Privacy Policy
Last updated: August 20, 2026
This policy explains what information the Comy mobile app (“Comy”, “the app”) collects, why we collect it, who we share it with, and the choices you have. Comy is operated by Acodear (“we”, “us”). By creating an account and using Comy, you agree to this policy.
- Who this applies to
- Information we collect
- What we do not collect
- How we use your information
- Legal bases (GDPR)
- Sign-in providers
- Who we share with
- How long we keep it
- Deleting your account
- Your rights and choices
- Security
- International transfers
- Children
- Changes to this policy
- Contact and governing law
1. Who this applies to
This policy covers the Comy mobile app (Android package com.acodear.comy), its web
build, and the Comy backend API that serves them. It applies to everyone who creates a Comy
account.
Comy is intended for people aged 13 and older. In parts of the European Economic Area and the United Kingdom the minimum age for consent to online services is higher (up to 16, depending on the country); where that applies, you must be at least that age, or have your parent or guardian’s consent, to use Comy. See section 13.
2. Information we collect
We collect only what we need to run your learning account. There are four kinds:
2.1 Information you give us
| What | Why |
|---|---|
| Email address | To identify your account, sign you in, and contact you about your account |
| Password — if you sign up with email (stored only as a salted hash, never in plain text) | To secure your account |
| Name / display name | To personalize the app and address you in it |
| Profile picture (a URL, if one comes from your sign-in provider) | To show an avatar on your profile |
| Language preference (English or Spanish) and daily-goal setting | To show the app in your language and pace your daily target |
2.2 Information created by using Comy
| What | Why |
|---|---|
| Lesson progress: which lessons you have unlocked or completed, your best score per lesson, and crown level | To save your place and unlock the next lesson |
| Exercise answers: for each exercise you answer, whether it was correct and when you answered it | To grade you, to power the learning path, and to improve the exercises |
| Game state: XP total, hearts remaining, current and longest streak, streak freezes, league tier, and XP earned per day | To operate the game mechanics and your daily goal |
2.3 Information collected automatically
| What | Why |
|---|---|
| IP address and device/browser user-agent string, recorded against each sign-in session | To keep your session secure, detect suspicious sign-ins, and prevent abuse |
| Session records: a session token, when the session was created, and when it expires | To keep you signed in and let you (and us) end a session |
| Server request and error logs generated when the app talks to our servers (request path, timestamp, status, error details) | To keep the service working, secure, and debuggable |
We do not use your IP address to determine your precise location, and we do not build an advertising or tracking profile from it. Note that an IP address can indicate an approximate region; we treat it as personal data and protect it accordingly.
2.4 Information stored on your device
Comy stores your sign-in token and your language preference locally on your device — in the operating system’s secure storage (Keychain on iOS, Keystore-backed storage on Android) on mobile, or in browser local storage on the web build. This data stays on your device, is not a third-party tracking cookie, and is removed when you sign out or uninstall the app.
3. What we do not collect
Comy does not collect: your precise or background location, contacts, calendar, photos, videos, microphone or camera input, SMS or messages, files, browsing history outside the app, health data, or financial or payment information. Comy has no in-app purchases.
Comy does not: show advertising, use any third-party advertising, analytics, attribution, or tracking SDK, collect an advertising ID, send your data to an AI/machine-learning provider, or sell or rent your personal information to anyone. We do not track you across other apps or websites.
4. How we use your information
- Create, secure, and operate your account, and keep you signed in
- Save your progress and run XP, hearts, streaks, leagues, and daily goals
- Grade your exercise answers and decide what you see next in the learning path
- Show the app in your chosen language
- Detect, investigate, and prevent abuse, fraud, and security incidents
- Diagnose problems and improve the lessons and the learning experience
- Respond to your support, privacy, or deletion requests
- Comply with legal obligations
We do not use your information for automated decision-making that produces legal or similarly significant effects about you. Grading an exercise is automated, but it only affects your progress inside the app.
5. Legal bases (GDPR)
Where the EU or UK GDPR applies, we rely on these legal bases:
| Purpose | Legal basis |
|---|---|
| Providing your account, saving progress, running the learning features | Performance of a contract (Art. 6(1)(b)) |
| Keeping sessions and the service secure, preventing abuse (including the IP address and user-agent recorded per session) | Legitimate interests (Art. 6(1)(f)) — our interest in a secure service, balanced against your rights |
| Improving lessons and fixing bugs | Legitimate interests (Art. 6(1)(f)) |
| Meeting legal obligations | Legal obligation (Art. 6(1)(c)) |
| Anything else we ask you about | Consent (Art. 6(1)(a)), which you may withdraw at any time |
6. Sign-in providers
You can create your Comy account in one of these ways:
- Email and password — we store your email address and a salted hash of your password. We never store your password in a readable form.
