Skip to content

Privacy Policy

Effective date: 1 November 2026

This policy explains what Epitree collects when you use our website (epitree.com), the Epitree browser extension and our emails, what we do with it, who else receives it, and the choices you have. Epitree is run by Teqard Labs Private Limited, a company registered in India, which is responsible for your data: the “data controller” under the EU’s General Data Protection Regulation (GDPR), and the “data fiduciary” under India’s Digital Personal Data Protection Act, 2023 (DPDP Act).

The short version

  • We don’t sell your data, show ads, or use tracking cookies.
  • Your account and everything you save are stored on servers in India (Amazon Web Services, Mumbai).
  • To write definitions, quiz questions and trees, we send the words and text you save to DeepSeek, an AI provider whose servers are in China. Your name, email address and account ID are not sent with them.
  • You can export your words, change or turn off our emails, and ask us to delete your account at any time.

1. Who we are

  • Company: Teqard Labs Private Limited, Marangadan Puthussery Building, CIAL City 130, Nayathode (P.O.), Angamaly, Ernakulam, Kerala 683572, India (teqardlabs.com)
  • Privacy questions and requests: privacy@epitree.com
  • Grievance Officer (India): Richard M Joy, reachable at privacy@epitree.com

2. What we collect

Your account

Sign-in is handled by Firebase Authentication, a Google service. It holds your email address and, if you sign in with Google, your name and profile picture. If you sign in with Apple, it holds the name and email address Apple shares with us, which can be a private relay address that forwards our emails to you. We store your email address and your settings: language, time zone (read from your browser, so emails arrive at the right local time), email schedule, daily goal, review preferences and the branches you focus on. We also keep your age group (see section 12), not your birth date.

What you save

  • The word or phrase, the sentence around it, and the address and title of the page you saved it from. Each time you save the same word again, we record that page, its title and the sentence too.
  • Definitions (written by AI, or by you when you edit them), your notes, and how your Concept Tree is organised.
  • Import page: the page’s title and address, and the article text the extension extracts from it. We keep the request built from that text together with the tree it produced.
  • Starter Trees: the description you write. We keep it with the tree.
  • The sites where you have paused the extension.

Your reviews

For each answer: whether it was right, the grade, the question style, what you typed or which option you chose, how long you took, and whether you used a hint or skipped it. Also your review sessions, daily goal and streaks. We use this to schedule your reviews and to improve how Epitree chooses questions.

Shared trees

When you create a share link, we store a copy of that branch as it was at that moment. Anyone with the link can view it and copy it into their own Epitree account. Links can’t be switched off in the app yet: email privacy@epitree.com and we’ll remove one.

Payments

Your plan, its status and dates, and reference numbers from our payment providers. Card and UPI details are handled by the payment providers; we never receive them.

Emails

Which emails we sent you, when, and the figures shown in them (such as how many questions you answered), so we don’t send the same email twice or repeat ourselves.

Technical data

Our servers log each request: IP address, browser, time and the address requested. We use these logs to keep the service secure and to fix problems, and keep them for up to 30 days.

Analytics

We count visits with Plausible Analytics, which we host ourselves on our own servers in India. It sets no cookies, stores nothing on your device, and does not keep your IP address. It records the page you visited (with private parts of links, such as share tokens, removed), the site that sent you, your approximate location (such as your country), and your browser and device type. We look at these in aggregate to see which pages are useful. They can’t identify you or follow you across other websites.

On your device

Your browser stores what’s needed to keep you signed in (Firebase keeps this in the browser’s storage) and your preferences: theme, question style, session size, and on the pricing page, your currency choice for that visit. We don’t use advertising or tracking cookies, which is why there is no cookie banner.

3. How we use it, and why we’re allowed to

For people in the EU, EEA or UK, these are the legal bases under the GDPR:

  • Providing Epitree (your account, saving words, building trees, scheduling and running reviews, the AI features, and emails about your account, security and billing): to perform our contract with you.
  • Review reminders and monthly reports: our legitimate interest in helping you keep the learning habit you signed up for. You can change or turn them off at any time.
  • Security, preventing abuse and moderating content: our legitimate interest in keeping Epitree safe and working.
  • Improving Epitree (analytics, and learning from review answers how to choose better questions): our legitimate interest in making the product better.
  • Billing and tax records: to meet our legal obligations.

For people in India, we process your data with your consent, which you give when you create an account and can withdraw at any time by deleting your account, and for the other legitimate uses the DPDP Act allows.

What you have to give us: an email address to sign in, and your age when you start. Without them we can’t create your account. Everything else is up to you.

Automated decisions: Epitree decides automatically when to show you each word and, for AI-checked questions, whether your answer was right. These only affect your learning inside the app. The age check also decides automatically whether you can use Epitree; if you think it got this wrong, contact privacy@epitree.com.

4. AI features

To write definitions, quiz sentences and answer options, explanations of how concepts relate, names for topics and trees, Starter Trees and page imports, and to check typed answers, we send the following to DeepSeek, whose servers are in the People’s Republic of China:

  • the words and sentences you save, and where they sit in your tree
  • what you type when an answer is checked by AI
  • the description you write for a Starter Tree
  • the text of a page you import

We don’t send your name, email address or account ID.

