QF-Learn Legal

QF-Learn: Quant Finance

Privacy Policy

Effective October 12, 2026 Last updated October 19, 2026

Daniel Tolenaar ("we," "us," or "our"), an individual developer, is the controller responsible for the personal information described in this Privacy Policy, and is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application, QF-Learn (the "App"), and our websites. Please read this Privacy Policy carefully. If you do not agree with the terms of this Privacy Policy, please do not access or use the App.

1. Information We Collect

We may collect information about you in a variety of ways. The information we may collect via the App includes:

a. Personal Data:

  • Account Information (Google): When you sign in using Google Sign-In, we receive information associated with your Google account, such as your name, email address, and profile picture URL, as permitted by Google's policies and your Google privacy settings. We store your basic profile information (like name, email, photo URL, Google User ID) in our systems (Firebase Authentication and Firestore) to manage your account.
  • Account Information (Apple): When you use Sign in with Apple, we receive the name and email address you choose to share. If you use Apple's "Hide My Email" feature, we receive a private relay address instead of your real one, and we store and use that relay address in the same way. We store this basic profile information in Firebase Authentication and Firestore to manage your account. If you delete your account, we also revoke the Apple sign-in token associated with it.
  • Guest Accounts: If you continue as a guest, we create an anonymous account that is not linked to a Google or Apple identity. We store the name you enter (the App asks for your full name, which is shown on your certificates) along with an anonymous user ID. We do not receive your email address for guest accounts, which means we generally cannot identify you, restore your data, or transfer it to another device.
  • Certificate Name: If you choose to edit the name displayed on your certificates within the App settings, we store this preferred name associated with your user ID.
  • New-Account Alert: When you create an account, we receive a notification over Telegram with the account's email address (guest accounts have none) and how you signed in, and we keep a marker that the alert was sent.
  • Certificates: We keep a record of each certificate you earn: the name printed on it, the course, your quiz score, the issue date, and a link to the certificate file. Other signed-in users of the App who know a certificate's ID can read this record. The ID is printed on the certificate and shown on LinkedIn if you add the certificate there, and it includes your account's user ID.
  • Feedback Information: If you choose to provide feedback through the App, we collect your name, email address (from your account), the content of your feedback, feedback type, rating, and associated metadata like timestamp and platform.

b. Usage Data:

  • Course Progress: We track your progress through courses, including completed modules and sections, to sync your learning across devices and provide features like "Continue Learning." This is stored associated with your user ID.
  • Quiz Results: We store your quiz scores, pass/fail status, and potentially your answers for completed quizzes, associated with your user ID, to determine course completion, enable certificate generation, and allow you to review results.
  • Game Scores and Leaderboards: Your scores from the in-app simulation games are kept on your device. If you take part in leaderboards, the score you submit and your chosen display name are stored on our servers, and your display name, score, and rank are visible to other signed-in users of the App. Choose a display name accordingly. You can change it the next time you submit a score, or email us and we will change or remove it.
  • Learning Streaks: Your learning streak is calculated and kept on your device (and in the home screen widget); it is not sent to our servers.
  • App Interaction Data (Usage Analytics): The App records how it is used, such as which screens you open and which buttons you tap, so that we can see which parts of it work and which to improve. These records are not linked to your account. Section 5B explains what is recorded, who processes it, and how to turn it off.
  • Reminder Timing: Reminder notifications are timed using the time you last signed in, which is stored with your account and deleted with it.
  • Settings and Achievements: Your App settings (such as notification, sound, and narration preferences) and the badges you earn are stored with your account.
  • Last Login/Activity: We store timestamps for your last login and potentially last activity within the app to manage your session and potentially tailor notifications.

c. Purchase Information:

  • Pro Status: If you purchase the Pro upgrade, the purchase is processed by the respective app store (Google Play Store or Apple App Store). We do not collect or store your payment card details. When you buy Pro on Google Play, we verify the purchase with Google, sending it your purchase token and an identifier for your account, and we store your Pro status, the purchase token, the order ID, the billing country and purchase type Google reports (for example, whether Pro came from a promo code), and the date we verified it, associated with your user ID in Firestore. We also keep a separate purchase record (your user ID, the product, the store transaction identifier, and the date) to substantiate your entitlement and to meet tax and accounting obligations; it is not removed by the in-app deletion flow.

d. Device and Technical Information:

  • Crash Reports: Firebase Crashlytics collects crash logs with technical details such as device model, operating system version, and app version. They are not linked to your account.
  • Error Reports: When the App hits an error, it sends a report to Sentinel, our own error-reporting service: the error message (with email addresses and account identifiers removed), a stack trace, the app version, and the platform. Reports that cannot be sent straight away are kept on your device until they can be. We are alerted to new errors over Telegram.
  • App Integrity: Firebase App Check uses Google Play Integrity to confirm that requests to our servers come from a genuine copy of the App.
  • Push Notification Token: If you allow notifications, the token your device uses to receive push notifications is stored with your account, together with your device platform and which of our apps it belongs to.

