English · Italiano

Privacy Policy

Last updated: 10 October 2026 · Personal data: privacy@viastudy.app

This page says what VIA asks you for, what it keeps, who else sees it, and how to get rid of it. It is written to be read by the person using the app. Where something has a legal name, we use the name and then say what it means in the same sentence.

This page is also available in Italian. The two versions say the same thing. If they ever differ, the Italian version prevails, except where a mandatory rule of law that is more favourable to you as a consumer says otherwise.

The short version

This is the whole page in one screen, written so that a 14-year-old can read it. Everything after it is the detail, and each line here links to its part.

• Who we are. VIA is made by one person, Andriy Mrichko, in Italy. He is responsible for your data. Anything about your data: privacy@viastudy.app. More
• What we ask you for. An email address and a password — or you sign in with Apple or Google — plus the month and year you were born and the country you live in. Your birth month and year and your country are checked once and thrown away. We never ask your name, your school or your phone number. More
• What we keep. What you put into VIA so that it can work: your chats, your study material, the photos you attach, the lessons you record, your timetable. It is stored in the EU, in Frankfurt. More
• You are talking with an AI, and it can be wrong. Your questions and the relevant parts of your material are sent to Google's AI model, which writes the answers. Google does not use them to train its models. Check important things against your own material. More
• The microphone opens only when you start a recording or a Speak conversation. In Speak your voice goes to Google as you talk, and the microphone stays on while VIA talks so that you can interrupt by speaking: it can pick up people around you. You can switch that off in the Speak bar, and you can delete any spoken line. More
• If you record a lesson, make sure the people around you know, keep it for your own study and do not pass it on. A teacher or classmate who is in a recording can ask us to delete it. More
• Who else handles your data. A few companies that VIA runs on — for storage, AI, hosting, email and subscriptions. Some are outside the EU, under the legal safeguards we name. We do not sell your data, and there are no adverts, no analytics and no cookies. More
• If you buy a plan, Apple takes the payment. We never see your card. More
• You can delete anything, or your whole account, from the app. Recently Deleted is emptied after 30 days. An account nobody uses for 24 months is deleted, after an email 30 days before. More
• Your rights. You can ask us for a copy of your data, to correct it, to delete it, to hand it to you so you can take it elsewhere, or to stop using it. Write to privacy@viastudy.app: we answer within one month, and it costs nothing. More
• If you are under 18, show this page to a parent. Parents can write to us at the same address.

Who is responsible for your data

The data controller is Andriy Mrichko (individual developer of VIA), Via dei Ciliegi 11, 00071 Pomezia (RM), Italy. P.IVA 11237521007. VIA is made by one person and not by a company. The data controller — in Italian, the titolare del trattamento — is the person who decides why and how your data is used, and the one who answers to you for it. For anything about your data, write to privacy@viastudy.app. For help with the app that is not about your data, support@viastudy.app.

VIA is offered only in the European Union and the European Economic Area. At launch the app is distributed through the App Store of those countries and nowhere else, and this page is written for people who live there.

What we ask for when you sign up

These fields, and nothing else:

• Email address. Kept. It identifies your account.
• Password. Not kept by us — see “What happens to your password”.
• The month and year you were born. Not kept by us — see “What happens to your month and year of birth”.
• The country you live in. Not kept by us — it is read with your month and year of birth, in the same check, and goes the same way.

We do not ask for your name, your school, your phone number, or a payment card. There is nowhere in VIA to enter any of those.

And two boxes to tick. One accepts the Terms. The other says: “I understand that VIA is an AI and its answers may contain errors: I'll check important things against my material.” An account cannot be created without both. We keep the date and time you ticked the one about AI.

You have to give all of these to have an account. Without an email address (or an Apple or Google sign-in) there is nothing to identify the account by, and without your month and year of birth and your country we cannot check that you are old enough. If you would rather not give them, we cannot create an account for you. Everything else you put into VIA is up to you.

Signing in with Apple or Google

On an iPhone you can press “Continue with Apple” or “Continue with Google” instead of typing an email address and a password. Your phone shows Apple's or Google's own sign-in sheet, and that company then vouches for you to the company that runs sign-in for us. Your Apple or Google password never reaches VIA or our server.

What we receive from Apple. A code that identifies you to VIA and to no other app, and an email address. The address is your own or, if you choose Apple's Hide My Email, a relay address Apple makes up that forwards to you — in that case we never learn your real one. We do not ask Apple for your name, so it does not send one.

What we receive from Google. A code that identifies your Google Account, your email address, and the name and profile picture on that account. Google's sign-in always sends the name and the picture with the rest: we cannot ask it for less. VIA does not use them. They are not in VIA's own database and the app never shows them. They are stored by Supabase Auth, the service that runs sign-in for us, in your sign-in record, until your account is deleted.