Before making a tree from a description or an imported page, we send the description, or the page’s title and its first 2,000 characters, to OpenAI’s moderation service (servers in the United States) to check it for harmful content.

Connecting related concepts uses a model that runs on our own servers, so nothing is sent out for that. We don’t use your data to train AI models. Please don’t save sensitive information, such as health details or passwords, as words or notes.

5. Who else receives your data

We use these providers to run Epitree. Each receives only what its job needs:

  • Amazon Web Services (India, Mumbai): hosts our servers and database, delivers images, and sends our emails.
  • Google Firebase (United States): sign-in.
  • Apple (United States): only if you sign in with Apple. Apple confirms it’s you, and if you hide your email, our emails reach you through Apple’s relay.
  • DeepSeek (China): the AI features described above.
  • OpenAI (United States): content moderation, described above.
  • Razorpay (India): payments in India. It receives the details you enter at checkout.
  • Polar (Polar Software, Inc., United States): sells plans outside India as merchant of record, so it handles payment and sales tax. It receives the details you enter at checkout.

Beyond these providers, your data goes only:

  • to people you give a share link to, as described above;
  • to authorities, when the law requires it;
  • to a new owner if Epitree is sold or merged, who must keep to this policy. We’d tell you first.

We don’t sell or rent your data, and we don’t share it for advertising.

6. Where your data is stored

Our servers and database are in India (Amazon Web Services, Mumbai). Some of the providers above process data in other countries: the United States (Firebase, Apple, OpenAI and Polar) and China (DeepSeek). If you are in the EU, EEA or UK, sending data to these countries is a transfer outside your region.

For Amazon Web Services, Google (Firebase) and OpenAI, we rely on their data processing terms, which include the European Commission’s standard contractual clauses. DeepSeek does not offer these clauses, so we send it only the text the AI features need, never your name, email address or account ID. You can ask us for a copy of the safeguards we rely on at privacy@epitree.com.

7. How long we keep it

  • Your account, words, trees and review history: until you delete your account. After that, we remove them from our live systems within 30 days and from backups within 35 days.
  • Share links: until you ask us to remove them or delete your account.
  • Billing records: as long as tax and company law require, which in India can be up to 8 years.
  • Server logs: up to 30 days.
  • Analytics: aggregate statistics that don’t identify anyone. We keep these indefinitely.
  • AI providers: DeepSeek and OpenAI keep what we send them under their own terms.

8. Your choices and rights

In Epitree

  • Edit or delete any word, definition or note.
  • Delete your account and everything in it, from your Profile. A paid plan ends at the same time.
  • Export your words to Anki or Obsidian.
  • Change when you get emails, turn off reminders or the monthly report, or use the unsubscribe link in any of them.
  • Pause the extension on any site.

By email

Write to privacy@epitree.com to get a copy of your data, correct it, delete your account and everything in it, or remove a share link. We reply within 30 days.

In the EU, EEA or UK

Under the GDPR you can access, correct and delete your data, restrict how we use it, take a copy in a portable format, and object to uses based on our legitimate interests. You can also complain to the data protection authority where you live.

Your right to object: you can object at any time to any use of your data that relies on our legitimate interests, including reminder emails and improving Epitree, and we will stop unless we have compelling grounds that override yours.

In India

Under the DPDP Act you can get a summary of your data and how it is used; have it corrected, completed, updated or erased; withdraw your consent; have your grievances answered by our Grievance Officer; and nominate someone to exercise these rights if you die or can’t act yourself. If we don’t resolve a grievance, you can complain to the Data Protection Board of India.

In California

We don’t sell your personal information or share it for cross-context behavioural advertising. You can ask to know, correct or delete what we hold about you.

9. The browser extension

  • It reads a page only when you act: the text you select when you save it, and the article text when you choose Import page.
  • It doesn’t collect or send your browsing history.
  • The sites where you pause it are saved to your account.
  • Our use of information received through the extension follows the Chrome Web Store User Data Policy, including its Limited Use requirements.

10. Emails

We send a weekly review reminder (on by default, on the day and at the time you choose), a monthly progress report, and emails about your account, security and billing. We don’t track whether you open our emails or click their links. Reminders and reports have an unsubscribe link, and you can change them in Settings.

11. Security

Everything travels over HTTPS, and every request for your data is checked against your sign-in. Only the people who run Epitree can access the database, and only to support you or keep the service running. No system is perfectly secure; if a breach affects your data, we’ll tell you and the authorities as the law requires.

12. Age and children

Epitree is for people aged 13 and over, or 16 and over in Europe. When you start, we ask for your birth month and year. We use them once to check your age and keep only your age group (13 to 15, 16 to 17, or 18 and over), never the date. If you are too young, we remove a new account straight away.

If you are under 18, you need a parent’s or guardian’s permission to use Epitree, and any paid plan must be bought by them.

If you believe a child under the minimum age has an account, contact privacy@epitree.com and we’ll delete it.

13. Changes to this policy

When we change this policy, we update the effective date at the top. For significant changes, we’ll email you before they take effect.

14. Contact

Teqard Labs Private Limited, Marangadan Puthussery Building, CIAL City 130, Nayathode (P.O.), Angamaly, Ernakulam, Kerala 683572, India. Email privacy@epitree.com.