Privacy Policy

penguen.io ("we", "us", or "our") is a flashcard learning application available at https://penguen.io, operated by penguen.io, located at 37 Mayne Road, Bowen Hills QLD 4006, Australia.

We are committed to handling your personal information with care and transparency. This Privacy Policy explains what information we collect, how we use it, who we share it with, and what rights you have.

For privacy-related questions or requests, contact us at: support@penguen.io

A. Information you provide directly

• Name and email address when you create an account
• Flashcard sets, decks, notes, and other content you create and store within the app, which are linked to your account

B. Information collected automatically

• IP address
• Browser type and version, operating system, and device type
• Pages visited, features used, session duration, and in-app actions
• Referring URLs
• Cookie identifiers and advertising identifiers (see Section 5)

C. Payment information

Payments are processed by Lemon Squeezy (Lemon Squeezy, LLC). Lemon Squeezy acts as the merchant of record for purchases made through penguen.io. We do not receive or store your full payment card number, card verification code, or equivalent payment credentials. Lemon Squeezy handles all billing and payment data under their own privacy policy, available at https://www.lemonsqueezy.com/privacy.

D. Sensitive data

We do not intentionally collect sensitive categories of personal data such as health information, biometric data, racial or ethnic origin, religious beliefs, or government identification numbers.

We use your personal information for the following purposes:

• To create and manage your account
• To authenticate you and keep your account secure
• To store and sync your flashcard content linked to your account
• To process payments through Lemon Squeezy
• To send you account-related communications (such as receipts, security alerts, and service notices)
• To analyse how users interact with the app and improve its features and performance, using Google Analytics
• To serve relevant advertising and conduct remarketing campaigns through Google Analytics advertising features
• To detect and prevent fraud, abuse, and security incidents
• To comply with applicable legal obligations

If you are in the European Economic Area (EEA) or the United Kingdom, we process your personal data on the following lawful bases:

• Performance of a contract: to provide the app, manage your account, and process payments.
• Legitimate interests: for security monitoring, fraud prevention, and product improvement, where our interests are not overridden by your rights.
• Consent: for non-essential cookies, advertising, and remarketing via Google Analytics. You may withdraw consent at any time through our cookie settings.
• Legal obligation: where we are required to process data to comply with a legal or regulatory requirement.

We use cookies and similar tracking technologies on penguen.io.

A. Types of cookies we use

Strictly necessary cookies

These are essential for the app to function, including session management and authentication. They cannot be disabled without breaking the service.

Analytics and advertising cookies (Google Analytics)

We use Google Analytics, including its advertising features. These features include:

• Usage analytics (pages visited, session duration, feature usage)
• Remarketing and retargeting (showing ads to past visitors on other platforms)
• Demographic and interest reporting
• Google Signals (if you are signed into a Google account with ad personalisation enabled)

These cookies collect information about your browsing behaviour and may be used to build a profile of your interests and show you relevant advertising across the web.

B. Your cookie choices

You have the right to accept or decline non-essential cookies. You can:

• Manage your preferences through our cookie consent banner when you first visit the site
• Use the Google Analytics Opt-out Browser Add-on
• Adjust your Google account's ad personalisation settings
• Configure your browser to block or delete cookies

Declining advertising cookies will not affect your ability to use the app.

C. Google Analytics and data transfers

Google processes analytics data on servers that may be located outside your country, including in the United States. This data is transferred under Standard Contractual Clauses approved by the European Commission. Google's privacy policy is available at https://policies.google.com/privacy.

We do not sell your personal information.

We share your information only in the following circumstances:

A. Service providers

We share data with third-party companies that help us operate the app. They are permitted to use your data only to perform services on our behalf:

• Lemon Squeezy (Lemon Squeezy, LLC) — payment processing and merchant of record
• Google LLC — analytics, advertising, and remarketing via Google Analytics
• Cloudflare, Inc. — cloud infrastructure, hosting, and content delivery

B. Advertising and remarketing

Because we use Google Analytics advertising features, information about your use of penguen.io (including your IP address and behaviour on the site) may be shared with Google for the purpose of serving you advertisements on third-party platforms and measuring their effectiveness. If you are a California resident, see Section 10 for your right to opt out of this sharing.

C. Legal and regulatory disclosures

We may disclose personal information where required or permitted by law, including in response to a court order, subpoena, or regulatory investigation, or to protect the rights, property, or safety of penguen.io, our users, or others.