What we keep. In our own database, the same thing as for any account: your email address, or Apple's relay address. The company that runs sign-in for us keeps the sign-in record: the code, the address and, for Google, the name and picture above. For Apple we keep one more thing, a token Apple gives our server when you sign in. It is good for a single purpose: telling Apple to disconnect VIA when you delete your account. It stays on our server, the app never holds it, and it is deleted with your account.

You are still asked when you were born and where you live, and to accept the Terms. The first time you arrive this way, the app shows one screen before anything else: the month and year you were born, the country you live in, the tick for the Terms and the tick saying you understand that VIA is an AI and its answers may contain errors. Until you have answered it, our server refuses that account everything except finishing that screen and deleting the account. Your month and year of birth and your country are checked and thrown away exactly as described below. What we do record is that you finished signing up, and the date and time you accepted the Terms and ticked the box about AI.

If you are below the minimum age for your country, the account Apple or Google just created is deleted at once — from our database, from the sign-in system and, for Apple, at Apple — and you are told that we cannot create an account for you. Nothing is kept. You can also leave that screen without answering: its only way out deletes the account in the same way.

If you already have a VIA account. Signing in with Google, or with Apple when you share your real address, brings you into the account that already has that email address, provided the address was confirmed — you are not asked when you were born again and nothing is duplicated. If you use Apple's Hide My Email, the relay address matches no account, so you get a new, separate, empty one; your existing account is untouched and still opens with your email address and password.

What happens to your month and year of birth

You choose the month and year you were born and the country you live in — the app starts on the country your phone is set to, and you can change it. We ask the month and year, not the day, and not your age as a number. Our server works out your age from them — in the month of your birthday it counts you as not yet a year older — and checks it against that country's minimum, which the Terms of Service list. If you are old enough the account is created. Then the month, the year and the country are gone. To be precise about that:

• They are not saved. There is no field for your date of birth, your age or your country anywhere in our database. Not an empty one — none at all. What remains is only the result: an account exists because the check passed.
• They are not passed on. When we create your account with the company that runs sign-in for us, the message we send them carries your email address, your password, a mark that sign-up was finished and the time you ticked the box about AI, and nothing else. We send that company a second message straight afterwards, asking it to email you a link confirming your address; that one carries your email address and the word “signup”. Neither message carries your month or year of birth or your country.
• They are not written to a log. If you are too young, the message you get back is one general sentence — “Sorry, we can't create an account for you.” — which names no age and never repeats what you chose.

Because nothing is kept, there is no retention period and no deletion to schedule. Your month and year of birth simply do not exist here after the moment they are checked. One trace stays on your phone, not with us: after a refusal the app notes, in the phone's secure storage, the time until which it will not offer sign-up again on that device — 24 hours. It is a time and nothing else, and it never reaches our server.

If you signed in with Apple or Google, the order is different and the result is the same: the account exists first, you are asked the month and year you were born straight afterwards, and they are checked and thrown away in the same way. See “Signing in with Apple or Google”.

What happens to your password

Your password reaches our server once, when you sign up, and is immediately passed on to the company that runs sign-in for us. We do not store it. We do not scramble it and store the result. We do not log it. There is no password field in our database.

That company stores a scrambled version — a hash — so that it can check your password without holding the password itself. That is their system, not ours, and we cannot read what they hold.

One consequence worth knowing: because we never see your stored password, we cannot reset it for you, and nobody who breaks into our database finds a password there.

What we store while you use VIA

Everything in this table is tied to your account and is removed when your account is removed. Some rows are different in a way worth flagging before you read them: a document you upload, a photo or a document you attach to a message and a lesson you record are all FILES, and none of them lives in the database with everything else here. What that costs is set out under “Deleting your account and your material”.

There is one more table in our database, and it is worth naming so that it is not mistaken for something it is not. Caption timing holds, for a YouTube video, the list of times at which each caption line starts. It is a cache of public information about the video — identical for everyone who ever adds it, and it holds no text from the video, no account, and no link back to any person. Deleting your account does not touch it, because it was never yours.

One more thing is held, and it is not in the database either — the uploaded file and the recording above are the others. To make VIA harder to use as a way of firing confirmation emails at somebody else's inbox, our server counts how many have been asked for, against two things: the email address they were asked for and the internet address the request came from. That count sits in the server's memory for an hour and is then dropped — deleted outright, whether or not anybody ever asks about that address again. It is never written to disk, and restarting the server forgets it.

