Privacy Policy
What we collect, why, who sees it, and the rights you have under GDPR. Kept short and plain.
Last updated: 20 August 2026
This is the privacy policy for Catalyst — the website at catalystlearn.app and the Catalyst mobile app. It explains what data we collect, why, who we share it with, and the rights you have under the EU General Data Protection Regulation (GDPR) and the Dutch implementing law (UAVG). We've kept it short and plain. If anything is unclear, email info@catalystlearn.app.
1. Who is the controller
Catalyst is operated as a sole proprietorship in the Netherlands. The data controller's full legal identity is listed in section 11 (Contact) at the bottom of this page — GDPR requires us to make it available, and that's where you'll find it.
For any privacy question, email info@catalystlearn.app and you'll reach the person actually responsible. Catalyst doesn't have a Data Protection Officer because GDPR Art. 37 doesn't require us to appoint one.
2. What data we collect
Waitlist signup (catalystlearn.app)
If you join the waitlist, we collect:
- Your email address.
- Which form you used (hero or final call-to-action) — for understanding the page.
- The referring URL (if your browser sends one) and a generic browser user-agent string.
- The timestamp of signup.
We do not ask for your name, location, payment details, or any other personal data on the website.
The Catalyst mobile app
By default the app uses Supabase anonymous authentication — a randomly generated user ID is stored on your device and in our database. We don't ask for your name or email inside the app. We collect:
- The anonymous user ID.
- Which learning paths you start and which days you complete (so the app can show your progress).
- Time spent on each session (a count of seconds, not what you read).
- Topics you submit when generating a custom AI-built learning path.
- Whether you have an active subscription, which plan, and when it expires — this is what unlocks the paid catalogue.
- A record of subscription events (started, renewed, cancelled, expired, refunded), kept so we can tell what happened if your access ever looks wrong. We never see your payment details — Apple takes the payment and tells us only whether it succeeded.
Apple shares basic build install information (device model, OS version) with us through App Store Connect. That's an Apple process, not something Catalyst opted into.
3. Why we use it (lawful basis under GDPR Art. 6)
| Purpose | Data | Lawful basis |
|---|---|---|
| Tell you when early access is ready | Email, signup metadata | Consent (Art. 6(1)(a)) — by submitting the form |
| Operate the app (show progress, save completion) | Anonymous user ID, path/day records | Performance of a contract (Art. 6(1)(b)) — providing the service you opened the app to use |
| Generate audio narration of lessons | Lesson text (not your data) | Performance of a contract (Art. 6(1)(b)) |
| Generate custom learning paths from a topic you submit | Topic, requested duration | Performance of a contract (Art. 6(1)(b)) |
| Diagnose bugs and prevent abuse | Error logs, request counts per anonymous user | Legitimate interest (Art. 6(1)(f)) — keeping the service running and unburned |
4. Who we share it with
We use a small number of trusted processors. Each one only sees the data it needs to do its job, governed by a Data Processing Agreement.
| Processor | What it does | What it sees |
|---|---|---|
| Supabase (Supabase Inc., USA) | Database, anonymous auth, storage, serverless functions | Waitlist email, anonymous user ID, path progress, lesson text |
| Vercel (Vercel Inc., USA) | Hosts the catalystlearn.app website | Standard server logs (IP, user-agent) — used for security and operations only |
| Cloudflare (Cloudflare Inc., USA) | DNS for the domain | DNS lookups (no content) |
| ElevenLabs (ElevenLabs Inc., USA) | Generates audio narration of lessons (text-to-speech) | Lesson script text — no user data |
| Anthropic (USA) and Google (USA) | Generate the lesson content for AI-built custom paths. Google Cloud Text-to-Speech also narrates lessons. | The topic you submitted plus our generation prompt, and lesson script text — no other user data |
| RevenueCat (RevenueCat Inc., USA) | Manages subscriptions and tells us whether yours is active | Your anonymous user ID and the purchase information Apple sends it — never your name, email or card details |
| PostHog (EU region, Frankfurt) | Product analytics inside the app — whether the core loop actually works | Your anonymous user ID and the in-app events described above |
| Sentry (Functional Software Inc. — data stored in the EU, Frankfurt) | Crash reporting — tells us when the app crashes so we can fix it | Device and OS details and the error itself — no account identifier (we deliberately do not attach one) and nothing you typed |
| Apple (Apple Inc., USA / Ireland) | Distributes the iOS app and takes every payment | Your Apple ID and device install metadata. Apple processes the payment and tells us only whether it succeeded. |
4. Who we share it with
We use a small number of trusted processors. Each one only sees the data it needs to do its job, governed by a Data Processing Agreement.
