Privacy Policy

Atrio is a study tool that lets you turn notes, scripts, PDFs, and images into flashcards and learn with spaced repetition. The application processes personal data only to the extent necessary to operate the service and provide its features.

We do not process any data on the basis of consent, do not use any tracking or advertising cookies, and do not sell any data. The processing is based on Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (legitimate interest in a secure, stable, and functional service).

This website is hosted by Vercel Inc. (340 S Lemon Ave #4133, Walnut, CA 91789, USA). When the website is accessed, Vercel processes technically required data (in particular IP address, time, and the pages accessed). This serves the provision, security, and stability of the service. The legal basis is Art. 6(1)(f) GDPR.

Vercel processes data partly in data centers outside the EU (in particular in the USA). Vercel is certified under the EU-US Data Privacy Framework, and where required we additionally use the EU Standard Contractual Clauses. Further information can be found in the Vercel privacy policy.

When the website is accessed, the hosting provider automatically collects information in so-called server log files that your browser transmits:

• IP address of the requesting device
• Date and time of the request
• Page / URL accessed
• HTTP status code and amount of data transferred
• Browser type, browser version, and operating system
• Referrer URL (previously visited page)

These data are not merged with other data sources and are not used to identify individuals. They serve the delivery of content, the ensuring of IT security, and error analysis. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation). The log files are stored for as long as necessary for these purposes and then deleted.

We do not use any cookies for advertising, tracking, or profiling by third parties. The web analytics collection described in section 3 is carried out without profiling; in practice it can be disabled via ad blockers and does not set any identifying cookie.

To use the study features you can create an account. In the process we process the following information:

• Username (publicly visible as your display name)
• Email address (for account and support purposes)
• Password – stored exclusively as a cryptographic hash (bcrypt)
• Time of registration
• Account settings (e.g. daily goals, reminder rate, color scheme)

The processing serves the provision of your account and the use of the signed-in features. The legal basis is Art. 6(1)(b) GDPR.

Your learning content – flashcards, decks, folders, exam dates, subjects, and your review statistics (spaced repetition) – is stored to enable your study workflow across all devices. The legal basis is Art. 6(1)(b) GDPR.

If you share a deck via the community feature, selected content (deck title, cards) as well as your username become visible to other users as author information and can be found via search. Therefore do not share cards that contain personal or confidential information. You can revoke the sharing at any time; afterwards the deck is no longer accessible to others.

Via the “AI import” feature you can upload texts, images, and PDF pages to automatically generate flashcards from them. For this feature to work, your uploaded content is transmitted together with a processing request to an AI service:

• OpenRouter (openrouter.ai) – the AI service through which the processing runs: primarily via the provider InferenceNet, and automatically via the provider DeepInfra if that provider is unavailable (no training use and no storage of prompt data).

The transmitted data are used solely to generate your flashcards and are not used by us for other purposes. The legal basis is Art. 6(1)(b) GDPR (provision of the requested feature). Please only upload material that you have created yourself or that you are entitled to have processed.

To avoid duplicate costs for identical imports, responses from the AI services are placed in a cache in our database. What is stored is the response generated by the model as text. This means: The image file itself is not stored, but the content derived from your material very much is. In the lossless import modes “Vocabulary list” and “Handwriting”, the stored response contains a verbatim transcription of your material; in card recognition, recognized topics and phrasings are also taken over.

The cryptographic checksum (SHA-256) of the complete request to the AI model serves as the key. The cache is not bound to your account. If exactly the same file with the same settings is imported again, the already stored response can be reused – also by another person. The stored entry can be retrieved for at most 24 hours and is additionally cleaned up nightly.

The providers mentioned may process the data in data centers outside the EU to fulfill the processing order. Where required, this is done on the basis of the EU-US Data Privacy Framework or the EU Standard Contractual Clauses. Further information can be found in the OpenRouter privacy policy.