What is on your phone, and what we have a copy of

Some things never reach our servers at all. They sit in your phone's own storage and they are not backed up by us:

• Your sign-in tokens, in the phone's secure storage: the short-lived one the app sends us with every request, and a longer-lived one it uses to get a fresh short-lived one without asking you to type your password again. Kept beside them is a note of whether you signed out, so that a phone you left is not treated as a phone that never signed in. If you signed in with Google, Google's own sign-in component also keeps its record of that sign-in on the phone.
• Light or dark mode, how your library is sorted, the order you dragged your subjects into, and whether you collapsed the quick-notes panel. On an iPad, also whether you hid the sidebar or the list of topics beside a chat.
• The language you chose for the app, English or Italian, if you changed it from Automatic.
• Your Speak choice: whether “Interrupt by speaking” is on, and whether this phone has already shown you the notice about it. See “Speaking to VIA out loud”.
• Which tip a new, empty chat showed you last, so that the next tip is a different one. It is the tip's short name and nothing about you.
• Which chat you last had open in each topic, so that going back into a topic puts you back in that chat. It is two numbers per topic, the topic's and the chat's, and none of the chat's words.
• Which chat you were in last, so that tapping that subject in your library takes you back to it. It is the subject's label and two numbers, the topic's and the chat's, and none of the chat's words.
• What you have typed in a chat but not sent. It is kept for each chat, so that leaving a chat and coming back, or closing the app, does not lose it. This is the one item in this list that holds your own words, and they stay on the phone: nothing you type reaches us until you press send. Kept with it is a note of any photo or file you attached to that message and have not sent: where the file is on this phone, and the number we gave it when it was uploaded. The file itself is already with us by then, as “Attaching photos to a message” says. All of it is removed when you send the message, and when you delete that chat or its topic.

Two things follow from that, and you should know both. If you delete the app or switch phones, these are gone and we cannot get them back — they were never on our side. And everything in that list except the sign-in tokens, the language, the Speak choice and the last tip is filed under the account that wrote it, so somebody else signing in on the same phone starts empty rather than in your library. The language belongs to the phone rather than to an account, because the sign-in screens are drawn in it before anyone has signed in; the last tip does too, and holds nothing of yours. The last two in the list, the chat you were in last and what you have typed but not sent, are also erased when you sign out; the others stay on the phone for when you sign back in.

Flashcards are not in that list: they are something we hold. VIA keeps no deck of cards on your phone. It writes cards into an answer: you ask for them in a chat, they arrive as part of the reply, and you open them from that reply; ask for them in Speak and they arrive as a message of their own in the same chat. So your cards are with us, in the text of a message — in the chat that holds it, kept the same way as every other message in that chat, and covered by the Chats row in “What we store while you use VIA”. They go when that chat goes, and when your account goes.

Quizzes work the same way, and your answers to them are kept nowhere. Ask for a quiz in a chat and VIA writes it into its answer: the questions, the choices and which choice is right are in the text of that message, kept and deleted exactly like the rest of that chat, and you open the quiz from there. What you do with it is different. The choices you tap, your score and the list of questions you got wrong exist only on your screen while the quiz is open. They are not sent to us, they are not saved on your phone, and they are gone when you leave the quiz. The same is true of the cards you mark as understood or not: that marking is never sent or saved either.

If you were using VIA before that change, the cards that were on your phone are still on it. The app does not read them any more, but deleting your account does erase them, along with everything else of yours the phone is holding. They sit in VIA's own storage on the phone with nothing reading them, no other app can get at them, and they go when you delete the app.

Four things are on your phone as well as with us, rather than only there, and this section would be misleading without them. Your weekly timetable is one of them. It is saved to your account on our servers as well as on your phone, so signing in on another phone brings it back. We keep one copy of it per account, and it is replaced whole every time you change it: we do not keep earlier versions. If you use VIA on two phones, the copy we are left with is the one that reached us last, which is not always the change you made last. A change made while a phone had no connection is sent the next time you open that screen, and when it arrives it replaces what is there — even if the other phone saved something newer in between. Nothing warns you, and there is no earlier version to go back to. It goes when you delete your account, along with everything else filed under it.

What a saved timetable says about you, put plainly rather than left as a list of fields. Each class in it carries the subject exactly as you typed it, the room exactly as you typed it, and the time it starts, against a day of the week. Together those are a record of where you physically are at a given hour on a given weekday, held on our servers for as long as that timetable stands. We are saying it in those words rather than leaving you to add the fields up, because you can have a VIA account from the age of 14 — so the youngest person this paragraph is written for is fourteen, or is that child's parent. If you would rather not tell us where you are, leave the room blank: a class works without it, and a room you never type is a room we never hold.

A lesson you record is another. When you record a lesson, your phone writes the audio to VIA's own storage on the phone and then uploads that file. So a recording exists in two places: in your private storage with us, and in the app's storage on the phone that made it. The phone's copy is inside VIA and no other app can read it. The app deletes that copy when the recording is deleted for good — by you, or when Recently Deleted is emptied — and when you delete your account; if the recording was deleted from another phone, the copy goes the next time the app finds our server no longer has it. It also goes when you delete the app, and your phone may clear it on its own when it needs the space.