1A. Information We Collect Through Our Websites

Our marketing websites and this legal information site are separate from the App, and you can read them without an account. If you sign up for email updates on one of them, we collect and store:

  • Your email address.
  • The language you were reading in, so we can write to you in it.
  • Which page you signed up from, so we know which site the interest came from.
  • Whether you asked to join testing, if you signed up while our sites offered that option.
  • A salted hash of your IP address. We store the hash, not the address itself, and we use it only to rate-limit signups and block abuse.

That information is stored with Supabase, sent to us as a notification over Telegram, and copied into Resend, which sends our emails. Those emails record, through Resend, whether you open them and which of their links you click, so we can tell which emails are worth sending; the signup form says so. If you asked to join testing, we also add your email address to the tester list in Google Play Console so that Google can send you the invitation.

Our websites are hosted on Vercel and use Vercel Web Analytics, which counts page views without cookies. If you pick a language on the QF-Learn or M-Learn site, it is remembered in a cookie for a year; those sites may also suggest a language based on your browser's settings or the country your connection comes from, without setting a cookie. The Q-Learn site may suggest a language based on your browser's settings or time zone, and keeps a language you pick in your browser's local storage. All of our websites serve their own fonts, so no font is fetched from Google or anyone else. If a page on our websites hits an error, it may send a report to Sentinel with the page address, your browser type, and the error.

A website subscription is separate from your app account. Deleting your account in the App does not remove you from the mailing list, and unsubscribing from the mailing list does not affect your account. To be removed from the list, use the unsubscribe option in any email we send you, or email us at axislearningsup@gmail.com.

2. How We Use Your Information

Having accurate information permits us to provide you with a smooth, efficient, and customized experience. Specifically, we may use information collected about you via the App to:

  • Create and manage your account.
  • Provide and deliver the educational content and features of the App.
  • Track your learning progress and quiz results.
  • Generate and manage certificates of achievement.
  • Process your Pro upgrade purchase and unlock premium features.
  • Send you notifications (e.g., learning reminders, milestone achievements), if enabled in settings.
  • Respond to your feedback and support requests.
  • Monitor and analyze usage and trends to improve the App and user experience.
  • Diagnose and fix technical problems.
  • Ensure the security and integrity of our App.
  • Comply with legal obligations.

If you are in the United Kingdom or the European Economic Area, data protection law requires a legal basis for each way we use your personal information. These are ours:

  • Providing the App you chose to use (your account, settings, progress, quiz results, certificates, any leaderboard you join, and Pro): necessary to perform our contract with you, the Terms of Service.
  • Keeping records of purchases: necessary to comply with tax and accounting law.
  • Reminder and push notifications: your consent, which you give by allowing notifications and can withdraw at any time by turning them off.
  • Email updates you signed up for on one of our websites, including recording whether you open them and which links you click: your consent, given when you sign up, which you can withdraw at any time by unsubscribing.
  • Showing ads in the free version of the App: our legitimate interest in funding the free version. AdMob decides for itself how it uses the data it collects, as an independent controller (see Section 5A).
  • Fixing errors, keeping the Services secure, preventing cheating and abuse, answering feedback, and being notified of new accounts, feedback, purchases, signups, and errors: our legitimate interests in running a reliable, fair service and improving it. You can object to this; see Section 5.
  • Usage analytics in the App (Section 5B): in the European Economic Area, your consent, which the App asks for before recording anything and which you can withdraw at any time in its Settings; elsewhere, including the United Kingdom, our legitimate interest in learning which parts of the App work and which to improve, using records that are not linked to your account. You can object at any time by turning off "Share usage data" in the App's Settings.
  • Measuring how our websites are used: our legitimate interest in knowing which pages are read, using counts that do not identify you.

