Privacy Policy

1. Who we are

Cognito is a personal study platform. The data controller for your information can be reached at cognito@rnsdevs.com. Cognito is a small, independently run project (not a registered company); this address is the single point of contact for all privacy questions.

2. What data we collect

• Account data: name, username, email address and your password (stored encrypted, never in readable form), or a link to your Google or Discord account if you sign in that way.
• Profile data (optional): school, school year, date of birth, country, profile picture.
• Usage data: tasks, notes, subjects, study sessions (duration and time), planned sessions, saved websites, your dashboard layout and widgets, and your open tabs so your workspace comes back after a reload.
• Social data (optional): friendships, shared milestones/activity, shared notes and shared layouts, if you use those features.
• Technical data: IP address (to prevent abuse at sign-in/registration), and device/browser information plus IP for your active sessions (so you can see in your settings which devices you're signed in on). We use a functional session cookie to keep you signed in.
• Mobile app (optional): if you use the Android app and enable this, the app syncs your daily screen time per app (app name and usage duration) and your list of apps to block to your account, so you can view and manage them on the web app. Your timetable is synced as well. The app stores a device token (a random code, stored hashed) so you stay signed in.

2b. Mobile app permissions

The Android app requests a number of permissions, which you can always refuse or revoke yourself:

• Usage access (screen time): only used to show your own screen time. You can turn off sharing with the web app via Settings → "Share screen time with web"; screen time then stays entirely on your device.
• Accessibility service (app blocking): only used to see which app is in the foreground, so apps you've chosen can be blocked during focus mode. No screen content is read, stored, or transmitted.

3. Why we process this data

We process your data to provide the service you're asking for: creating and managing an account, saving and restoring your workspace, calculating statistics, and (if you enable it) sharing features with friends. This is based on the performance of the contract between you and Cognito (Art. 6(1)(b) GDPR). Security measures such as rate-limiting and session logging are based on our legitimate interest in preventing abuse and unauthorized access (Art. 6(1)(f) GDPR). Linking a Google or Discord account happens based on your explicit action (consent, Art. 6(1)(a) GDPR). We do not use your data for advertising and do not sell it to third parties.

4. How long we keep data

We keep your data for as long as your account exists. If you delete your account (via Settings → Privacy → Delete account), all your data is immediately and permanently deleted. Password reset and verification codes automatically expire after 30 to 60 minutes.

5. Who we share data with

We never sell your data. We work with a limited number of parties that are necessary to run the service:

• Hosting provider (within the EU/EEA): stores the database and application.
• Google and/or Discord: only if you choose to sign in via that provider; they then process your login according to their own privacy policy.
• UploadThing: file storage for attachments you share yourself within Communities, if you use that feature.
• ip-api.com: on your very first visit we send your IP address once to this geolocation service to determine your language preference (Dutch or English). Only your IP address is sent, nothing about you is stored by this service, and a cookie then remembers your choice so the lookup is not repeated.

6. International transfers

Our hosting is located within the EU/EEA. Some third parties named above (such as Google, Discord, UploadThing and ip-api.com) may process data outside the EEA. Those parties provide appropriate safeguards for this (such as standard contractual clauses) via their own processing terms.

7. Cookies and local storage

Cognito only uses functional, technically necessary cookies: a session cookie (httponly, samesite) to keep you signed in, a CSRF security token, and a cookie that remembers your language preference. We do not use tracking, analytics or advertising cookies, and we do not place third-party cookies for marketing purposes. Because this is strictly necessary, functional storage, no separate consent is required for it. On your very first visit we determine your language preference based on your IP address; after that, the cookie remembers your choice (you can always switch languages via the link at the bottom of any page).

8. Minors

Cognito is intended for pupils and students. You must be at least 13 years old to create an account; you confirm this yourself when creating your account. If you are younger than 13, please ask a parent or guardian for permission before creating an account.

9. Security

We take technical measures to protect your data: passwords are hashed (never stored in readable form), all database queries use prepared statements, every write action is protected with a CSRF token, sessions are regenerated after signing in, and rate-limiting applies to sign-in, registration and password recovery.

10. Your rights

You have the right to access, correct and delete your data, and the right to receive your data in a portable format (data portability). You can arrange this yourself:

• Access & correction: update your profile and settings yourself in the app.
• Data portability: download all your data as a JSON file via Settings → Privacy → Your data.
• Deletion: delete your account entirely via Settings → Privacy → Delete account.

For other requests (for example, objecting to a specific processing activity), you can email cognito@rnsdevs.com.

11. Complaints

If you're not happy with how we handle your data, please let us know first via the email address above. You also have the right to lodge a complaint with the supervisory authority: in Belgium the Data Protection Authority, in the Netherlands the Dutch Data Protection Authority.

12. Changes

We may update this privacy policy, for example when we add new features. For a significant change, we'll ask you to agree again on your next visit. The date at the top of this page shows when the policy was last updated.

13. Contact

Questions about this privacy policy? Email cognito@rnsdevs.com or use the contact page.