D. Business transfers

If penguen.io is involved in a merger, acquisition, or asset sale, your personal information may be transferred as part of that transaction. We will provide notice before such a transfer where required by law.

penguen.io features leaderboards that display certain user activity to all registered users of the app. If you participate in practice sessions, the following information may be visible to other users through the leaderboard:

• Display name: the name associated with your account
• Profile picture: your avatar or profile image, if set
• Practice scores: your quiz and session scores
• Streaks: your current and best practice streaks
• Ranking position: your position relative to other users

This data is displayed to foster a sense of community and healthy competition among learners. Your email address is never shown on the leaderboard.

If you do not wish your information to appear on the leaderboard, you may contact us at support@penguen.io to request removal.

penguen.io is based in Australia. If you access the app from the EEA, UK, or another jurisdiction with data transfer restrictions, your personal data may be transferred to and processed in Australia and other countries, including the United States (via Google and Lemon Squeezy).

Where such transfers occur, we rely on:

• Adequacy decisions where applicable
• Standard Contractual Clauses (SCCs) approved by the European Commission
• The UK International Data Transfer Agreement (IDTA) or UK addendum to EU SCCs for transfers subject to UK GDPR
• Other recognised safeguards under applicable law

You may request further information about our transfer mechanisms by contacting us at support@penguen.io.

We retain your personal information for as long as your account is active and for a reasonable period after closure to comply with legal obligations and resolve disputes.

Indicative retention periods:

• Account information (name, email): for the life of the account, plus up to 2 years after closure
• Flashcard content: deleted when you delete your account or the specific content
• Payment records: up to 7 years, as required for tax and financial compliance
• IP addresses and server logs: up to 90 days
• Analytics data: as configured in Google Analytics (default 14 months)
• Support communications: up to 3 years from last contact

When data is no longer required, we delete or anonymise it securely.

A. General rights (all users)

Wherever you are located, you may:

• Request access to the personal information we hold about you
• Request correction of inaccurate or incomplete information
• Request deletion of your personal information (subject to legal retention obligations)
• Withdraw consent for processing based on consent (including advertising cookies)
• Object to certain processing activities

To exercise these rights, email us at support@penguen.io. We will respond within 30 days (or the period required by applicable law). We may ask you to verify your identity before processing your request.

B. EEA and UK users (GDPR / UK GDPR)

In addition to the rights above, you have the right to:

• Data portability: receive your data in a structured, machine-readable format
• Object to automated decision-making that produces significant legal effects
• Lodge a complaint with your local supervisory authority

Relevant authorities:

• EEA: your national data protection authority — see https://edpb.europa.eu
• UK: the Information Commissioner's Office (ICO) — https://ico.org.uk

C. California residents (CCPA / CPRA)

If you are a California resident, you have the right to:

• Know what personal information we have collected about you and how it is used and shared
• Delete your personal information, subject to certain exceptions
• Correct inaccurate personal information
• Opt out of the sale or sharing of your personal information for cross-context behavioural advertising

Important notice for California residents: We share personal information (including identifiers and browsing behaviour) with Google through Google Analytics advertising features for the purpose of remarketing and targeted advertising. This may constitute "sharing" personal information under California law. To opt out, you may:

• Use the cookie consent settings on our website
• Install the Google Analytics Opt-out Add-on
• Adjust Google's ad personalisation settings
• Submit a request to us at support@penguen.io

We will not discriminate against you for exercising your California privacy rights.

D. Australian users (Privacy Act 1988 / Australian Privacy Principles)

We handle your personal information in accordance with the Australian Privacy Principles. You have the right to access and request correction of the personal information we hold about you. If you are not satisfied with our response to a complaint, you may contact the Office of the Australian Information Commissioner (OAIC) at https://www.oaic.gov.au.

E. Canadian users (PIPEDA)

We handle personal information in Canada in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA). You may access, correct, or withdraw consent for certain uses of your personal information by contacting us. Complaints may be directed to the Office of the Privacy Commissioner of Canada at https://www.priv.gc.ca.

penguen.io is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us at support@penguen.io and we will take steps to delete it promptly.

Users under 18 may use the app, but we encourage parents and guardians to supervise their children's use of online services.

We implement reasonable technical and organisational measures to protect your personal information against unauthorised access, loss, alteration, or disclosure. However, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security and encourage you to use a strong, unique password for your account.

In the event of a data breach likely to result in a risk to your rights, we will notify the relevant supervisory authority and, where required, affected users within the timeframes required by applicable law.

The app may contain links to third-party websites or services not operated by us. This Privacy Policy does not apply to those services. We have no control over their content or data practices and encourage you to read their privacy policies.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by posting a prominent notice on penguen.io, and we will update the "Last Updated" date at the top of this policy. We encourage you to review this policy periodically.

For any questions, concerns, or privacy rights requests:

• Email: support@penguen.io
• Post: penguen.io, 37 Mayne Road, Bowen Hills QLD 4006, Australia

We aim to respond to all requests within 30 days.