Mastery, an app by Ombun Xavier Mboma. Effective 2026-10-01.
This is the whole policy. It is short because the app collects little, and specific because a policy you cannot check against the app is not worth reading.
| Data | What it is and why | Used for |
|---|---|---|
| Email Address Contact Info |
Your email address, if Sign in with Apple gives us one. If you chose to hide it, what we get is Apple’s relay address and we never see your real one. It is used to reach you about your account and nothing else — there is no mailing list. | App Functionality |
| User ID Identifiers |
An account identifier, and the identifier Apple issues for you when you sign in. Apple’s is specific to this app: it cannot be used to recognise you anywhere else. | App Functionality, Analytics |
| Other User Content User Content |
What you write and what the app writes for you: the topics and goals you enter, the decks and cards generated from them, your study plan, and your habits. This is the app — without it there is nothing to study. | App Functionality, Product Personalization |
| Product Interaction Usage Data |
Two different things under one heading, because Apple has one heading for both. First: which cards you answered, when, how you rated them, and how long you took — spaced repetition is a schedule computed from exactly this, so it is the feature, and it stays on our servers. Second: a much smaller record of how the app itself is used — that a session finished, that a deck was created — which goes to PostHog so we can tell which parts work. That second one is counts and categories only, never your cards, topics, goals or answers, and you can turn it off in Settings. | App Functionality, Analytics |
| Other Data Types Other Data |
Your onboarding answers — age range, the reasons you gave, how much time you want to commit — and your timezone and app language. The timezone is what makes “due today” mean your today, and the language is the one your reminders are written in. The rest changes the wording and pacing of what is generated for you. | App Functionality, Product Personalization |
| Customer Support User Content |
What you send when you report something the app generated: the text you reported, why you reported it, and anything you chose to add. Apple’s label calls this Customer Support, and it is separate from the rest of your content because it is a message to us rather than something you are studying. It is deleted with your account. | App Functionality |
| Device ID Identifiers |
A session record per signed-in device, so you can sign out of one without signing out of the others, and so a stolen token can be recognised and revoked. If you turn on reminders, the notification token for that device is stored too — it can only be used to send notifications to this app, and it is deleted with your account. If you connect ChatGPT, that connection is kept the same way: which app, what it may do, when it was last used, and one-way digests of its keys rather than the keys. Disconnecting deletes it. | App Functionality |
| Product Interaction Usage Data |
Your reminder preferences — when to send, when not to, and how often at most — and a short record of the reminders that were sent, which is what enforces the daily cap. The record is deleted after a month. | App Functionality |
| Purchase History Purchases |
Whether you have a subscription, which one, and when it runs out — as Apple reports it in a signed receipt, passed on by RevenueCat, who run subscriptions for us. We never see your card, your billing address or what you paid; Apple handles all of that and tells us only whether your subscription is active. | App Functionality, Analytics |
| Other Diagnostic Data Diagnostics |
A record of each AI request: which feature asked, how many tokens it cost, whether it failed. It is what enforces the daily limits and what tells us the bill is not a bug. It stores no prompt text and no answer text. Reading a link you paste is counted the same way, and the count is all that is kept — not the address. | App Functionality |
All of it is linked to your account. None of it is used to track you across other companies’ apps or websites, none of it is sold, and none of it is shared with advertisers or data brokers. There are no third-party analytics or advertising SDKs in the app.
Mastery generates cards, plans and explanations with a large language model run by a third party. When you ask it to generate something, the text needed for that request leaves our server and goes to that provider.
The app asks first. Before the first request that would send anything you wrote, the app shows you who the provider is and what it will be given, and nothing is sent until you agree. You can withdraw that permission at any time in Settings → Privacy; the features that need the model stop working, and everything already in your library keeps working without it.
Generates cards, plans, scenarios and tutor answers (the Claude API).
What it receives: The text needed for that one request — a topic, a goal, a card’s front and back, a typed answer, the notes you left to shape your Explore feed — inside a prompt this server composes. Never audio: a spoken note is turned into text on your phone first.
What it does not receive: Your email address, your account id, your Apple id, your device, or your study history. Requests carry no identifier that ties them to you, and the client cannot send a prompt of its own: it names an operation, and the server writes the prompt.
Their privacy policy: https://www.anthropic.com/legal/privacy
Runs subscriptions — validates the receipt, tracks renewals and refunds, and decides whether a subscription is live.
What it receives: Your account id, and what the App Store tells it about the purchase: which product, when it renews, whether it lapsed. Apple is the one that takes the payment.
What it does not receive: Your email address, your name, your card, your billing address, or anything you study. It is given an opaque id and a transaction, and nothing that would let it work out who you are.
