Privacy Policy of the Legalia app
1. Who the controller is
The legalia.md website and the Legalia app are administered by SCALELAW SOLUTIONS SRL (IDNO 1025600064372, brand Applexium), which acts as the personal data controller, registered office: MD-2069, mun. Chișinău, Calea Ieșilor 67, of. 9, Republic of Moldova; office address for correspondence: str. Mihai Viteazul 2a, Chișinău. For any question about your data: info@applexium.com, phone +373 78 76 87 65.
We process data in accordance with Law no. 195/2024 on personal data protection of the Republic of Moldova and, for users in the European Union, with Regulation (EU) 2016/679 (GDPR).
2. What data we collect
| Category | Data | Source |
|---|---|---|
| Account | email address, password (stored only as a hash), user identifier, name (optional). When you sign in with Google we receive the account identifier, the email address, the name and the URL of the profile photo; unless you have chosen another avatar, we copy that photo into our storage and use it as your avatar (you can change it at any time under Profile → Edit profile). When you sign in with Apple we receive the account identifier, the email address and the name, if you choose to share them; Apple may provide a “Hide My Email” relay address. | from you / from Google or Apple |
| Profile | @username, display name, description (bio), workplace, university, year of study, avatar (an illustrated preset or a photo you upload), preferred language and theme. | from you |
| Study plan | your answers during the initial setup: the chosen study track (faculty, exam or general), the year of study or the exam type and, optionally, the exam date (you can change them at any time under Profile → Study plan), the daily goal, the university (optional) and the score of the diagnostic test. | from you |
| Learning | quiz answers, scores, XP, streaks of consecutive days, achievements, progress by discipline, results of mock exams and duels, the option you picked in each question (the attempt log, kept for 7 days — the result stays in your progress), items scheduled for review, the streak calendar (days with the goal met, frozen or repaired), available streak freezes and the number of answers per day. The playback position of audio and video lessons stays on your device only. | generated by using the app |
| Social and reports | friends list and friend requests, blocked users, reports you submitted about other users (reason and details), duels played, reports of errors in questions (the question, the reason, an optional comment, app version, platform and language). | generated by using the app |
| Activity status | the time of your last activity in the app (updated at most once every 2 minutes while the app is open) and your choice whether to show it. | generated by using the app |
| Messages | the conversations you take part in (direct ones, groups created by users, the automatic groups of your year or exam, and the conversation with the Legalia team): the text of messages, replies, reactions and edits, date and time, up to which message each participant has read (for the “seen” mark), message requests, group membership and role, invite links and notification preferences; study attachments (a question, a result, a lesson, a duel challenge — references to Legalia content, not copies); from version 1.2 of the app, the photos, PDF documents and voice messages you choose to send. Messages to the Legalia team include the app version, platform and language so that we can help. Reports about messages (reason and details) and posting restrictions applied by moderation. | from you / generated by using the app |
| Subscription | the status of the Premium subscription and the transaction identifiers. For store purchases they come from the Apple App Store or Google Play through RevenueCat; for card payments on legalia.md, from maib — the order number, amount, date, the masked card number, the identifier of the card kept at the bank for renewals, and the month and year until which the bank keeps the card (so that no renewal is attempted after that date). We do not receive or store the full card number or the CVV code — they are entered only on the bank's secure page. When a payment is started we send the bank your email address and IP address, which maib requires to verify the transaction. | from Apple / Google / RevenueCat / maib |
| Notifications | an Expo push token for the device, the platform and the app language (so that notifications arrive in your language), only if you enable notifications; the preferred time of the study reminder and your notification preferences. | from the operating system, with your consent |
| Sign-up attribution (website only) | when you open legalia.md in a browser, we keep the UTM parameters of the link (source, medium, campaign) and the domain of the site you came from — never the page path. They are kept locally in the browser until the account is created, then saved once to the profile. We use no device identifier and do not track you on other sites. This data is not collected in the iOS and Android apps. | generated automatically, web only |
| Usage statistics | events about how the app is used — for example the steps of the initial setup, opening the app, the Premium offer being shown, finishing a quiz — with a random installation identifier (not a device identifier), the platform, the app version and the language; once you are signed in, linked to your account. They contain no free text, no email and no data about other users. You can turn them off at any time: Profile → Privacy (“Confidențialitate”) → Usage statistics. | generated automatically |
| Technical | an app installation identifier, sent to Expo's push notification service together with the push token; an anonymous client identifier, sent to the app-update service; crash reports and diagnostic data (the user identifier, device model, system and app version, error context — no email or name); technical server logs (IP address, time of the request, requested page, browser type); the authentication log (sign-ins, sign-outs, session refreshes, with the account email). | generated automatically |
We do not collect location, contacts, calendar or the device advertising identifier, and we do not track your activity in other apps or on other websites.
3. Why we process data
- Providing the service (performance of the contract): the account, the study plan, progress, leaderboards, duels, the Premium subscription, messages and the conversation with the Legalia team.
