Retestly is a product of Kept Index LLC, a company registered in Wyoming, USA ("Kept Index", "we", "us"). Kept Index decides how the personal data described here is used. Under India's Digital Personal Data Protection Act this makes us the Data Fiduciary; under the Philippines' Data Privacy Act and the EU and UK GDPR, the controller.
Privacy and grievance contact: info@retestly.app. Write to this address for any question, request or complaint about your data.
The mistakes, questions, answers, photos, subjects, exam dates, retest results, notes and AI conversations you create are stored only in the app's private storage on your device. Android's automatic cloud backup is switched off for Retestly, so this data is not copied to your Google account. Use Settings → Back up if you want a copy.
The Study Agent is off until you agree to turn it on. Each time you message it, the app sends what it needs to answer and plan for you: your message, the conversation so far, the language you chose, your country setting and exam, and a summary of your study — subject names, how many mistakes are open, stuck and mastered, why you lost marks, retest dates, days to your exam, accuracy on fresh practice questions, and the short text (first 240 characters) of up to 40 open mistakes.
If you photograph a marked test, that photo is sent so the agent can read your wrong answers. Otherwise it does not send your saved photos, your answers, your notes or your tutor chats.
The agent only suggests actions (adding mistakes, a plan, an exam date, a challenge link). Anything that adds data, changes your schedule or shares something happens only when you tap to approve it. The conversation is saved only on your phone and you can clear it at any time.
The AI tutor is off until you agree to turn it on. When you ask about a mistake, the app sends only that mistake: the question text and, if you choose, a smaller copy of its photo, your answer, the right answer, the subject, why you think you lost the mark, and the conversation so far. The conversation is saved only on your phone.
Study Agent and tutor requests go through the Retestly link server, operated by Kept Index on Cloudflare, to an AI provider that writes the answer — currently Anthropic, or Google. The link server does not store the request or the answer. It keeps only a daily message count linked to a random install number created by the app (not your name, phone number or email) so it can apply fair-use limits.
Each AI provider processes the request under its API terms, which do not allow it to use this data to train its models; a provider may keep it for a limited period for safety and abuse monitoring, as its terms describe.
AI answers can be wrong. Check important answers with your teacher or textbook. Do not put other people's personal information or medical details about real patients into questions.
The daily brief, evening nudge, exam countdown and weekly report are worked out and scheduled on your phone from your own data. Nothing is sent to a server to create them. Turn them off in Settings or in your phone's notification settings.
If you choose to join a coaching-centre or university class with a code, the app sends that class a summary every few hours: the name you chose, counts of open, stuck and mastered mistakes in total and per subject, counts of why marks were lost, your recall rate, retests done in the last 7 days and days to your exam. Question text, answers, photos, notes, your phone number, email and location are never sent.
The class organiser sees the summary on a private dashboard and is responsible for how their institution uses it. Leave the class in Settings → Classes and your summary is deleted. A member who has not opened the app for a year is removed automatically. Teachers who create a class provide only the class and institution name.
Only when you create a challenge link, the link server stores what you chose on that screen: a smaller copy of the question photo, the question text, the answer if you switched it on, the subject and your first name. Anyone with the link can see these. The server counts how many people opened it, tried it and got it right, but records nothing about who they are. The link is deleted after 90 days, when you delete it, or when you delete the mistake.
Only when you send a confirmation link (for example to a teammate for group work or money owed), the link server stores that request: the title, statement, amount, reference, your name and the other person's name, plus their reply, any photos or PDFs they upload, the server time and their country. It is deleted after 30 days, or immediately when you delete the link. The other person's fingerprint, face or PIN never leaves their phone; their phone only reports that the check succeeded.
Like any internet service, our server receives the network (IP) address of the device that contacts it. We use it to stop abuse: short-lived counters limit how many requests one network can make, and reset within an hour. When a challenge link, confirmation link or class is created, the address that created it is kept with it, to investigate abuse, and is deleted with it.
Off unless you switch them on. They contain only the app version, phone platform and the error message, after the app removes names, email addresses, phone and other numbers, web links and file paths. Never your mistakes or photos. Kept for 90 days.
A backup is a file the app creates only when you ask. It contains your data and photos and goes wherever you choose to save it, under that service's terms. If you set a password, the file is encrypted (XChaCha20-Poly1305 with a key derived from your password) and nobody can open it without the password — including us, so we cannot recover a forgotten password. Without a password, anyone with the file can read it.
The camera and photo library are used only when you choose to add a photo. Photos are copied into the app's private storage on your device. Only if you switch on "Stamp camera photos with location", the app reads your location at the moment you take a photo and saves it with that photo on your device.
retestly.app is hosted on Cloudflare. It sets no cookies and uses no analytics or advertising tools. Cloudflare processes standard request data (such as IP address and browser type) to deliver and protect the site. The Android download file is hosted at loopclosed.org on Hostinger, which keeps standard server logs. If you install from Google Play or the App Store, Google or Apple handle that under their own privacy policies.
If you email us, we keep your message and email address to answer you. Our email is routed by Cloudflare and stored in Google's Gmail.
Retestly contains no advertising or tracking software. We do not sell personal data, and we do not share it for targeted or cross-context behavioural advertising.
We use these providers only to run Retestly, under contracts that limit their use of the data: Cloudflare (link server, website, email routing), Anthropic and Google (AI answers; Google also provides our email), and Hostinger (Android download hosting). Their servers may be in the United States or other countries, so your data may be processed outside the country where you live. We rely on those providers' contractual safeguards for such transfers.
Settings → Delete all data removes everything on the phone and asks the link server to delete your links and leave your classes. If the server cannot be reached, the app keeps retrying until it confirms. Uninstalling the app deletes the data on the phone; links still on the server then expire on their normal schedule. You can also email info@retestly.app and we will delete server-side data we can link to you.
Wherever you live, you can ask us to tell you what data we hold about you, correct it, delete it, or stop using it, and you can withdraw consent at any time by switching a feature off. Because Retestly has no accounts, most of your data is under your control on your phone; for data on our server, we may ask for the link or the app's install number so we can find it. We answer within 30 days.
India: under the Digital Personal Data Protection Act, 2023, you have the rights to access a summary of your data, to correction and erasure, to grievance redressal, and to nominate someone to act for you. If you are not satisfied with our response, you may complain to the Data Protection Board of India.
Philippines: under the Data Privacy Act of 2012, you have the rights to be informed, to access, to object, to erasure or blocking, to rectification, to data portability and to damages. You may complain to the National Privacy Commission.
United States: we do not sell or share personal information as those terms are defined in state privacy laws. Residents of states with privacy laws may exercise the rights those laws give them by emailing us, and we will not treat you differently for doing so.
European Economic Area and United Kingdom: we rely on your consent for the Study Agent, AI tutor, classes and crash reports; on what is needed to provide a link you ask us to create; and on our legitimate interest in preventing abuse. You may complain to your local data protection authority.
Retestly is only for people aged 18 and over — college and university students and adult exam candidates. You confirm your age when you start. We do not knowingly collect data from anyone under 18; if we learn that we have, we delete it.
Data sent between the app and our server is encrypted in transit (HTTPS). Links use long random codes, and only a fingerprint (hash) of each code is stored, so the codes cannot be read from our database. Access to our systems is limited to the people who run them. No system is perfectly secure; if a breach affects your data, we will notify you and the authorities as the law requires.
If we change this policy, we will update the date at the top. If a future version adds accounts or cloud sync, or sends more data from your phone, we will ask you before it does.
Kept Index LLC — Retestly. Privacy and grievance contact: info@retestly.app.