Application: Poki
Effective date: 17 June 2026
Version: 1.0
Poki, accessible from the App Store, is developed and operated by INNOWAY SAS.
We are committed to protecting the privacy of our users and handling personal data with care, transparency, and respect. This Privacy Policy explains what data we collect, why we collect it, how we use it, which third-party service providers we use, how long we keep data, and what rights users have regarding their personal data.
This Privacy Policy applies to the Poki mobile application and to the related services we provide, including account creation, authentication, artificial intelligence features, flashcard generation, quiz generation, summary generation, OCR-based content extraction, cloud sync, analytics, crash reporting, advertising attribution, and subscription management.
The data controller responsible for the processing of your personal data is:
Company: INNOWAY SAS
Privacy contact:
contact@innoway.app
Users located in France or in the European Union also have the right to contact the competent data protection authority. In France, the supervisory authority is the CNIL:
CNIL
3 Place de Fontenoy
TSA 80715
75334 Paris Cedex 07
France
Website: www.cnil.fr
We collect only the data necessary to provide, secure, maintain, analyze, and improve the app. The categories of personal data we may process are described below.
Users may create an account or sign in using authentication features supported by the app, including Sign in with Apple through Firebase Authentication.
Data processed may include:
Purpose: account creation, authentication, account security, cloud sync, and access to user content.
Legal basis: performance of the contract and legitimate interest in securing the service.
Users may create, upload, edit, save, and manage learning materials in the app.
Data processed may include:
Purpose: providing the core learning features of the app, saving user content, syncing content across devices, allowing users to access and manage their learning materials, and improving the user experience.
Legal basis: performance of the contract.
Users may import documents, images, or text in order to generate flashcards, quizzes, summaries, explanations, or other learning materials.
When a document or image is imported, we may process it using OCR or similar technologies to extract text. The original document or image is not sent to our backend and is not stored in our database.
Only the OCR-extracted text may be sent to our backend, to OpenAI, and/or stored in Firebase Firestore when necessary to generate and save the requested learning materials.
Data processed may include:
We may store the OCR-extracted text and generated learning materials in the user's account so that the user can access, edit, sync, and manage them in the app.
OCR-extracted text and generated learning content are kept until the user deletes the content or deletes their account, unless a longer retention period is required by law or for legitimate security reasons.
Purpose: OCR extraction, generation of learning materials, content storage, and cloud sync.
Legal basis: performance of the contract.
The app uses artificial intelligence to help users generate flashcards, quizzes, summaries, explanations, and other learning materials.
To provide these features, user inputs and related content may be sent to OpenAI for processing and generation of the requested output.
Data processed may include:
AI-generated content may be stored in the user's account so that the user can access, edit, sync, and manage it in the app.
Users should avoid submitting sensitive personal information, confidential information, financial information, identity documents, health data, or third-party private information unless strictly necessary for their own use of the app.
AI-generated content may be inaccurate, incomplete, or inappropriate in some cases. Users should review AI-generated learning materials before relying on them.
Purpose: generating learning materials and providing AI-powered educational features.
Legal basis: performance of the contract and legitimate interest in maintaining and improving the reliability of the service.
The app offers paid features, purchases, free trials, and/or subscriptions. Payment processing is handled by Apple through the App Store. We also use RevenueCat to manage subscriptions, entitlements, purchase status, free trials, renewals, cancellations, and purchase restoration.
Data processed may include:
We do not directly collect or store your full payment card details. App Store payments are processed by Apple.
Purpose: managing access to paid features, subscriptions, trials, renewals, cancellations, and purchase restoration.
Legal basis: performance of the contract and compliance with legal obligations.
We use Amplitude to understand how users interact with the app and to improve the product experience.
Data processed may include:
We do not send names, email addresses, user-generated content, OCR-extracted text, uploaded documents, flashcards, quizzes, summaries, AI prompts, or AI-generated learning materials to Amplitude.