- Legitimate interest: account security, preventing abuse and fraud, moderating messages (an automatic word filter, sending limits, automatically hiding a message reported by 3 people, review of reports by the team), aggregate statistics about how content is used and about which public pages of the website lead to sign-ups, usage statistics (you can object at any time under Profile → Privacy; after that we record no events for your account), diagnosing errors.
- Consent: push notifications, access to the photo library for the avatar and, from version 1.2, for photos sent in messages; access to the microphone for voice messages. Consent can be withdrawn at any time in the app or device settings. When you create an account on legalia.md we additionally ask for your explicit consent to the processing of your data for creating and running the account — a box that is not ticked by default. We keep proof of that consent with the account: the date and time, the version of this policy, the exact consent text, the sign-up method and the browser type (user agent). In the iOS and Android apps there is no checkbox — the account is processed to perform the contract — but we likewise keep proof that the notice about the Terms and this policy was shown to you at sign-up (date and time, policy version, the notice text, the language and the sign-up method).
- Legal obligations: tax records of payments, responding to requests from competent authorities.
Do you have to give us your data? An email address and a password (or a Google or Apple account) are required to create an account — without them we cannot create it or save your progress. Your name, university, avatar, bio and other profile data are optional. The public pages of the website (practice questions, admission pages) can be read without an account.
4. What other users see
Legalia has social features. The following data is visible to other signed-in users: @username, display name, avatar, university, year of study, the date the account was created, XP and leaderboard position, achievements, the profile description and the results of duels played with them. Your email address is never shown to other users. You can block or report any user from their profile.
Activity status. While you use the app we keep the time of your last activity. Your classmates (same university and year of study, or the same exam) and your friends see only an approximate status — “Online now”, “Active today”, “Active yesterday”, “Active this week” — never the exact time; other users do not see it at all. You can turn it off at any time in Profile → Privacy; we then stop keeping the time of your activity and you do not see other people's status either. We delete this information after 90 days without activity.
Premium badge. If you have an active Legalia Premium subscription, other signed-in users see a star or a “Premium” label next to your name (in the leaderboard and on your profile). We never show the plan, price, dates or payment method, and people in a block with you do not see it.
Messages. A message is seen only by the participants of the conversation you sent it to; in a group, by all its members, including those who join later. If you are not friends and share no group, your first message arrives as a request that the recipient accepts or declines (we do not tell you if they declined). You join the automatic groups of your year or exam only if you choose to; there the other members see your name, @username and avatar. Messages are not end-to-end encrypted: they are encrypted in transit (TLS) and at rest, and the Legalia team reads a message only when it is reported, to decide on it, and your conversation with the Legalia team. A push notification about a new message may contain its beginning.
5. Who we share data with
We do not sell your data. We share it only with the service providers below, which process it on our behalf and only for the purposes described:
| Provider | Role | Where / transfer basis |
|---|---|---|
| Supabase Inc. | database hosting, authentication and authentication emails, file storage (avatars, data-export files, files sent in messages), real-time message delivery, server functions | EU (Frankfurt, Germany); standard contractual clauses for support access from the US |
| Apple Inc. | Sign in with Apple, payments and subscriptions through the App Store, push notifications on iOS (APNs) | US / EU; standard contractual clauses |
| Google LLC | Sign in with Google, payments and subscriptions through Google Play, push notifications on Android (Firebase Cloud Messaging) | US / EU; standard contractual clauses |
| RevenueCat Inc. | subscription management and purchase validation (account identifier, store purchase history) | US; standard contractual clauses |
| BC “Moldova Agroindbank” S.A. (maib) | processing card payments on legalia.md and keeping the card for subscription renewals (receives your email and IP address at payment) | Republic of Moldova; no transfer |
| Hostinger International Ltd. | hosting of the legalia.md web server (technical logs, kept for 14 days) and the email service through which we send payment confirmations and receive moderation reports | EU (Lithuania) |
| Expo (650 Industries Inc.) | delivery of push notifications (receives the push token, the installation identifier and the notification text) and of app updates (receives an anonymous client identifier) | US; standard contractual clauses |
| Telegram Messenger Inc. | internal notifications to the Legalia team about new accounts, subscriptions, reported messages and messages to the Legalia team (may include the name, email and message text), in a private team chat | UAE / EU; standard contractual clauses |
| Functional Software Inc. (Sentry) | collection of crash reports and diagnostic data, if the feature is enabled in the installed version (user identifier, no email); not enabled in the versions published as of this policy | US; standard contractual clauses |
Some providers process data outside the Republic of Moldova (in the European Union or the United States), on the basis of the standard contractual safeguards provided by the applicable law; you can ask for a copy of the safeguards at info@applexium.com. To produce course content (lesson narration, summaries) we also use speech-synthesis and text-editing services; they receive public legal texts only, never data about users.
6. How long we keep data
- Account and profile data: for as long as the account exists.
