The short version
- We collect what it takes to run your account: your email address, a password hash (or your Google account ID if you sign in with Google), and the rabbitholes you build.
- The topics and questions you type are sent to our AI provider, Anthropic, to write your lessons. Your email address is never sent with them.
- There are no ads, no analytics or tracking SDKs, and we never sell or share your personal information for advertising.
- You can delete your account and everything in it at any time, from the app or by following these steps.
What we collect
Information you give us
- Account details — your email address, and your password stored only as a one-way bcrypt hash. If you sign in with Google, we receive your email address and Google’s stable account identifier from a verified Google sign-in token; we do not receive your Google password, contacts, or anything else.
- What you learn — the topics and questions you enter, the lessons generated for you, and your map: rabbitholes, folders, connections between cards, quiz answers and results, review history, mastery, streaks, experience points and badges.
- Messages to us — if you email support, we keep the conversation so we can help you.
Information created as you use the service
- Daily usage counts — how many lessons and review sessions you have started today, and your device’s time zone, so free limits reset at your local midnight.
- Password reset codes — if you ask to reset your password, we email you a one-time code and keep only a one-way hash of it. It stops working after 15 minutes and is deleted once used.
- Subscription status — whether you have Rabbithole Pro, which plan, and when the current period ends. We never see or store your card or payment details; the app store handles payment.
- Technical data — your IP address is used, in memory only, to rate-limit requests and prevent abuse. Our hosting provider may keep standard server logs (IP address, time, requested path) for a short period for security and operations.
We do not collect your location, contacts, photos, advertising ID, or precise device identifiers.
How we use it
| Purpose | Information | Legal basis (EEA/UK) |
|---|---|---|
| Create and secure your account; sync your map across devices | Account details, your map | Performing our contract with you |
| Generate lessons, links, quizzes, sub-maps and video picks | Topics, questions, lesson text | Performing our contract with you |
| Apply free limits and unlock Pro | Usage counts, time zone, subscription status | Performing our contract with you |
| Prevent abuse, fraud and overload | IP address, request logs | Our legitimate interest in a safe, working service |
| Answer support requests | Your messages, account email | Performing our contract; legitimate interest |
| Meet legal obligations | Records we are required to keep | Legal obligation |
We do not use your information for advertising, we do not build advertising profiles, and we do not use your content to train AI models.
Who we share it with
We share information only with service providers that help us run Rabbithole, only what each one needs, and under contracts that limit their use of it to providing their service to us:
| Provider | What they receive | Why |
|---|---|---|
| Anthropic (Claude API) | Topics and questions you type, titles and summaries of your cards, folder names. Not your email or account details. | Writing lessons, linking related cards, building quizzes and sub-maps, picking videos |
| Google — YouTube Data API | A card’s title and difficulty, as a search query | Finding videos for a card |
| Google — Sign-In | Handled by Google; we receive your email and account ID | Signing in with Google, if you choose it |
| Resend | Your email address and a one-time code, only when you ask to reset your password | Sending password-reset emails |
| Google Play / Apple App Store | Your purchase, under your store account | Processing Pro subscriptions |
| RevenueCat | A random internal account ID (not your email) and your store purchase receipts | Verifying subscriptions and telling our server who has Pro |
| Railway | Everything we store, as our host | Running our servers and database in the United States |
Anthropic processes API requests under its commercial terms, which do not allow it to train its models on them by default. We may also disclose information if the law requires it, to protect the rights and safety of our users or the public, or as part of a merger or sale of the business — in which case this policy continues to apply to your information.
We do not sell your personal information, and we do not “share” it for cross-context behavioral advertising, as those terms are defined under California law.
YouTube API Services
Rabbithole uses YouTube API Services to suggest videos for your cards. By using the video features you agree to be bound by the YouTube Terms of Service, and Google’s handling of that data is covered by the Google Privacy Policy. We store the ID and title of suggested videos with your card. When you open a video, it plays in the YouTube app or website, where YouTube’s own terms and privacy policy apply.
On your device
The app keeps a local copy of your map so it opens instantly and keeps working through a bad connection, stores your sign-in token in the device’s secure storage (Android Keystore or iOS Keychain), and remembers small preferences such as light or dark mode. Signing out clears the local copy of your map; uninstalling the app removes all of it.
How long we keep it
- Your account and map — until you delete your account. Deletion removes them from our live database immediately.
- Daily usage counts — about 60 days, then deleted automatically.
- Subscription status — while you have an account. Your store keeps its own purchase records under its own policy.
- Server logs and backups — where they exist, they expire on their own within 30 days.
- Password reset codes — deleted as soon as they are used, and cleared out after they expire.
- Support emails — as long as needed to help you, and no longer than two years.
Your rights
Wherever you live, you can ask us to:
- tell you what information we hold about you and give you a copy;
- correct information that is wrong;
- delete your account and data — you can also do this yourself, in the app under More → Account → Delete account;
- export your map in a machine-readable format (JSON).
EEA, UK and Switzerland. You also have the right to object to or restrict our processing, and to complain to your local data protection authority. Where we rely on legitimate interests, you can object at any time.
California. You have the right to know, delete and correct your personal information, and to not be discriminated against for exercising these rights. We do not sell or share personal information, so there is nothing to opt out of.
To make a request, email info@thegoodmanagers.com from the address on your account. We will respond within 30 days. We may need to confirm the request came from you before acting on it.
Security
Traffic between the app and our servers is encrypted with TLS. Passwords are stored only as bcrypt hashes, sign-in tokens are signed and expire, and access to production systems is limited to the people who run Rabbithole. No system is perfectly secure; if we learn of a breach that affects you, we will tell you as the law requires.
International transfers
Linked Corners is based in the United States and our servers are there. If you use Rabbithole from elsewhere, your information is transferred to and processed in the United States and in the countries where our providers operate. Where the law requires it, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.
Children
Rabbithole is not directed to children under 13, and you must be at least 13 — or the minimum age of digital consent in your country, if higher — to create an account. If you believe a child has given us personal information, contact us and we will delete it.
Changes to this policy
If we change this policy, we will update the date at the top. If a change is significant, we will also tell you in the app or by email before it takes effect.
Contact
Linked Corners, a Delaware company
Email: info@thegoodmanagers.com