We use analytics data only for internal product analytics, such as understanding feature usage, identifying friction points, improving onboarding, improving retention, and making the app more useful and reliable.
We do not use Amplitude analytics data for third-party advertising purposes.
Purpose: product analytics, app improvement, performance analysis, and internal statistics.
Legal basis: legitimate interest for privacy-friendly internal analytics, or consent where required by law or platform rules.
We use TikTok Ads Manager and the TikTok App Events SDK to measure the performance of our advertising campaigns and optimize our marketing.
Data processed may include:
On iOS, when required by Apple platform rules, we request the user's permission through Apple's App Tracking Transparency framework before accessing the IDFA or engaging in tracking as defined by Apple. If the user refuses permission, we do not access the IDFA and we limit advertising attribution to data that is permitted without tracking consent.
We do not use user-generated learning content, flashcards, quizzes, summaries, OCR-extracted text, uploaded documents, or AI-generated learning materials for third-party advertising.
Purpose: measuring the performance of advertising campaigns, understanding campaign effectiveness, and optimizing marketing campaigns.
Legal basis: consent where required by law or platform rules, and legitimate interest for limited campaign measurement where legally permitted.
We use Firebase Crashlytics to detect, understand, and fix crashes, errors, and performance issues.
Data processed may include:
Crash and diagnostic data helps us improve app stability, fix bugs, and provide a better user experience.
Purpose: debugging, crash analysis, security, and app reliability.
Legal basis: legitimate interest in maintaining a secure and reliable app.
We may process limited technical data to maintain the app, prevent abuse, and protect user accounts.
Data processed may include:
We do not intentionally collect IMEI numbers or MAC addresses from iOS devices.
Purpose: security, fraud prevention, abuse prevention, debugging, and service maintenance.
Legal basis: legitimate interest in protecting the app and its users.
The app offers push notifications. When the user enables them, we may process a push notification token and notification preferences.
Data processed may include:
Users can disable push notifications at any time in their device settings.
Purpose: sending app-related notifications, reminders, learning reminders, or account-related messages.
Legal basis: consent or performance of the contract, depending on the type of notification.
We use personal data for the following purposes:
We do not sell personal data. We do not use user-generated learning content for third-party advertising.
For users located in the European Economic Area, the United Kingdom, or another jurisdiction with similar data protection laws, we rely on the following legal bases:
| Legal basis | Examples of processing |
|---|---|
| Performance of a contract | Creating an account, authenticating users, saving flashcards, generating learning materials, syncing content, managing subscriptions, restoring purchases. |
| Legitimate interest | Securing the app, preventing abuse, debugging, crash reporting, improving app performance, internal analytics where legally permitted. |
| Consent | Optional notifications, advertising attribution, tracking technologies, access to advertising identifiers, and any analytics or marketing activity that legally requires consent. |
| Legal obligation | Compliance with accounting, tax, legal, regulatory, or security obligations. |
The app includes artificial intelligence features that help users transform their content into learning materials such as flashcards, quizzes, summaries, and explanations.
These features are automated. When you use them, you are interacting with an AI-powered system, not with a human teacher.
To provide these features, your prompts, uploaded text, OCR-extracted text, selected learning parameters, and related content may be sent to OpenAI for processing.
AI outputs are generated automatically and may contain mistakes. Users remain responsible for reviewing, correcting, and validating the learning materials generated by the app.
We recommend that users do not submit sensitive personal information, confidential documents, identity documents, financial data, health data, or private third-party information to AI features unless strictly necessary.
AI-generated content may be stored in the user's account if the user saves or generates learning materials through the app.
We use trusted third-party service providers to operate, secure, analyze, monetize, and improve the app. These providers process personal data only as necessary to provide their services to us.