That copy is not only sitting there: it is what plays when you tap a recording, as long as it is still on the phone, so listening back usually needs no network and moves no data. If your phone has cleared it, VIA falls back to the copy in your storage with us — see “Recording a lesson”.

The third is a copy of each PDF you open. The first time you open a PDF, from your materials or from a chat, the app downloads it once into VIA's own storage on the phone and opens it from there every time after, so a second look needs no network. A PDF you upload from this phone is copied there as soon as the upload arrives, so it is never downloaded at all. These copies are the same files you gave us: nothing is added to them, and nothing about them is sent to us. Beside each copy the app also keeps a picture of every page it has shown you, made on the phone from that copy, so the pages come back at once; they go with the copy. Together they take up to about 500 MB, and when they would take more the oldest are removed first; your phone may also clear them on its own when it needs the space, and the next time you open that PDF it is downloaded again. No other app can read them. On an iPhone a PDF, a Word, PowerPoint or Excel file opens in the phone's own viewer, which is part of iOS and shows the file on the phone without sending it anywhere. A Word, PowerPoint, Excel or OpenDocument file is not kept the way a PDF is: each time you open one, in the phone's viewer or with Open in another app, the phone downloads the file into a temporary folder of VIA's and replaces it the next time you open a file that way. With Open in another app it is then handed to the app you pick, and what that other app does with the file is up to that app. They are erased when you sign out and when you delete your account, and they go when you delete the app.

The fourth is your subject list. It is saved to your account on our servers as well as on your phone, so signing in on another phone brings your subjects back with their names. For each subject we hold its name exactly as you typed it, its colour and icon, whether you made it yourself or picked it from our list, a code the app made up for it, the time your phone says you last changed it, and when we last accepted a change to it. The app sends the whole list at these moments: when you sign in, when you start the app and your library opens, when you add a subject in your library, and when you delete one. The subjects you pick when you first set up the app are sent the first time your library opens after that. Renaming a subject or changing its colour or icon is saved on your phone first and reaches us at the next of those moments, usually the next time you start the app. A change made while the phone had no connection is sent at the next of those moments that has one. The order you dragged your subjects into, and how your library is sorted, are never sent: they stay on this phone only, in the first list further up. If you use VIA on two phones, the change your phones say was made last is the one we keep. A subject you delete stays in our copy, name included, marked as deleted, so that your other phone learns it was deleted instead of bringing it back. It goes when you delete your account, along with everything else filed under it.

A subject's name can reach us a second way. If you type it into a class on your timetable, it is also in the week we save — as the text of that class, with nothing joining it to your subject list or to the topics filed under it. Renaming or deleting a subject does not change your timetable.

What happens when you add a link or a video

When you paste a web link into a topic, our server visits that page and pulls the readable text out of it. It does the same with a web link you send VIA in a chat — the first one in your message, never one in VIA's reply — so that VIA can read the page before it answers. In a topic's chat, that page is then kept as one of the topic's materials. The website sees our server, not your phone — but it does mean the link you chose has left your device.

When you add a web link to a topic's materials, or send one in a topic's chat, our server also asks that website for its icon — the small picture a browser shows beside a site's name. It asks only the website the page came from. If the page says its icon is kept on a different website, we do not fetch it from there, and if the website tries to send us somewhere else for it, we do not follow. (If the link you added forwarded us to another website before the page loaded, that other website is the one the page came from, and so it is the one we ask.) This can be a few requests rather than one — the icons the page names, then the usual address for one — but it never fetches the page a second time. Like the page itself, the request comes from our server and carries nothing that says who you are.

We keep that icon, and your phone gets it from us, not from the website. Our server turns it into a small picture, at most 96 pixels on each side, and stores it with the link, in our database. Where VIA shows it — beside a topic's name in your library and in your list of topics, using the first web link that topic got, whether you added it or sent it in its chat — your phone loads it from VIA, signed in as you. So the website never sees your phone for this. That is the opposite of a YouTube video's picture, further down, which your phone loads straight from YouTube.

It happens once each time you add a link, or send one in a topic's chat. We note that we asked whether or not an icon was found, so a website with no icon is not asked again for that link; adding or sending the same link again counts as a new link, and that one is asked. It does not happen in a chat that is not in a topic, for a YouTube link, for a page VIA could not read, or for a link added or sent before this was switched on — those have no icon.