3. Disclosure of Your Information

We are committed to protecting your personal information and do not sell it to third parties. We may share information we have collected about you in certain situations:

a. By Law or to Protect Rights: If we believe the release of information about you is necessary to respond to legal process, to investigate or remedy potential violations of our policies, or to protect the rights, property, and safety of others, we may share your information as permitted or required by any applicable law, rule, or regulation.

b. Third-Party Service Providers: We may share your information with third parties that perform services for us or on our behalf, including cloud hosting (Firebase Firestore, Firebase Storage, Firebase Functions), authentication (Google Sign-In, Firebase Authentication), app integrity checks (Firebase App Check with Google Play Integrity), push notifications (Firebase Cloud Messaging), crash and error reporting (Firebase Crashlytics, and Sentinel, our own service hosted on Vercel and Supabase), usage analytics (PostHog), notifications to us (Telegram, and ntfy.sh in older versions of the App — see the note below), payment processing for Pro upgrades (Google Play Billing, Apple App Store), website hosting and email (Vercel, Supabase, Resend), and ad serving (AdMob; Pro removes the ads shown between lessons, quizzes, and games, but rewarded ads you choose to watch stay available). These service providers have access to your information only to perform these tasks on our behalf and are obligated not to disclose or use it for any other purpose. We encourage you to review their privacy policies.

c. Notifications to Us (Telegram and ntfy.sh): We receive notifications in a private Telegram chat about new App accounts (including the account's email address), feedback, Pro purchases, website signups, and errors. Feedback you send from the App is saved in our database, and the notification about it contains only the feedback type, your rating, the text of your message (with any email address in it removed), your device's platform (such as Android or iOS), and a reference to the entry in our database. It does not include your name, email address, or account identifier. When you buy Pro on Google Play, the notification contains the price you paid, your billing country, the product, and the Google Play order number, and likewise does not include your name, email address, or account identifier. Versions of the App up to and including 1.0.0-beta.12 also send a copy of your feedback to us through ntfy.sh, including your display name (or, if you have none, your email address), the feedback type and rating, and the text of your message, on a topic that is not access-controlled, which means it is technically readable by anyone who knows or guesses the topic name. Later versions no longer do this. If you have an older version, update the App before sending feedback, or email us instead.

d. Business Transfers: If we transfer the Services to someone else, for example to a company we set up to run them or to a person or organisation that takes them over, your information may be transferred with them. Whoever receives it must use it in line with this Privacy Policy.

e. With Your Consent: We may disclose your personal information for any other purpose with your consent.

4. Data Storage and Security

a. Storage Location: Your information, including personal data and progress, is primarily stored using Google Cloud Platform services (Firebase Firestore, Firebase Storage, Firebase Authentication) located in various regions globally. Google employs robust security measures.

b. Security Measures: We use administrative, technical, and physical security measures to help protect your personal information. While we have taken reasonable steps to secure the personal information you provide to us, please be aware that despite our efforts, no security measures are perfect or impenetrable, and no method of data transmission can be guaranteed against any interception or other type of misuse.

c. Data Retention: We keep personal information only for as long as we need it for the purposes in this policy:

  • Your account data (profile, settings, progress, quiz results, certificates, and stored files): until you delete your account.
  • Guest accounts you have signed out of: until you ask us to delete them, as you cannot sign back in to delete them yourself.
  • Leaderboard entries, feedback, push notification tokens, and new-account alerts: until you ask us to remove them, or until we no longer need them.
  • Purchase records: for as long as tax and accounting law requires us to keep them.
  • Email signups on our websites (including the hashed IP address): until you ask us to delete them. If you unsubscribe, we keep a note of that so that we do not email you again.
  • Crash and error reports, and notifications we receive on Telegram: for as long as they help us run and fix the Services.
  • Usage analytics (Section 5B): one year for records of how the App was used, and one month for session replays.

We may keep information longer where the law requires it or to resolve a dispute, and usage data may be kept in an aggregated or anonymized form that no longer identifies you.

d. International Transfers: Our service providers, including Google (Firebase and AdMob), Vercel, Supabase, Resend, Telegram and PostHog, may store or process your information outside the United Kingdom and the European Economic Area, including in the United States, where data protection law may differ from yours. Where personal information leaves the UK or the EEA, we rely on an adequacy decision or regulation that covers the recipient where there is one (for example, the EU-U.S. Data Privacy Framework and its UK Extension, for providers certified under it), and otherwise on the standard contractual clauses those providers offer.