Depending on the features you use, your data may be processed by the following providers:
| Provider | Category | Purpose | Data processed |
|---|---|---|---|
| Apple | Authentication and payments | Sign in with Apple, App Store purchases, subscriptions, refunds, and purchase restoration | Apple account identifier, email address or private relay email, transaction and subscription information |
| RevenueCat | Subscription management | Managing subscriptions, free trials, entitlements, purchase status, renewals, cancellations, and purchase restoration | App user identifier, purchase history, subscription status, product identifiers, transaction identifiers, trial status, renewal and cancellation information |
| Firebase Authentication | Authentication | User sign-in, account creation, account security, and Sign in with Apple integration | User ID, email address or Apple private relay email, authentication identifiers, login metadata |
| Firebase Firestore | Database and cloud sync | Storage and synchronization of user content and app data | Account data, flashcards, quizzes, summaries, OCR-extracted text, learning content, settings, progress |
| Firebase Crashlytics | Crash reporting | Crash detection, error diagnosis, stability improvement | Crash logs, device information, operating system, app version, technical diagnostics |
| Amplitude | Product analytics | Understanding app usage and improving the product experience | Pseudonymous user ID, usage events, device information, app version, language, technical information. We do not send names, email addresses, OCR text, flashcards, quizzes, summaries, AI prompts, or user-generated learning content to Amplitude. |
| OpenAI | Artificial intelligence | Generation of flashcards, quizzes, summaries, explanations, and other learning materials | User prompts, submitted text, OCR-extracted text, generated learning content, related context |
| TikTok Ads / TikTok App Events SDK | Advertising attribution and campaign measurement | Measuring the performance of TikTok advertising campaigns, tracking app installs, trial starts, and purchases, and optimizing advertising campaigns | App events such as install, trial start, and purchase; event timestamps; technical identifiers; device information; advertising identifiers where available and permitted |
These providers may be located in or process data from countries outside your country of residence, including outside the European Economic Area. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses, data processing agreements, or other legally recognized transfer mechanisms.
We do not authorize these providers to use your personal data for their own advertising purposes, except where advertising attribution or campaign measurement is expressly described in this Privacy Policy and permitted by your consent or applicable law.
Some of our service providers may process personal data outside the European Economic Area, including in the United States.
When personal data is transferred outside the European Economic Area, we rely on safeguards required by applicable data protection laws. These may include:
We use Amplitude for product analytics. This helps us understand how the app is used, which features are helpful, where users encounter problems, and how we can improve the app.
We do not send names, email addresses, user-generated content, OCR-extracted text, uploaded documents, flashcards, quizzes, summaries, AI prompts, or AI-generated learning materials to Amplitude.
We also use TikTok Ads Manager and the TikTok App Events SDK to measure the performance of our advertising campaigns and optimize our marketing. For example, we may send app events such as app install, trial start, and purchase events to TikTok.
These analytics and attribution tools may process technical information, pseudonymous identifiers, event timestamps, app usage events, device information, and advertising identifiers where available and permitted.
On iOS, when required by Apple platform rules, we request the user's permission through Apple's App Tracking Transparency framework before accessing the IDFA or engaging in tracking as defined by Apple. If the user refuses permission, we do not access the IDFA and we limit advertising attribution to data that is permitted without tracking consent.
We do not sell your personal data. We do not use your user-generated learning content, flashcards, quizzes, summaries, OCR-extracted text, uploaded documents, or AI-generated learning materials for third-party advertising.
The mobile app does not use browser cookies in the same way as a traditional website. However, the app and third-party SDKs may use similar technologies such as technical identifiers, authentication tokens, device identifiers, analytics identifiers, advertising identifiers, or crash reporting identifiers.
These technologies may be used for:
Where consent is required by law or platform rules, we will request it before using non-essential technologies.
