Legal

Privacy Policy

Last updated: 15 October 2026 · Deutsche Fassung

This policy explains how personal data is processed when you visit roadmind.app (the website) and when you use the RoadMind app on the web (app.roadmind.app), Android or iOS (the app).

1. Controller

2. The website (roadmind.app)

2.1 Hosting

The website is hosted on Microsoft Azure by Microsoft Ireland Operations Ltd. in the “West Europe” region (Netherlands, EU). To deliver a page, the hosting infrastructure necessarily processes your IP address and the technical details of your request. Our own application logs record the requested page, the response status and timing, and the referring website’s host name; they do not record IP addresses and are deleted after 30 days. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in delivering and securing the website).

2.2 Anonymous usage measurement

To understand whether the website is useful, we measure page views, clicks on buttons such as “Request early access”, how far a page was scrolled, the host name of the website that linked to us (for example google.com, never the full address), campaign parameters in the link (utm_source, utm_medium, utm_campaign) and whether the screen is mobile-sized.

• We use no cookies and store nothing on your device (no local storage, no session storage, no fingerprinting). Each page view gets a random identifier that exists only in that page’s memory, so separate visits cannot be linked to each other or to you.
• The measurement runs on our own server. No third-party analytics service is involved.
• Your IP address is held in our server’s memory for at most one minute to block abuse (rate limiting) and is never written to storage.
• If your browser sends a Global Privacy Control or Do Not Track signal, nothing is measured at all.

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in improving the website).

2.3 Fonts and third parties

The website uses the fonts already installed on your device and loads no content from third-party servers. It contains no advertising and no social media plug-ins.

2.4 Contacting us

If you e-mail us, for example to request early access, we process your e-mail address and message to answer you (Art. 6(1)(b) GDPR) and delete them once they are no longer needed, unless a statutory retention period applies.

3. The RoadMind app

3.1 Your account

To use the app you sign in with your e-mail address and an invitation code (or, where offered, with your Google account, in which case we receive your name, e-mail address and Google account identifier from Google). We store your e-mail address, name if provided, and the dates you created your account and last used it. Legal basis: Art. 6(1)(b) GDPR (performance of the contract).

3.2 Your learning data

The app stores what you create in it: your conversations with the tutor, your learning path and the concepts on it, review cards and your review history, items you saved for later, and your settings. This data is kept on your device and, so that it is available on all your devices, on our servers in the EU (Microsoft Azure, “West Europe” region, Netherlands). Legal basis: Art. 6(1)(b) GDPR.

3.3 AI processing by OpenAI

To generate answers, explanations, quick definitions and review cards, the text of your message, the relevant earlier messages of the conversation and the current topic are sent from our server to OpenAI (OpenAI Ireland Ltd. / OpenAI, L.L.C.), which processes them on our behalf as a processor under a data processing agreement. Your e-mail address and name are not sent. Processing may take place in the United States; the transfer is based on the EU Standard Contractual Clauses contained in OpenAI’s data processing agreement. According to OpenAI’s terms for API customers, data sent through the API is not used to train OpenAI’s models and is retained by OpenAI for up to 30 days for abuse monitoring. Legal basis: Art. 6(1)(b) GDPR.

Please do not enter sensitive personal data (for example health information) into conversations.

3.4 Product analytics and usage limits

To understand how the app is used and to keep it reliable, we record coarse usage events linked to your account, for example that a question was sent, a concept was added to your path or a review session was completed, together with the platform (web, Android or iOS). These events never contain the content of your messages, answers or cards. For each AI request we also record the model used, the number of tokens, the response time, whether it succeeded and its estimated cost, which we also use to enforce usage limits. No third-party analytics or advertising services are used. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in operating, securing and improving the service).

3.5 Storage on your device

The app stores your sign-in token and a local copy of your learning data on your device. This is strictly necessary to provide the service you requested (§ 25(2) no. 2 TDDDG).

3.6 App stores and updates

If you install the app from Google Play or Apple’s App Store / TestFlight, those providers process data under their own privacy policies. On Android, the app asks Google Play whether an update is available so it can update itself.

4. Recipients

• Microsoft Ireland Operations Ltd. (hosting, database) — EU
• OpenAI (generation of AI responses) — see section 3.3
• Google LLC, only if you sign in with Google or use Google Play
• Apple Inc., only if you use the iOS app

We do not sell personal data and do not use it for advertising.

5. How long we keep data

• Account and learning data: until you delete your account. On request we delete your account and all learning data linked to it within 30 days.
• Usage events and AI request records: as long as your account exists; anonymous website measurements: up to 24 months.
• Application logs: 30 days.

6. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). To exercise them, including to delete your account, write to info@pragpath.com.

You also have the right to lodge a complaint with a supervisory authority, for example the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).

7. Children

RoadMind is not directed at children under 16, and we do not knowingly process their data.

8. Changes

We will update this policy when the service changes. The current version is always available at roadmind.app/privacy.