The short version, for anyone not reading all of it.
We store your email address and your study progress, because without them there is no account and no review at the right time. There are no ads, no trackers, we sell nothing to anyone, and we use no behavioral analytics service. Account deletion can be started inside the app, as described in this policy.
Who is responsible for your data
AXIS is developed and operated in Brazil by Marcos Vinícius Fernandes Santana, an individual, who is the data controller under the LGPD — Brazil’s data protection law (Law 13,709/2018). Requests related to the rights described in this policy should be sent to privacidade@m1synapse.com.
What we collect, and why
Every line below exists for an operational reason. We collect nothing “in case we need it later.”
| What | Why |
|---|---|
| Email address | To identify your account, let you sign in on another device, and recover your password. It is the only personally identifying detail we ask for — we do not ask for your name, a government ID, a phone number or a date of birth. |
| Password | To sign in. It is stored only as a cryptographic hash by our authentication provider: neither we nor anyone else can read it back. |
| Study progress | Which expressions you have seen, how you rated each one, and when each review is due. It is the heart of the product: without it there is no spaced repetition, and switching devices would erase months of study. |
| Favorites, points and rank | To pick up where you left off, on any device. |
| Subscription status | To unlock paid content. From Apple we receive only whether the subscription is valid and until when — never your card number, which Apple does not show us. |
| Flashcard error reports | To fix the content. Stores which card was flagged. |
| Problem reports | The text you write on the “Report a problem” screen, plus the app version. The version is included because without it there is no way to reproduce what you saw. |
| Technical events | A closed list of nine milestones and failures — for example “content failed to download” or “the app closed unexpectedly.” Described in section 3. |
About the technical events
This is the part most likely to hide data collection in other apps, so here it is in detail.
We log nine fixed-name events, and nothing beyond them: first successful launch, first expression answered, first block completed, hitting a limit of the free version, subscribing, download failure, sync failure, content-preparation failure, and app crash.
Each event carries only the app version and, where it makes sense, a short code — for example how many of how many modules failed to download. What you wrote, the content you studied, and any identifier of your device are never uploaded.
For crashes we use MetricKit, which is part of iOS itself. There is no third-party kit inside the app — not for analytics, not for advertising, not for crash reporting.
What we do NOT collect
- Nothing for advertising. There are no ads in AXIS and no advertising identifier (IDFA). We will never ask for tracking permission, because we do not track.
- No health data. AXIS teaches medical vocabulary in English. It does not receive, does not store, and has no way of seeing any patient information.
- No behavioral analytics. We do not measure screens viewed, time on screen, taps or scrolling, and we do not build usage profiles.
- No contacts, no location, no photos, no microphone, no calendar. The app does not request those permissions.
Legal basis
We process your data on the basis of performance of the contract (LGPD art. 7, V) — which is what allows an account, stored progress and delivery of subscribed content — and on legitimate interest (art. 7, IX) for the technical events, whose purpose is keeping the app working and fixing failures.
Who we share it with
We do not sell, rent or trade data with anyone. We use four infrastructure providers, and each sees only what it needs:
| Provider | What for, and what it sees |
|---|---|
| Supabase | Database and authentication. This is where the account and the progress live. |
| Cloudflare | Delivery of study content (audio, images and text) and the service that checks whether you have access. It processes your IP address, as any internet service does, in order to answer the request. |
| Resend | Sending account email: sign-up confirmation and password recovery codes. Sees the destination address and the content of the message sent. |
| Apple | App distribution and subscription billing. The payment relationship is between you and Apple. |
We may also disclose information if legally required to do so by a competent authority.
International transfer
These providers’ servers may be outside Brazil. Where the option exists, we choose the nearest region — email, for instance, is sent from São Paulo. Transfers are made under LGPD art. 33, for the performance of the contract you enter into when you create an account.
How long we keep it
Data is kept for as long as necessary for the purposes described in this policy, while the account is active and in line with applicable legal retention periods. After a deletion request, personal data is deleted or anonymized, except where retention is authorized by law.
One exception, and it is explicit.
Flashcard error reports and problem reports may be kept in anonymized form, with no link to the account, after the deletion process is complete.
The reason is easy to verify: “this flashcard has the wrong translation” is information about the flashcard, and it stays true with nobody behind it. Anonymized data may be retained (LGPD art. 12 and art. 16, sole paragraph), and we would rather say so here than have you find out later.
Your rights
The LGPD (art. 18) guarantees that you may request, at any time:
- confirmation that we process your data, and access to it;
- correction of incomplete or outdated data;
- anonymization, blocking or deletion of unnecessary or unlawfully processed data;
- portability of the data to another provider;
- deletion of data processed with your consent;
- information about who we share it with;
- withdrawal of consent.
Write to privacidade@m1synapse.com. Requests are handled in the manner and within the time limits set by applicable law. If the data protection law of your country, state or province grants you additional rights, exercise them at the same address.
How to request account deletion
The request can be started in Settings → Delete my account, inside the app. The screen sets out the effects of deletion before you confirm.
Note: deleting the account does not cancel the subscription. The subscription belongs to your Apple ID and is canceled in iPhone Settings. The app says so on the same screen.
Security
- All traffic between the app and our servers uses HTTPS.
- Downloaded content is encrypted on the device (AES-GCM), with a key that comes from the server and expires — the files cannot be copied elsewhere and used.
- Database access is governed by row-level security policies: each account reaches only its own data.
- The password never travels and is never stored in clear text.
No system is infallible. Security incidents are assessed and, where applicable, reported to data subjects and to the competent authority in the cases and within the deadlines set by law.
Children
AXIS is made for health students and professionals, and is not directed to children under 13. We do not knowingly collect data from children. If you know of such an account, write to us so that appropriate steps can be taken.
Changes to this policy
This policy may be updated to reflect changes in the service or in the law. The current version and its update date will remain available on this page, and additional notice will be given where the law requires it.
Contact
Privacy: privacidade@m1synapse.com
Support: suporte@m1synapse.com