We keep personal data only for as long as necessary to provide the app, maintain user accounts, ensure security, comply with legal obligations, and allow users to access their learning materials.
| Category of data | Retention period |
|---|---|
| Account and authentication data | Kept while the account remains active, then deleted or anonymized after account deletion unless retention is legally required. |
| Flashcards, quizzes, summaries, explanations, and learning content | Kept until the user deletes the content or deletes their account. |
| OCR-extracted text | Kept in the user's account until the user deletes the related content or deletes their account. |
| Original uploaded documents and images | Not sent to our backend and not stored in our database. They are used only for OCR extraction and generation of the requested learning materials. |
| AI prompts and generated outputs stored in the app | Kept until the user deletes the related content or deletes their account. |
| Subscription, trial and purchase information | Kept as long as necessary to manage paid access, restore purchases, handle support requests, and comply with legal, tax, accounting, and App Store obligations. Certain accounting-related records may be retained for up to 10 years where required by law. |
| Amplitude analytics data | Kept for up to 24 months for internal product analytics, then deleted or anonymized. |
| TikTok advertising attribution data | Kept for up to 24 months for campaign measurement and optimization, then deleted or anonymized. |
| Crash logs and diagnostic data | Kept for up to 24 months to investigate and fix crashes, improve stability, and secure the app. |
| Support communications | Kept for up to 3 years after the last contact, unless a longer retention period is required to establish, exercise, or defend legal claims. |
| Security logs | Kept for up to 12 months, unless a longer retention period is necessary to investigate fraud, abuse, security incidents, or legal claims. |
When a user deletes their account, we delete or anonymize personal data associated with the account, unless we are legally required or permitted to retain certain information for security, fraud prevention, legal, accounting, tax, dispute resolution, or compliance purposes.
Users may request deletion of their account and associated personal data. Where available, users can delete their account directly from the app. Users may also contact us at contact@innoway.app.
Account deletion may result in permanent deletion of user-generated content, including flashcards, quizzes, summaries, OCR-extracted text, progress, and settings.
Some data may be retained where required or permitted by law, including for security, fraud prevention, accounting, tax, dispute resolution, or compliance purposes.
Depending on your location and applicable law, you may have the following rights regarding your personal data:
To exercise your rights, please contact us at contact@innoway.app.
We may ask you to verify your identity before responding to certain requests, especially where the request concerns access, deletion, or account-related information.
The app is designed for general learning and flashcard creation. It is not specifically directed to children under the age required by applicable law to use online services without parental consent.
Users under the age required by applicable law must use the app with the consent of a parent or legal guardian.
We do not knowingly collect personal data from children without appropriate consent. If we become aware that we have collected personal data from a child without the required consent, we will take appropriate steps to delete such data.
Parents or legal guardians who believe that their child has provided personal data to us may contact us at contact@innoway.app.
We implement reasonable technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration, disclosure, or destruction.
These measures may include access controls, authentication mechanisms, encryption in transit where applicable, database security rules, logging, monitoring, and restricted access to production systems.
However, no method of transmission over the Internet or electronic storage is completely secure. Therefore, we cannot guarantee absolute security.
In the event of a personal data breach, we will take appropriate steps in accordance with applicable law, which may include notifying the competent supervisory authority and affected users where required.
User-generated content, including flashcards, quizzes, summaries, OCR-extracted text, and AI-generated learning materials, is treated as user content.
We do not sell user content. We do not use user content for third-party advertising.
Access to user content by our team is limited to what is necessary for support, debugging, security, legal compliance, or service maintenance.
If you contact us for support, we may process the information you provide in your message, including your email address, account information, device information, screenshots, bug descriptions, or other information necessary to understand and resolve your request.
Support data is used only to respond to your request, resolve issues, improve the app, and maintain a record of support interactions where necessary.
We may update this Privacy Policy from time to time to reflect changes in the app, our data practices, legal requirements, or service providers.
If we make significant changes, we will notify users through the app, by email, or by another appropriate method before the changes take effect where required by law.
The latest version of this Privacy Policy will be made available in the app or on our website.
For any questions, requests, or concerns regarding this Privacy Policy or your personal data, please contact us at:
INNOWAY SAS
Email:
contact@innoway.app