Sam The Wise
Sam The Wise ("we," "us," "our," or "the App") is committed to protecting your privacy and ensuring transparency about how we collect, use, and protect your personal information.
This Privacy Policy explains:
By using Sam The Wise, you consent to the collection and use of information as described in this policy.
Age Requirement: You must be at least 16 years old to use Sam The Wise. We do not knowingly collect personal information from anyone under 16.
Name: Hanan Hebibovic (individual operator)
Address: Pater-Rupert-Mayer-Straße 9, 85386 Eching, Germany
Email: [email protected]
Phone: +49 162 6474342
German and EU data protection laws (including GDPR) apply to the processing of your personal information.
Account Information:
Study Content:
AI Tutor Conversations:
Essay Content:
Exam Data:
Grade Data:
Uploaded Files:
Social Information:
Learning Memory Data (Student Plus and Unlimited tiers):
WebUntis / Timetable Data (Student tier and above):
Calendar Data:
Payment Information:
We do NOT store credit card numbers, bank details, or full payment credentials. Payments are processed by Apple (iOS) or Stripe (Android/Web).
Preferences and Settings:
Usage Data (with your consent):
Crash Reports (with your consent):
Technical Data:
Offline and Sync Data:
| Purpose | Data Used | Legal Basis (GDPR) |
|---|---|---|
| Provide the Service (account, study, AI features) | Account, study content, conversations, essays, exams, grades | Contract performance (Art. 6(1)(b)) |
| Process payments and manage subscriptions | Payment data, subscription status | Contract performance (Art. 6(1)(b)) |
| Enforce quotas and rate limits | Usage counts, subscription tier | Contract performance (Art. 6(1)(b)) |
| Send push notifications (reminders, achievements) | FCM token, notification preferences | Consent (Art. 6(1)(a)) |
| Improve the Service (analytics) | Usage data (anonymized) | Consent (Art. 6(1)(a)) |
| Fix bugs (crash reporting) | Crash data, device info | Consent (Art. 6(1)(a)) |
| Social features (friends, leaderboards) | Profile data, study stats, friend connections | Consent / Legitimate interest (Art. 6(1)(f)) |
| Gamification (achievements, streaks, XP) | Study activity data | Contract performance (Art. 6(1)(b)) |
| Build learning memory profile (Sam Remembers) | Tutor conversations, study data, calendar events | Consent (Art. 6(1)(a)) — requires eligible tier |
| Sync school timetable (WebUntis) | WebUntis credentials, timetable data | Consent (Art. 6(1)(a)) — user-initiated connection |
| Provide context-aware AI assistance (Calendar AI) | Calendar events, upcoming exams | Consent (Art. 6(1)(a)) — explicit opt-in toggle |
| Send daily schedule digest notifications | Calendar events, timetable data | Consent (Art. 6(1)(a)) — opt-in preference |
| Prevent abuse and ensure security | Account data, usage patterns, rate limit data | Legitimate interest (Art. 6(1)(f)) |
| Comply with legal obligations | Payment records, account data | Legal obligation (Art. 6(1)(c)) |
| Respond to support requests | Account data, communication content | Contract performance (Art. 6(1)(b)) |
Sam The Wise uses third-party AI services to power its intelligent features:
Anthropic (Claude): Used for:
Data Handling by AI Providers:
When you upload files (images, PDFs, documents) for AI quiz generation:
Do NOT upload:
Apple (iOS): In-App Purchase transactions are processed by Apple. Apple's privacy policy applies to payment data collected by Apple.
Stripe (Android/Web): Subscription payments are processed by Stripe. We receive subscription status and billing period information but NOT your full payment card details. Stripe's privacy policy applies to payment data collected by Stripe.
If you choose to connect your WebUntis account:
We use Firebase for:
Data is primarily stored in EU data centers (Firebase Europe West).
We do NOT sell your personal information.
We share data with the following service providers solely for operating the Service:
When you use social features, certain information is visible to other users based on your privacy settings:
| Data | Public Profile | Friends Only | Private |
|---|---|---|---|
| Username | Yes | Yes | No |
| Profile photo | Yes | Yes | No |
| Bio | Yes | Yes | No |
| Study stats (for leaderboards) | Yes | Yes | No |
| Achievements | Yes | Yes | No |
| Online status | No | Yes | No |
| Friend list | No | Yes | No |
You control your profile visibility in Settings > Privacy or during profile creation.
If you appear on leaderboards, your username, profile photo, and relevant statistics (XP, streak, cards studied, accuracy) are visible to other users who can see the leaderboard.
When you share a deck via link, the recipient can see the deck title, description, card content, and your username as the creator.
When you share a referral link, your referral code is embedded in the link. The referred user's account is linked to yours for referral tracking purposes. No additional personal information is shared.
We may disclose your information if required by law, regulation, legal process, or governmental request, or to protect the rights, safety, or property of our users or the public.
In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will notify you before your data is transferred and becomes subject to a different privacy policy.
