving Alle | Feedback messages and attachments | Our legitimate interest in improving Alle during testing (Art. 6(1)(f)); replying by email only if you give us your address |
| Website statistics with Google Analytics and Hotjar | Pages visited, clicks, taps and scrolling, device and approximate location, via cookies | Your consent (Art. 6(1)(a)), which you can withdraw at any time |
| Understanding how Alle is used, to support people and improve it | App usage events, account details, deck names and study activity (not the cards in your decks) | Our legitimate interest in improving Alle (Art. 6(1)(f)) |
| Keeping Alle secure and preventing misuse | Technical data and account records | Our legitimate interest in security (Art. 6(1)(f)) |
| Meeting legal obligations | Only what the law requires | Legal obligation (Art. 6(1)(c)) |
We don't sell your personal data, use it for advertising, or make automated decisions about you that have legal or similarly significant effects.
Service providers
We use a small number of trusted providers to run Alle. They process data only on our instructions.
- Supabase: user accounts, the database for decks, progress and feedback, and storage for feedback attachments.
- Vercel: hosting for the Alle website and app.
- Resend: sending account emails, such as confirming your email address or resetting your password.
- Google Analytics (Google Ireland Ltd): website statistics, only if you accept analytics cookies.
- Hotjar (Hotjar Ltd, Malta): heatmaps and visit recordings on the website, only if you accept analytics cookies.
Some of these providers are based in, or may access data from, countries outside the European Economic Area, including the United States. When that happens, the transfer is protected by safeguards recognised under the GDPR, such as the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework.
Our fonts are served from our own website, so loading a page doesn't send your data to a font provider.
Cookies and storage
The Alle website doesn't use advertising cookies. With your permission, it uses Google Analytics to understand how visitors find and use the site, such as which pages are visited and roughly where visitors come from, and Hotjar to see how pages are used, through heatmaps and recordings of clicks, taps and scrolling (with text you type hidden). Both set cookies and only run if you choose “Accept” in the cookie banner; if you choose “No thanks”, neither loads at all. IP addresses are shortened before storage. You can change your choice at any time with “Cookie settings” at the bottom of the homepage. The Alle app itself doesn't use Google Analytics or Hotjar.
When you sign in to the app, your browser stores a sign-in token so you stay logged in, and your display preferences, such as light or dark mode, are kept on your device. These are strictly necessary for the app to work as you set it up, so they don't require consent.
AI and Google Sheets
AI prompts. Alle can write a prompt for you to use with an AI service of your choice. Alle doesn't send anything to that service. You copy the prompt yourself, and anything you share with an AI service is covered by that service's own privacy policy. Please don't put sensitive personal information into prompts.
Google Sheets. When you import a sheet, Alle reads the published CSV link you provide. Anyone with a published link can view that sheet, so only publish content you're comfortable sharing. Google's own privacy policy applies to your use of Google Sheets.
How long we keep it
- Account, learning and usage data: for as long as your account exists. You can delete your account at any time in the app (Account, then Delete account), which removes it straight away together with your decks, progress and usage events. If you ask us instead, we do it within 30 days, unless we're legally required to keep something.
- Feedback and attachments: for up to 24 months, or sooner if you ask us to delete them.
- Technical logs: kept by our hosting provider for a short period, typically days to weeks, for security and troubleshooting.
Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and get a copy of it
- correct data that is wrong or incomplete
- have your data deleted, including your whole account
- restrict or object to how we use your data
- receive your data in a portable format
To use any of these rights, contact us using the details below. We'll reply within one month. You also have the right to complain to the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données) at dataprotectionauthority.be, or to the authority in the EU country where you live.
Children
Alle is not intended for children under 13. If you are under the age at which you can consent to data processing in your country (13 in Belgium), please use Alle only with the involvement of a parent or guardian. If you believe a child has given us personal data without that involvement, contact us and we will delete it.
Changes to this policy
We may update this policy as Alle grows, for example when new features are added. We'll change the date at the top of this page, and for important changes we'll let you know in the app or by email.
Contact
For any question about your privacy or to use your rights, send us a message through the contact form on our homepage. Choose “Other” and tell us what you'd like us to do.