Their privacy policy: https://www.revenuecat.com/privacy
Product analytics — which screens are used, where people stop, whether a feature works.
What it receives: Your account id, and events describing what happened: a session finished, a deck was created, a purchase completed. Counts and categories only.
What it does not receive: Your email address, your decks, your cards, your topics, your goals, your answers, or anything else you typed. No advertising identifier, no screen recording, and nothing joined with data from other companies. You can turn it off in Settings.
Their privacy policy: https://posthog.com/privacy
Decides which subscription screen to show, so pricing and wording can be tested without a new app release.
What it receives: Your account id, whether you currently subscribe, and which screen you were shown.
What it does not receive: Your email address, anything you study, and any payment detail — purchases are handled by RevenueCat and Apple, not by Superwall.
Their privacy policy: https://superwall.com/privacy
Two things about how this is set up, because they are the difference between a disclosure and a promise:
Do not put secrets in a card. Anything you type into a card, a topic or a goal may be sent to the provider as part of generating an answer, and is stored on our servers until you delete it.
You can use Mastery inside ChatGPT. Nothing is shared with it until you connect it yourself: you start in ChatGPT, get a one-time code from Settings → Connected apps in the app, and type that code on our page. Without the code nobody can connect your account, and the code works once, for ten minutes.
Once connected, ChatGPT can read your decks, your cards and what is due, save new decks it writes for you, and record your answers when you study there. It cannot delete anything, see your email address or change your subscription. What ChatGPT reads from Mastery is handled by OpenAI under OpenAI’s own privacy policy (https://openai.com/policies/privacy-policy), not this one. OpenAI is not a processor of ours: connecting is you sending your data to a service you chose, and it is that service’s policy that covers it there. Decks ChatGPT saves are written by OpenAI’s model, not ours; the app treats them as generated text and you can report them like any other card.
We keep a record of the connection — which app, what it may do, when it was last used, and one-way digests of its keys, never the keys themselves. Disconnect at any time in Settings → Connected apps: ChatGPT loses access on its next request and the record is deleted. Deleting your account does the same.
Before the app is out, you can leave your email address on our website to hear when it launches. We keep the address, the language the page was in, which of two page headlines you saw (we test which one explains the app better), the choices you made in the questions on the way (such as your goal, your interests and how much time you have a day), and when you signed up. Not the sentence you wrote about your future self, and not your date of birth: the first is only shown back to you while you go through the questions, and the second is checked once and never kept. We use the address for one thing: one email when Mastery launches. It is not shared, sold or used for anything else. The legal basis is your consent, given by submitting the form (GDPR Art. 6(1)(a)); you can withdraw it at any time by writing to xaver.mbo@gmail.com, and the address is deleted.
The page sets no cookies and loads nothing from other sites. To show you the same headline each time, it derives the headline from your IP address and browser name with a keyed one-way hash. The hash is not stored. Page views are kept only as a daily count per page and headline, with nothing about who viewed.
Settings → Delete account, inside the app. It is immediate and irreversible: every row belonging to you is deleted, not flagged, not anonymised, not kept in a shadow copy. If you signed in with Apple, we also tell Apple to revoke the sign-in grant.
We keep one record of the deletion itself — a timestamp and a count of rows removed, with no identifier of any kind in it — because being able to show that a deletion happened is the only way the promise above is auditable.
Deleting your account does not cancel a subscription. Apple holds the subscription, not us. Cancel it in Settings → your name → Subscriptions on your device, before or after deleting the account.
You can ask for a copy of your data, ask for it to be corrected, ask for it to be deleted, object to how it is used, or complain to your data protection authority. Email xaver.mbo@gmail.com and you will get an answer within 30 days. Deletion needs no email — the app does it.
The legal bases are: performing the contract you entered when you created an account (the app working at all), our legitimate interest in the service not being abused (rate limiting, fraud prevention), and your consent for the two things you are asked about and can switch off — sending your text to the model provider, and product analytics. Both live in Settings → Privacy, and withdrawing either is one tap and takes effect immediately.
Mastery is not for children. You must be at least 16 to create an account, and the app is not directed at anyone younger. We do not knowingly collect data from anyone under 16; if we learn that we have, the account is deleted. If you believe a child has created an account, email xaver.mbo@gmail.com.
Traffic is HTTPS end to end. Sign-in tokens are held in the iOS Keychain, not in a preferences file. The Apple refresh token we store so that we can revoke your grant on deletion is encrypted at rest. Logs redact credentials at the point they are written rather than after.
If this policy changes in a way that affects what is collected or where it goes, the app will tell you before the change applies. The current version always lives at https://usemastery.app/legal/privacy.
Ombun Xavier Mboma — xaver.mbo@gmail.com