We may share anonymized, aggregated data that cannot identify you (e.g., total number of study sessions across all users) for analytics and research purposes.
Sam The Wise stores certain data locally on your device for offline functionality and performance:
Local data remains on your device and is not transmitted to our servers unless sync is required. You can clear local data through Settings > Storage, or by uninstalling the App.
We use Firebase Cloud Messaging (FCM) to deliver push notifications. We store your FCM device token to send notifications.
Types of notifications we may send (each individually controllable):
Your control:
We send transactional emails to the email address associated with your account for contract-related communications. These emails are not marketing and cannot be disabled, as they are necessary for the performance of our contract with you (Art. 6(1)(b) GDPR).
Types of transactional emails:
These emails are sent via Firebase Trigger Email. Your email address is used solely for delivery and is not shared with third-party marketing services.
We request your explicit consent for optional data processing:
Analytics Consent: Anonymous usage data collection to help us understand how the App is used and improve it. Disabled by default.
Crash Reporting Consent: Automatic crash report collection to help us fix bugs faster. Disabled by default.
Calendar AI Consent: Allows Sam to use your calendar events (including WebUntis-synced events) in AI features such as the Tutor and Learning Memory. When enabled, Sam can reference your upcoming exams, classes, and deadlines in conversations. Disabled by default.
You are asked for consent during your first login via our Privacy Preferences dialog. You can change your choices at any time in Settings > Privacy.
Withdrawing consent does not affect the lawfulness of processing performed before withdrawal.
Under GDPR and German data protection law, you have the following rights:
| Right | Description | How to Exercise |
|---|---|---|
| Access | Request a copy of your personal data | Settings > Account > Export Data, or email us |
| Rectification | Correct inaccurate or incomplete data | Edit in-app, or email us |
| Erasure | Delete your account and personal data ("right to be forgotten") | Settings > Account > Delete Account, or email us |
| Data Portability | Export your data in a machine-readable format (JSON) | Settings > Account > Export Data |
| Object | Object to processing based on legitimate interests | Email us |
| Restrict Processing | Limit how we use your data | Email us |
| Withdraw Consent | Revoke consent for analytics or crash reporting | Settings > Privacy |
To exercise your rights:
Complaint Rights: You may lodge a complaint with your local data protection authority. For Bavaria, Germany: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, www.lda.bayern.de.
| Data Type | Retention Period |
|---|---|
| Account information | Until account deletion |
| Study content (decks, questions, cards) | Until account deletion or manual deletion |
| AI Tutor conversations | Until account deletion or manual deletion |
| Essay content and grading results | Until account deletion or manual deletion |
| Exam sessions and reports | Until account deletion or manual deletion |
| Grade data | Until account deletion or manual deletion |
| Uploaded files (images, PDFs) | 30 days (automatic deletion) |
| Learning memory profile (Sam Remembers) | Until account deletion, manual deletion, or disconnection from feature |
| WebUntis credentials | Until you disconnect WebUntis or delete your account |
| WebUntis-synced timetable data | Until you disconnect (with optional deletion) or account deletion |
| Calendar events | Until manual deletion or account deletion |
| Friend connections | Until unfriended or account deletion |
| Achievement and gamification data | Until account deletion |
| Usage analytics | 2 years (anonymized after 90 days) |
| Crash reports | 1 year |
| Payment records | 7 years (German tax law: AO §147) |
| Support communications | 2 years |
| Push notification tokens | Until logout or account deletion |
| Referral data | Until account deletion |
Upon account deletion:
We implement the following measures to protect your data:
No system is 100% secure. You are responsible for keeping your account credentials confidential.
The mobile app does not use browser cookies. We use:
The web version uses:
Sam The Wise is NOT intended for children under 16 years of age. We do not knowingly collect personal information from anyone under 16.
If we discover that a user is under 16, we will immediately:
Parents and Guardians: If you believe your child has created an account, please contact us at [email protected] and we will promptly delete the account and associated data.
Sam The Wise operates from Germany (EU). Your data is primarily stored in EU data centers (Firebase Europe West region).
Data may be transferred outside the EU in the following cases:
| Recipient | Location | Purpose | Safeguard |
|---|---|---|---|
| Anthropic | United States | AI processing (tutor, grading, generation, memory extraction) | EU-US Data Privacy Framework, Standard Contractual Clauses |
| Stripe | United States | Payment processing | EU-US Data Privacy Framework, Standard Contractual Clauses |
| Google/Firebase | EU (primary), US (backup) | Hosting, database, authentication | Standard Contractual Clauses, adequacy decision |
| Apple | United States | In-App Purchase, Sign-in | Standard Contractual Clauses |
All international transfers are protected by appropriate safeguards as required by GDPR.
We may update this Privacy Policy to reflect changes in our practices or legal requirements.
Your continued use of the Service after changes take effect constitutes acceptance of the updated policy. If you disagree with changes, you may delete your account.
For privacy questions, data requests, or concerns:
Email: [email protected]
Subject line: "Privacy Inquiry"
We will respond within 30 days as required by GDPR.