- When you delete your account, all your data is removed immediately from the live database and from file storage; backups are overwritten within 30 days at most.
- The quiz attempt log (the options picked): 7 days; the result of each quiz stays in your progress for as long as the account exists.
- Answers per day: 90 days. The streak calendar, XP, achievements and results: for as long as the account exists.
- Usage statistics: 13 months.
- Time of last activity (activity status): 90 days without activity.
- Messages: for as long as the account exists or until you delete them. A message deleted or hidden by moderation keeps its content for 30 days (to review reports); then the content is erased for good, together with its files (photos, documents, voice messages).
- Reports about messages: 12 months.
- Push tokens of devices that no longer receive notifications: 30 days after deactivation; technical notification logs: 7 days at most.
- Web server logs: 14 days. The authentication log: 12 months; after an account is deleted only the record of the deletion (email and date) remains, also for 12 months, as proof that the request was carried out.
- Data-export files: one hour.
- Crash reports: 90 days at most.
- Proof of the consent given at sign-up: for as long as the account exists.
- Data kept in your browser (see section 10): until you sign out or clear the site's data; the acknowledgement of the storage notice — 12 months at most.
- Billing data required by law (order, amount, date, payment status): for the period set by accounting and tax legislation, including after the account is deleted, no longer linked to it.
7. Deleting your account
You can delete your account at any time, directly in the app: Profile → Account (“Cont”) → Delete account (“Șterge contul”). Deletion is permanent and removes the profile, the study plan, progress, answers and the attempt log, the streak and its calendar, friends, duels, your blocks and reports, usage statistics, notification tokens, the avatar and data-export files. If you signed in with Apple, we also revoke the associated Apple authorisation. A Premium subscription, if any, must be cancelled separately in your Apple ID or Google Play settings, because it is managed by the respective store. You can also request deletion by email at info@applexium.com; we reply within 30 days at most. Step-by-step instructions (in Romanian): legalia.md/delete-account.
Your messages in conversations with other people leave no trace in their history: each is replaced by a “message deleted” mark, with no content, no files and without your name. Your reactions, group memberships and your conversation with the Legalia team are deleted entirely.
8. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability, objection and withdrawal of consent. Most of them can be exercised directly in the app:
- Access and portability: Profile → Privacy (“Confidențialitate”) → Download my data — a JSON file with all the data of your account.
- Rectification: Profile → Edit profile and Profile → Study plan.
- Objection to usage statistics: Profile → Privacy → Usage statistics. We send no marketing notifications; reminders are turned off under Profile → Settings.
- Erasure: Profile → Account → Delete account (see section 7).
For any other request write to us at info@applexium.com; we answer within 30 days. You also have the right to lodge a complaint with the National Center for Personal Data Protection of the Republic of Moldova (datepersonale.md) or with the supervisory authority of your country.
Withdrawing consent is as easy as giving it: delete your account in the app (Profile → Account → Delete account) or write to us at info@applexium.com. Withdrawal does not affect the lawfulness of processing carried out before it.
9. Security
Data travels only in encrypted form (TLS). Access to the database is restricted by row-level security policies, so each user can access only their own data; passwords are stored only as a hash; and the team's access to production systems is limited and logged.
Messages are encrypted in transit and at rest, but not end-to-end (see section 4). Access is limited to the participants of the conversation; the Legalia team accesses them only to moderate reported messages and for support conversations.
10. Cookies and browser storage
legalia.md uses no cookies and no third-party analytics, advertising or tracking tools (Google Analytics, social media pixels, etc.); the usage statistics described in section 2 are our own and stay on our servers. In the browser's local storage (localStorage) we keep only what is strictly necessary for the service to work: the sign-in session (Supabase), your chosen language and theme, app data kept for offline use, your onboarding answers until the account exists, the source of the visit (see section 2), the random installation identifier and usage events not yet sent, your choice about usage statistics, and the acknowledgement that you have seen the storage notice. No consent is required for this data; you can delete it at any time in your browser settings — you will be signed out. If we ever add optional tools, they will only be switched on after you agree.
11. Children
Legalia is aimed at students and graduates of law faculties and is not intended for persons under 16. When you sign up on the website you confirm that you are at least 16; the mobile apps do not ask for a date of birth, and using them assumes the same minimum age. Under art. 8 of Law No. 195/2024, data of persons under 14 could only be processed with the consent of their legal representative — which is why we do not create accounts for them. We do not knowingly collect data from children; if we learn that an account belongs to a child, we delete it.
12. Changes
We may update this policy. Material changes will be announced in the app before they take effect. The current version is always available at legalia.md/privacy/.
13. Contact
SCALELAW SOLUTIONS SRL · info@applexium.com · +373 78 76 87 65 · Registered office: MD-2069, mun. Chișinău, Calea Ieșilor 67, of. 9 · Correspondence: str. Mihai Viteazul 2a, Chișinău, Republic of Moldova. Help: legalia.md/support/en.