When you paste a YouTube link, our server fetches that video's existing captions, and again later if VIA needs the caption timing to point you at a moment in the video. It gets them by asking Supadata, a service operated by Dumpling Software UG (haftungsbeschränkt), a company in Berlin, that fetches the captions from YouTube for us and hands them back — see “Who else touches your data”. What Supadata is sent is the video's plain YouTube address, rebuilt from the video's code rather than copied from the link you pasted, and nothing that says who you are or which account added it. When you first add the link, our server also asks YouTube for the video's title. None of those requests comes from your phone.

Your phone does talk to YouTube itself, though, to show you the video's picture. Wherever VIA shows a YouTube video's still — on a topic in your library and in your list of topics, beside the video in a topic's materials, and at the top of the video's own screen — your phone loads that picture straight from YouTube, not through us. So YouTube sees your phone's internet address and which video's picture it asked for. And opening the video to watch it is you visiting YouTube, the same as opening it anywhere else.

We do not download videos. When Supadata fetches captions for us, we ask it only for captions the video already has, never for the video's sound to be turned into text. And for a web link, our server visits only the page you added and, for its icon, that same website. It follows no other link on the page and visits no other site.

Attaching photos to a message

You can attach photos to a message you write to VIA, from your photo library or by taking one with the camera. How many depends on your plan, and photos and files are counted together: on Free, up to four photos and files a day in all; on Lite and Pro, up to 25 photos and files in one chat, after which a new chat takes more. To keep those counts, our server adds one to your day's count on Free when a message carrying a photo is sent, and on Lite and Pro counts the photos and files already in that chat. It counts them; it does not look at them to do it. Both are rows of the panel behind the “+” in a topic's chat. VIA opens your photo library only when you tap Photos, and your camera only when you tap Camera; nothing in the app looks at your photos or your camera at any other moment.

VIA does not ask for permission to your photo library, because it is never given the library. What opens is your phone's own picker, run by the phone rather than by us, and when you are done it hands back only the pictures you tapped. VIA cannot look through your photos, cannot count them, and cannot see one you did not choose. The camera is different: the first time you tap Camera, your phone asks you whether VIA may use it, and you can change that answer in your phone's settings at any time. The camera is your phone's own, and VIA receives only the photo you take with it.

Location and other hidden details are removed before anything leaves your phone. A photo usually carries hidden details beside the picture — when it was taken, on what, and often exactly where. VIA asks for the pictures without those, and each one is saved again as a new image on your phone, which carries none of them — and made smaller first when it is too big to send. That new copy is what is uploaded. The photo in your library is not moved, changed or deleted.

Each photo goes straight into your private storage, the same storage your documents and recordings are kept in, without passing through our server, as soon as you choose it.

A photo sent in a topic's chat is also filed in that topic's materials. When you send a photo in a chat that belongs to a study topic, it is also filed as one of that topic's materials, so you can find it again in the Notebook instead of scrolling back through the chat to look for it. It is listed by the time you sent it — “Photo, 22 Sep 21:15” — and opens there. That means a second copy of the picture is stored, one belonging to the message and one belonging to the topic's materials, so that deleting either cannot break the other. It is still not put in the search index and VIA still does not read it as study material: nothing turns the picture into text, so its content is never part of what VIA is told about your topic. A photo you send in a chat that belongs to no topic is not filed anywhere, because there are no materials for it to be filed in.

The images are sent to Google's model with your message, and again with later messages in that chat while they are recent. When you send the message, our server fetches the images from your storage and sends them to Google's model together with your words, in the same request and to the same place as the rest of the chat — Google's EU multi-region, see “The AI part, and where it happens”. Every photo of the message you are sending goes with it. So that VIA can go on answering questions about them, each later message in the same chat also sends the most recent earlier images again: at most four of them in one request, newest first, taken from the part of the chat that is sent with every message. Older images are replaced by a note that an image was sent earlier. Photographing something catches what is around it: whatever was in the frame — the rest of the desk, somebody's hand — is in the image, and is sent with it.

Google does not train its models on them. VIA uses Google's paid Cloud service, whose terms state that Google will not use customer data to train or fine-tune AI/ML models without prior permission or instruction. VIA does not give that permission.

They are deleted with the chat, the topic or your account. Deleting a chat deletes every image sent in it, deleting a topic deletes its chats and every image sent in them, and deleting your account deletes every image you ever attached; each asks the storage system to remove the files themselves, with the caveat set out under “Deleting your account and your material”. There is no way yet to delete a single image once it has been sent, short of deleting its chat. The copy filed as a topic's material can be deleted on its own, from the Notebook, like any other material — and because it is a separate copy, deleting it removes that one and leaves the picture in the message where you sent it. Deleting it there is not a way to take the photo out of the chat. A photo you remove before sending is deleted at once. One you attached but never sent is never sent to Google and never shown; it is deleted the next time you attach a photo a day or more later — there is no clock on our side that does it sooner — or with your account. A photo or file still waiting in an unsent message is uploaded again, not lost. If you come back to that chat most of a day or more after attaching it, the app sends the photo from your phone a second time, or asks us to copy the file from your materials again, so that it is still there to send, and deletes the earlier copy. If the phone has cleared the photo's file in the meantime, the app says it could not attach it and you can remove it or pick it again.