As part of product development, we may voluntarily ask for your assessment, e.g. of features or of a possible pricing model. If you take part, we store your answers in connection with your account:

• Your assessment (e.g. Yes / Maybe / No)
• A price indication you provided (optional)
• A free-text comment you entered (optional)

Participation is voluntary. You can leave out any information you do not want to provide. The data are used solely to improve the product. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in product development) or your voluntary provision of the information. You can request deletion at any time.

On the pricing page you can join a waitlist for the paid Endspurt plan. In the process we process:

• Your email address – for the invitation to the first founders wave
• optionally your exam date and a label (e.g. “Mathe LK”)
• optionally a price indication you provided and a free-text comment
• your waitlist position as well as the status (signed up / invited / converted)

The legal basis is your sign-up as a request to conclude a (later) contract (Art. 6(1)(b) GDPR). Invitations and information are sent by email via Resend Inc. (USA). Transmissions to the USA take place on the basis of the EU-US Data Privacy Framework or the EU Standard Contractual Clauses.

You can request removal from the waitlist and deletion of your email address at any time via the contact channels listed below.

Your account data and learning content are stored in a managed cloud database (libsql/Turso), which may be replicated across multiple locations for high availability. Processing may therefore take place outside the EU. Where required, the transmission is based on appropriate safeguards (EU Standard Contractual Clauses or adequacy decisions).

Access to your data is held exclusively by the system itself and the controller. There is no disclosure to third parties for advertising purposes.

For the processing described in this policy we use the following processors (Art. 28 GDPR). They process data exclusively on our instructions and only to the extent necessary for the respective purpose. Where data are transmitted to third countries (in particular the USA), this is done on the basis of the EU-US Data Privacy Framework or the EU Standard Contractual Clauses.

• Vercel Inc. (USA) – hosting of the website, object storage (Vercel Blob) for uploaded files, and web analytics (usage statistics)
• Turso (United Kingdom) – managed libsql database for account data and learning content
• OpenRouter (USA) – AI-assisted processing during import (primarily InferenceNet, automatic fallback DeepInfra)
• Cloudflare Inc. (USA) – spam protection (Turnstile) for registration, waitlist, surveys, and guest imports
• Resend Inc. (USA) – sending emails, e.g. waitlist invitations

We take technical and organizational measures to protect your data against loss, misuse, and unauthorized access:

• Encrypted transmission via TLS/HTTPS
• Passwords are stored exclusively as a bcrypt hash
• Session tokens are stored only as a hash (SHA-256) in the database
• Rate limiting and CSRF protection on the API endpoints
• Access rights according to the principle of least privilege

Your data are stored only for as long as necessary for the purposes stated above or as required by statutory retention periods.

• Account data and learning content: for as long as your account exists. Account deletion is carried out on your request via the contact channels listed below (there is currently no automatic deletion function in the account).
• Session data: until the session expires (max. 30 days).
• Server log files: only as long as necessary for security and error analysis.
• Source files uploaded for the AI import: for the duration of the processing in Vercel Blob; automatic deletion does not currently take place. You can request deletion at any time.
• Cache for AI responses: stored entries can be retrieved for at most 24 hours, after which they are additionally cleaned up nightly. The cache contains content derived from your material, not the image file itself. Details in section 8.
• Conversion data from flashcard study pages: for as long as the corresponding database row exists. They are not automatically deleted with the account, are included in the data export, and are deleted on request.

If you want to delete your account, write to us via the contact channels listed below. We will carry out a deletion without undue delay.

You have the following rights regarding your personal data:

• Access to the data processed by us (Art. 15 GDPR)
• Rectification of incorrect data (Art. 16 GDPR)
• Deletion of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR) – you can download your data at any time in the “Settings” section as a JSON file
• Objection to the processing (Art. 21 GDPR)
• Complaint to a data protection supervisory authority (Art. 77 GDPR)

To exercise these rights, an informal message to the email address mentioned above is sufficient. The supervisory authority responsible for you depends on your federal state or place of residence.

For questions about the processing of data, to exercise your rights, or if you have concerns about the processing of your data, contact us at any time:

For privacy-related questions you can also reach us via the Imprint page.