- Google — if you choose “Continue with Google”, Google asks you to approve the sign-in and then sends us your Google account identifier, your email address, your name, and your profile picture URL. We also store the access, refresh, and identity tokens Google issues so we can keep you signed in. We do not receive your Google password, and we do not get access to your Gmail, Drive, contacts, or any other Google data. Google’s own handling of the sign-in is governed by the Google Privacy Policy.
Other providers may appear in the app marked “soon”; those are not active and send us nothing. If we enable one, we will update this policy first.
7. Who we share with
We do not sell, rent, or trade your personal information, and we do not share it with advertisers or data brokers. We share it only in these limited cases:
| Who | What they get | Why |
|---|---|---|
| Amazon Web Services (AWS) | Hosts the servers and database that hold your account and learning data | Infrastructure. AWS processes the data only to provide hosting to us, under its own security and confidentiality obligations. |
| Only if you choose Google sign-in — the sign-in exchange described in section 6 | Authentication. We send Google no learning data. |
We may also disclose information if we are legally required to (for example, a valid court order), to enforce our terms, or to protect the rights, safety, and security of our users, the public, or the service. If Comy is ever involved in a merger, acquisition, or sale of assets, we will ensure your information stays protected under this policy and will notify you before it becomes subject to a different one.
8. How long we keep it
| Data | Kept for |
|---|---|
| Account, profile, and learning data (progress, XP, streaks, answers) | As long as your account is active, and until you delete it |
| Session records, including the IP address and user-agent attached to them | Until the session expires or you sign out, and no more than 30 days after that |
| Server request and error logs | A short operational period, normally no more than 90 days |
| Records we must keep by law, or to resolve a dispute or enforce our terms | Only as long as that obligation lasts |
9. Deleting your account
You can delete your Comy account and its data at any time:
- In the app — open Profile and tap Delete account, then confirm.
- From the web — visit the account deletion page.
- By email — write to privacy@acodear.com from the address on your account.
Deleting your account removes your profile, your learning progress and answer history, your game state, and any linked sign-in provider connection, and signs out all of your sessions. We complete deletion within 30 days of the request. Backups are purged on their normal rotation, within 90 days. We keep only what the law requires us to keep, and anonymous, aggregated statistics that cannot be linked back to you.
10. Your rights and choices
Depending on where you live — including under the EU and UK GDPR, the California CCPA/CPRA, and similar laws — you may have the right to:
- Know and access the personal information we hold about you
- Correct inaccurate information
- Delete your account and associated personal data
- Export or port your data in a portable format
- Object to or restrict certain processing, including our legitimate-interests processing
- Withdraw consent where we relied on it, without affecting past processing
- Not be discriminated against for exercising any of these rights
For California residents: in the past 12 months we have not sold or shared personal information as those terms are defined by the CCPA/CPRA, and we do not process personal information for cross-context behavioral advertising. We do not knowingly sell the personal information of anyone under 16.
To exercise any right, email privacy@acodear.com from the address on your account. We respond within 30 days. If you are in the EEA or the UK and you are not satisfied with our response, you may lodge a complaint with your local data protection authority.
11. Security
- All traffic between the app and our servers is encrypted in transit with HTTPS/TLS.
- Passwords are stored only as salted hashes and are never logged or readable by us.
- Your session token is held in your device’s secure storage, not in plain app storage.
- Access to production systems and the database is restricted to the people who operate the service.
No method of transmission or storage is completely secure, but we use industry-standard measures to protect your information. If a breach affects your personal data, we will notify you and the relevant authorities as required by law.
12. International transfers
Our servers are operated on Amazon Web Services infrastructure, and your information may be processed and stored in a country other than your own, including the United States. Where required, we rely on appropriate safeguards for such transfers, such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum.
13. Children
Comy is not directed to children under 13, and we do not knowingly collect personal information from them. Where local law sets a higher minimum age for consenting to online services (up to 16 in parts of the EEA and the UK), Comy is not directed to anyone below that age without parental consent. If you believe a child has given us personal information, contact privacy@acodear.com and we will delete the account and its data promptly.
14. Changes to this policy
We may update this policy from time to time. When we do, we will revise the “Last updated” date above, and for material changes — such as collecting a new category of data or adding a new provider we share with — we will give you a more prominent notice in the app before the change takes effect. Your continued use of Comy after a change means you accept the updated policy.
15. Contact and governing law
Questions or requests about this policy or your data:
Acodear — data controller for Comy
privacy@acodear.com
Your use of Comy is also governed by the Comy Terms of Service.
This policy is governed by the laws of the jurisdiction in which Acodear is established, without regard to its conflict-of-laws rules, and without limiting any mandatory rights you have under the law of your country of residence.