Recording a lesson

VIA opens your phone's microphone only when you start something that needs it — a recording, or a Speak conversation — and never on its own. Nothing starts listening in the background, there is no wake word, and the app does not open the microphone at any other time. A lesson recording you have started is the one thing that keeps the microphone on while VIA is not on your screen; the paragraph after next says how. Your phone asks for microphone permission the first time, in its own words rather than ours, and you can take that permission back in your phone's settings at any time.

The recorder tells you something every time you look at it, and we are repeating it here because it is the part that involves somebody other than you: “Make sure people around you know you're recording.” That line is under the record button permanently, and in the bar a chat shows while it records, rather than in a box you dismiss once, because the day it matters is a day you are in a room with someone who has not agreed to be recorded. A microphone picks up whoever is talking, not only the person who meant to be recorded.

The other people in a recording: your teacher, your classmates. A lesson recording holds their voices and what they said. When we store it, write it out or summarise it for you, we are handling their personal data too, although they have no account with us and we do not know who they are. Our legal basis for that is legitimate interest — see “Why we are allowed to use your data”. We cannot inform each of them personally: we do not know who is in a recording, and finding out would mean listening to it and identifying people, which would intrude on them more than it protects them. The GDPR provides for that case (Article 14(5)(b)) on condition that we protect them in other ways, and these are ours: this page is public; the recorder tells you, every time, to make sure people know; the Terms of Service allow recording only for your own study, within your school's rules and your teacher's instructions, and forbid passing a recording on; a recording is private to your account and used for nothing but your study; and it is deleted when you delete it, with your account, and with an account left unused. If you are in a recording somebody made with VIA — as a teacher, a classmate, or the parent of one — write to privacy@viastudy.app. Tell us what you can about when and where it was made and who made it; once we can tell which recording it is, we delete it, or have the student delete it.

A lesson recording continues while your phone is locked or VIA is in the background. Once you press Record, the recording carries on if you lock the phone, go to the home screen or open another app, until you press Stop. Your phone shows its own microphone indicator the whole time, which is the phone telling you, not us, that the microphone is in use. Only a lesson recording does this: a Speak conversation ends as soon as you leave VIA. If a phone call or another app takes the microphone, the recording pauses; it carries on in the same file when the phone allows it, and if it cannot, VIA ends the recording, keeps everything before that moment and tells you what happened and when. We say it here because it changes what is in the file: a recording can have a gap where a call was, or be shorter than the lesson was, and it is not a fault in the file if it is.

Where the audio goes. The file goes from your phone straight into the same private storage an uploaded document would use — it does not pass through our server on the way, and we keep no second copy of it. The phone keeps one, though: see “What is on your phone, and what we have a copy of”, which says what that costs. Its address in our storage is built the same way as a document's: a scrambled code standing in for your account, then the word “recordings”, then a random file name. Your name is nowhere in it, and a list of the stored files on its own says nothing about who any of them belongs to. In the database we keep the row described under “What we store while you use VIA”, together with any flags you add to the recording and the notes you write on them, and nothing more.

A recording is not sent to Google unless you ask for it to be written out. This is worth being exact about, because your voice leaving your phone is the kind of thing you should be told about wherever it happens — here, and under “Speaking to VIA out loud”. Recording from a chat's Record button is one way of asking, described in the list below. Otherwise, recording alone does nothing but store the file: it is not transcribed, it is not turned into study material, it is not put in the search index, and no AI model is given it. Until you ask, our own server does not open it either — it knows how big the file is and what type it says it is, and that is all it learns from the file itself. The only other thing it holds about what was said is whatever you write yourself, in a flag's note.

Having a recording written out, and where that audio goes. Transcription is optional, and nothing happens to a recording until you choose it. Opening the recording's transcript page is one of the ways of choosing it; the bullet below headed “From a recording's Study page, or from its transcript page” says exactly when opening it sends and when it does not. Starting a recording with a chat's Record button is another: stopping it sends it, as the bullet headed “From a chat's Record button” says. The rest of the app never transcribes on its own. When you choose it, VIA sends that audio to Google so that Google can return a text transcript. A recording longer than about 14 minutes is sent as several consecutive pieces of up to 14 minutes each, cut where nobody is speaking, to the same model at the same place; the text is kept only if every piece comes back, and a recording longer than 2 hours is not transcribed. Where the text is kept depends on where you asked, and the next paragraph says how. The audio may include the lecturer's voice and anyone else who spoke, not only yours. Everything this page says elsewhere about a model getting things wrong without saying so applies at least as strongly to speech as to a scanned page.

