Privacy

Consumer mode: guest identity

The app never asks for your name, email address, phone number or a password. Instead it generates a random device identifier, stores it encrypted on your device, and uses it to obtain a short-lived access token from the LearnSys service. This identifier is not an advertising or hardware ID and does not identify you by itself.

What stays on your device

Consumer learning history is encrypted on the device. Android uses Android Keystore protection; native iOS uses AES-GCM with a device-only Keychain key. Grade/language preferences and cached entitlements remain local.

Android consumer data is excluded from Android backup/transfer. Native school session, settings, cached practice and queued answers are excluded from device cloud backup. Consumer iOS history follows the existing app storage controls.

Photos and text recognition

Android consumer photo recognition runs on the device first; the optional cloud-recognition action sends a compressed photo to the LearnSys consumer service only when explicitly selected. Android documents automatic removal of locally cached photos within 24 hours. This does not establish upstream server retention.

Native iOS uses the selected photo for on-device Vision text recognition. No photo-upload function is implemented in this native iOS build; recognised text leaves the device only when submitted to the live tutor.

School practice adds no camera, photo upload, face analysis, biometric collection or emotion recognition. Personal QR content can be pasted or opened with the device’s ordinary QR reader.

Android consumer service submissions

All connections use HTTPS. The service stores what it needs to operate quotas, entitlements and safety reviews; your content is not used for advertising and is not sold.

• Your anonymous device identifier, to sign in as a guest.
• The problem text you submit, together with your grade and language, to generate tutoring replies.
• A compressed photo — only when you explicitly request cloud text recognition.
• Google Play purchase tokens, to verify and activate purchases.
• When you report a reply: the session and message identifiers and your reason. The service keeps a short preview of the reported reply for safety review.

Purchases

Android consumer content packs/subscriptions use Google Play, and purchase tokens are sent to the LearnSys service for entitlement verification. Native iOS uses Apple StoreKit; the inspected candidate uses local transaction entitlements and its server transaction-verification integration remains pending release verification. Payment card details are handled by the store and are not received by the app. School licensing is handled with the school, outside the student purchase flow.

Advertising and SDK diagnostics

The apps contain no advertising or advertising identifier. Android consumer OCR uses Google ML Kit. Google states that the SDK collects device/app information, installation identifiers, performance and feature diagnostics for diagnostics and usage analytics. This is distinct from the app’s learning records. Native iOS OCR uses Apple Vision on the device. School mode adds no advertising or analytics SDK.

School mode: information and access

The school supplies the student identifier, school, class/class number and display name used for its existing account. The app authenticates with a personal one-time teacher token; school-capability sign-in returns no email address. The school records question/item version, answer or working, skipped status, practice time, hint count and retries, assignment/session references, mastery estimates, coins and badges. A self-chosen mood tap is collected only if the school explicitly enables it and is optional. No emotional state is inferred from behaviour.

Access is limited to the authorised school, class and student. Teachers review their assigned classes; students see their own practice and progress. There is no public student roster or individual public leaderboard. School records stay on the school VM or the Hong Kong host selected and confirmed for that school. The public demonstration contains fictional data only.

School mode: offline practice and shared devices

Native Android and iOS cache only approved issued questions for the signed-in student. Encrypted pending answers have durable identifiers and sync only for the same school and student. Results, rewards and mastery update after school acknowledgement; completed question identifiers prevent repeated cached questions after reopening.

Shared-device settings default to sign-out when leaving the app. Sign-out removes the displayed identity, tokens, cached practice and progress. An encrypted minimal pending-answer envelope remains until the same student signs in and the school acknowledges it. No token is retained solely for unattended upload. School settings may permit a retained session on a private device; sign out after shared use. The separate Family/browser client uses its own session storage and is not described here as encrypted native storage.

School mode: optional AI and service recipients

School maths AI and the core school AI/budget controls default off. When a school enables both, requests go through the existing approved iGears self-hosted gateway. The app does not contact an upstream model directly. Known school identities and identifiers are redacted before bounded question/working/topic content is processed. No-training, zero-retention and store:false controls are required; usage records contain feature/count/cost/latency metadata rather than student prompts or responses. The school must confirm the actual hosting, logging and processing terms before enabling real-pupil processing.

Student hints select from human-reviewed hints. AI marking is a proposal that a teacher must confirm, and AI-created or adapted questions remain unavailable until human review. Review includes answer correctness, curriculum mapping, safe hints and Creative Commons attribution. No new external AI processor was activated for this pilot.

Existing service recipients include the LearnSys consumer API at ad55.igears.org/mathandroid, Google ML Kit for Android OCR diagnostics, Google Play or Apple for purchases, and the school’s selected hosting/operator arrangement. The consumer API’s upstream tutor/cloud-recognition provider, physical location and retention terms have not been independently confirmed in this update. Contact support for the relevant release’s service information; do not send school personal records to the consumer tutor.

Children

Consumer tutoring does not ask for a name, email or phone number. Do not include names, school identifiers or other personal details in consumer tutor questions. School practice uses only the existing school identity and records needed for teaching; parents and pupils should receive the school’s own notice before use. Purchasing content should involve a parent or guardian.

Retention and deletion

Consumer history can be deleted through the app’s local history controls. Android documents removal of local cached photos within 24 hours. Request deletion of consumer server records linked to the guest identifier through support; purchase records held by Apple/Google are subject to the store’s own controls.

School attempt records default to the current and previous Hong Kong school years, 1 September to 31 August. Schools may configure a shorter retention policy; daily cleanup applies the school-year cutoff. The school’s privacy controls support student and tenant export/deletion. Contact the school for access, correction or deletion of school records, or contact LearnSys support to coordinate. Pending native answers require the same student to reauthenticate before upload; contact the school/support if a shared device must be cleared before that can happen.

Changes and contact

When our practices change we will update this page and the date above. Questions and requests can be sent to iGears Technology Limited, Hong Kong, at the email address below.