| Processor | What it does | What it sees |
|---|---|---|
| Supabase (Supabase Inc., USA) | Database, anonymous auth, storage, serverless functions | Waitlist email, anonymous user ID, path progress, lesson text |
| Vercel (Vercel Inc., USA) | Hosts the catalystlearn.app website | Standard server logs (IP, user-agent) — used for security and operations only |
| Cloudflare (Cloudflare Inc., USA) | DNS for the domain | DNS lookups (no content) |
| ElevenLabs (ElevenLabs Inc., USA) | Generates audio narration of lessons (text-to-speech) | Lesson script text — no user data |
| Anthropic (USA) and Google (USA) | Generate the lesson content for AI-built custom paths | The topic you submitted plus our generation prompt — no other user data |
| Apple (Apple Inc., USA / Ireland) | TestFlight distribution of the iOS build | Your TestFlight Apple ID and device install metadata |
We do not sell or rent your data. We don't use advertising networks, and there are no third-party analytics on the website itself. Inside the app we use PostHog, hosted in the EU, to understand whether the core "open the app, complete a session" loop is working — it receives your anonymous user ID and the events listed above, never your name or anything you typed.
5. International transfers
Most of our processors are based in the United States. When your data is transferred outside the European Economic Area, we rely on:
- The EU–US Data Privacy Framework, where the processor is certified, and
- Standard Contractual Clauses (the European Commission's 2021 SCCs) as a fallback.
You can ask us for a copy of the relevant safeguards by emailing info@catalystlearn.app.
6. How long we keep it
- Waitlist email: until you ask us to delete it, or until the public launch is well past and the list is no longer relevant — whichever is sooner.
- App progress data: as long as the anonymous account exists. Reinstalling the app creates a new anonymous account and the old one is no longer linked to you.
- Server and error logs: typically 30 days, then deleted by the processor.
- Subscription status: while the subscription is active; the record is removed when it expires.
- Subscription event history: kept as a billing record, so it outlives the subscription itself.
7. Your rights under GDPR
You have the right to:
- Access the personal data we hold about you (Art. 15).
- Correct data that's wrong or incomplete (Art. 16).
- Erase your data — the "right to be forgotten" (Art. 17).
- Restrict processing in certain situations (Art. 18).
- Port your data to another service in a machine-readable format (Art. 20).
- Object to processing based on legitimate interests (Art. 21).
- Withdraw consent at any time, where processing is based on consent (Art. 7(3)).
To exercise any of these, email info@catalystlearn.app from the address you signed up with. We'll respond within 30 days, free of charge.
If we don't resolve a complaint to your satisfaction, you can file one with the Dutch Data Protection Authority — Autoriteit Persoonsgegevens — at autoriteitpersoonsgegevens.nl.
8. Cookies and tracking
The catalystlearn.app website uses no cookies and no third-party trackers at the time of writing. The only outbound request from the page is to Google Fonts to load the typefaces; Google may log standard request data (IP, user-agent) for that delivery.
The Catalyst mobile app uses local device storage (similar to cookies) to remember your anonymous session and progress. It doesn't use advertising identifiers.
9. Children
Catalyst is built for adult learners. We don't knowingly collect data from anyone under 16. If you believe a child has signed up, email info@catalystlearn.app and we'll delete the record.
10. Changes
We'll update this page when something material changes — for example, when we add product analytics, add a paid tier, or replace a processor. The "Last updated" date at the top will reflect the change. If the change affects what we do with data you already gave us, we'll email you before it takes effect.
11. Contact
For privacy requests, support, and general questions, please email info@catalystlearn.app. We'll respond from the inbox of the person actually responsible for the data.
Controller of record (per GDPR Art. 13): Robin Maximus, sole trader, the Netherlands. A postal address can be supplied on request to the email above.