There are three ways to ask, and the text is kept in a different place for each. The audio goes to Google the same way for all three.

• From inside a topic. The text is filed in that topic. It is study material there, it is put in that topic's search index, and you can ask questions about it. If the topic has no name yet, the start of the text can be sent to give it one — see “The AI part, and where it happens”.
• From a recording's Study page, or from its transcript page. Tap a recording in your Recordings list and it opens; its Study with VIA button opens the recording's Study page. If the recording has no transcript yet, the page's Transcript row says Make a transcript. One press on that row sends the audio to Google, straight away, and nothing asks you again. Two other rows on that page, Ask VIA about this lesson and Add to a topic, also make a transcript first when there is none, in the same way, and say so on the row before you press it. Opening the transcript page also sends the audio, on its own, with nothing pressed. The Study page opens it only once there is a transcript to read; a link to it opens it too. If the recording has no transcript yet, arriving there starts one. There are four things that stop it, and while any of them holds, arriving sends nothing: the recording already has a transcript; one is already being written for it; the recording is not ready, or is in Recently Deleted; or a previous attempt failed. After a failure the page shows you what went wrong instead, and asks nothing further of Google until you press its button yourself; the Study page shows the same failure, with when it happened, and its Try again is a press too. Pressing always tries again, however many times it has failed before. That refusal is remembered on your phone, so it survives closing and reopening VIA; it is forgotten only when a transcript is made, or when you delete your account. The text is kept with the recording, in no topic. It is not put in the search index, you cannot ask questions about it, and nothing is sent to name a topic. You read it on that page. It stays with the recording. The app has no button to delete it on its own. It is deleted when you delete the recording permanently.
• From a chat's Record button. Pressing Record in a study topic's chat starts an ordinary recording, which is saved to your Recordings list like any other. When you stop it, and it has finished uploading, the audio is sent to Google to be written out straight away, with nothing else pressed. The text is filed in that chat's topic, exactly as if you had asked from inside the topic: it is study material there, it is put in the topic's search index, and VIA can answer questions about it in that chat. The chat also keeps a card for the recording, which records which recording it was; that link between the chat and the recording is stored with the chat's messages. Deleting the chat deletes the card and the link, not the recording and not the text filed in the topic. The recording is also listed in that topic's Materials; deleting it there deletes the text filed in the topic, so VIA stops using it, and the card keeps the time you did so, to say it was removed. The recording itself stays in your Recordings list. If today's transcriptions are used up, the recording is still saved, the card says when they come back, and nothing is sent until you press Try again on it.

A transcript you already have can be put into a topic, and that sends no audio. Two rows on a recording's Study page do this. Add to a topic lets you pick one of your study topics and files a copy of the recording's transcript there. Ask VIA about this lesson opens a new chat — in the topic you added the recording to, or, if you added it to none, in a new topic in Quick Notes, as New topic makes one — puts the recording's card first in that chat, and files a copy of the transcript in that chat's topic the same way. Either way the copy is study material in that topic, exactly like a transcript made from inside it: it is put in the topic's search index, VIA can answer questions about it, and if the topic has no name yet the start of the text can be sent to give it one — see “The AI part, and where it happens”. Making the copy sends nothing to the transcription model and uses none of the day's transcriptions; it is the text you already have. If the recording has no transcript yet, one is made first, as the bullet above says, and that does send the audio.

What is kept, and how it goes. For Add to a topic we keep, with the recording, which topic you added it to; a recording is in one topic at a time this way. The topic's Materials list the recording. Removing it there deletes the copy filed in that topic, so VIA stops using it, and forgets the topic; the recording, and the transcript kept with it, stay. For Ask VIA, the chat, its card and the copy behave as a chat recording's do in the bullet above: deleting the chat deletes the card and the link, not the recording and not the copy; deleting the recording from that topic's Materials deletes the copy. Deleting a topic for good deletes the copies filed in it with its other materials, and a recording you had added to it is simply in no topic. The recording itself is never deleted by any of this.

VIA uses Google's paid Cloud service, and the model it uses for this is Gemini 3.8 Flash, a generally available model — not a preview or a test version. Google's current Cloud terms state that Google will not use customer data to train or fine-tune AI/ML models without prior permission or instruction. VIA does not give that permission.

That is not a promise that Google keeps no copy. Google may log requests for a limited time to detect abuse and keep the service secure. Those are two different things and we keep them in two different sentences on purpose: the first is about training, the second is about logging, and only the first is the one we can point at a term for.