5. Your Privacy Rights and Choices

a. Account Information: You may at any time review or change the information in your Google account settings that we access via Google Sign-In. You can typically manage your Google profile information directly through Google.

b. Certificate Name: You can review and update the name used for your certificates within the App's settings menu.

c. Notifications: You can turn reminders off in the App's settings. To stop all notifications from the App, including push notifications we send from our servers, turn notifications off for the App in your device's settings.

d. Account Deletion: You can delete your account and associated data directly from within the App, or by following the instructions on our Account Deletion page. Please note that deleting your account is permanent and will remove your profile, progress, quiz results, stored files, and earned certificates. Some records are stored outside your account and are not erased by the in-app flow: leaderboard entries (your submitted score and the display name shown with it), feedback you have sent us, purchase logs, push notification tokens, our record of the new-account alert, and any guest accounts you signed out of earlier. See our Account Deletion page for detail. Email us and we will remove them on request, except where we must keep a purchase record for tax or accounting purposes. We may retain certain information as required by law or for legitimate business purposes.

e. Your Rights: Depending on where you live, you have the right to ask us for a copy of your personal information, to correct it, to delete it, to restrict or object to how we use it (including where we rely on our legitimate interests), and to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time; this does not affect anything we did before you withdrew it. To exercise any of these rights, email us at axislearningsup@gmail.com. We will reply within one month, and we may need to ask for information to confirm your identity first.

f. Complaints: If you are unhappy with how we have handled your information, please contact us first so we can try to put it right. You also have the right to complain to a data protection authority: in the United Kingdom, the Information Commissioner's Office (ico.org.uk); in the European Economic Area, the authority in the country where you live or work.

g. Automated Decisions: We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Quiz scores and certificate eligibility are calculated automatically from your answers; if you think a result is wrong, for example because of a translation error, tell us and a person will review it.

5A. Advertising

The free version of the App shows ads served by Google AdMob: full-screen ads between lessons, quizzes, and games, and rewarded ads you can choose to watch. To serve and measure ads, AdMob may use your device's advertising identifier, your IP address, and other device and usage signals, and may use them to personalise the ads you see. You can reset or delete your advertising ID at any time in your device settings (on Android: Settings, then Privacy, then Ads); once it is deleted, it can no longer be used to personalise ads. AdMob acts as an independent controller of the data it collects for advertising, not merely as our processor, and its handling of that data is governed by Google's own policies, which we link to in Section 7. Buying Pro removes the full-screen ads; see Section 7 of the Terms of Service for exactly what it covers.

5B. Usage Analytics

To learn which parts of the App work and which to improve, the App records how it is used: which screens you open, which buttons you tap and what follows (for example, that you finished a lesson, passed a quiz, opened the Pro page, or bought Pro, with its price), your answers to the questions the App asks when you start (such as your goal and experience level), whether you have Pro or an account, and details of your device and the App, such as the phone model, operating system, App version, language, time zone, and screen size. The records carry a random number that the App creates on your device, so that its actions can be counted together. Your name, email address, and account are never sent with them, and nothing you type is recorded.

If you have agreed to usage analytics yourself, we may also record some sessions as a replay of the screens, with all text and pictures blanked out, showing where you tapped.

We use PostHog, Inc. to store and analyse these records, on its servers in the European Union (Frankfurt, Germany). PostHog works out an approximate location (country and city) from your connection and does not store your IP address. Records are kept for one year and replays for one month.

Your choices: If your device's region or time zone is in the European Economic Area, or the App cannot tell where it is, nothing is recorded unless you choose "Allow" when the App asks. Elsewhere, including the United Kingdom, usage analytics are on, and you can turn them off at any time in the App's Settings ("Share usage data"). Turning them off stops the recording at once and erases the random number, so what was recorded before can no longer be tied to your device. Because the records are not linked to your account, deleting your account does not remove them, and we cannot tell which records are yours.

6. Children's Privacy

The App is not intended for children under the age of 13 (or the relevant age of consent in your jurisdiction). We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13, we will take steps to delete such information promptly.

7. Third-Party Websites and Services

The App may contain links to third-party websites or services (like Google) that are not affiliated with us. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies.

8. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy within the App or via other communication methods. You are advised to review this Privacy Policy periodically for any changes. Changes are effective when they are posted.

9. Contact Us

If you have questions or comments about this Privacy Policy, please contact us at:

axislearningsup@gmail.com

Daniel Tolenaar

Back to top