The audio goes to Google's EU endpoint, the same place your typed questions go. Google processes this audio as our processor, under Google's Cloud Data Processing Addendum, which we accepted in our Google Cloud console, and VIA calls the model at Google's EU endpoint. Any processing outside the EU/EEA is covered by the Standard Contractual Clauses that are part of that addendum. The mechanism is named, with how to get a copy of it, under “Where your data is stored”.

Choosing is the whole of it. There is no setting that sends recordings automatically, no schedule and no background job that reaches a recording, and a recording you never choose is a file that never leaves your storage. A lesson longer than about 36 minutes is refused rather than cut into pieces, because a transcript with a silent gap in it reads exactly like a complete one.

The original recording stays where it is. Having a recording written out does not consume it, replace it or move it — it remains in your Recordings list, and the text is a second thing rather than a thing that took its place. Its title is copied from the recording's title at that moment, so renaming the recording later does not rename the text.

A transcript keeps a note of which recording it came from. When the text is made, VIA also stores which of your recordings it was made from, in a topic or not. That link is there so VIA can find text you have already made from a recording, instead of sending the same audio to Google again. The recording's Study page and its transcript page both use it, and so do Add to a topic and Ask VIA, which copy that text rather than send the audio again. If the recording already has a transcript, the Study page offers to open it, the transcript page shows it, and neither offers to transcribe again. Neither sees a transcript in a topic you have deleted, so in that case they do offer. If a second ask reaches Google before the first transcript is ready — from another phone, or after VIA was closed while one was being written — you can still get a second copy, and the audio is sent again. Opening the recording's page can be that second ask: VIA knows a transcript is being written only for as long as it is running. Transcribing from inside a topic does not check. If you do it there again, you get a second copy, and the audio is sent to Google again. Transcripts made before this link was added do not have it and cannot be given it, because the only trace they carry is a copy of the recording's title, and a title is not enough to be sure.

You can play a recording back, and how that works is worth one paragraph. Tap a recording in the list and it opens in place, as a player with a position, a length, and a bar you can drag. If the file your phone made is still on the phone, that is what plays — nothing is downloaded and nothing leaves your storage. If it is not there any more, VIA fetches your copy from your private storage instead, and to do that our server hands your app a temporary link to that one file. The link works for an hour and then stops working. The hour is a limit on the link, not on the recording, which stays exactly as it was; the next time you tap play, your app asks for a new link. Anyone holding one of those links while it lasts could play that one recording, which is why the app keeps it to itself and never shows it to you.

You can rename a recording. Open it in your Recordings list and use its … menu. Only the title changes. The number it was given when you made it stays the same, and the next recording you make still takes the next number.

You can flag a moment in a recording. A flag — the app calls it a bookmark — marks a moment in your own recording so you can jump straight back to it later. You can tap Flag while you are recording, or while you are playing a recording back. For each flag we keep where it is in the audio, to the thousandth of a second, and when you made it. Flags you tap while you are still recording wait in the app's memory until you stop and the recording is saved to your account, and are sent to us then. They are not written to your phone's storage, so if the app closes before that, or the recording is never saved, those flags are lost.

A flag can carry a name. Use Rename on a bookmark's … menu, in an open recording or on its Study page. A name can be up to 80 characters; we store it as you typed it, apart from any spaces at the start and end, and an empty one is stored as no name. A bookmark with no name is shown as Bookmark 1, Bookmark 2 and so on, by its place in the recording; that number is worked out on your phone and not stored. A name stays until you change it, delete the flag, delete the recording for good, or delete your account.

A flag can carry a note, and a note is your own writing, kept on our server. The app no longer lets you add or change a note: a bookmark has a name instead. A note you wrote before is kept, and shown with that moment on the recording's transcript page. A note can be up to 1,000 characters long. We store it as you typed it, apart from any spaces at the start and end, and a note with nothing in it is stored as no note at all. Because it is your writing, it holds whatever you put in it — including what your teacher or somebody else said — so treat it like anything else you put into VIA. It stays until you change it, delete the flag, delete the recording for good, or delete your account.

Flags, their names and their notes stay with the recording and go nowhere else. They are not sent to Google, including when you ask for a recording to be written out: only the audio goes, and the transcript that comes back carries no flags. A copy of the transcript filed in a topic carries none either. They are not put in the search index, and VIA's answers cannot see them. Deleting one flag removes it, its name and its note straight away. Flags have no Recently Deleted of their own, and the app does not ask you first: for a few seconds it offers Undo instead, which puts the same moment back with the same name and note, as a new flag. After that it is gone.

You can delete a recording, and you can change your mind. Open it and use its … menu, or Delete recording at the bottom of its Study page. A deleted recording goes to Recently Deleted, and you can put it back from there. Its audio is kept in our storage the whole time it is there, which is what lets you put it back. Its flags and their notes are kept too, so putting it back gives them back exactly as they were; while it is in Recently Deleted you cannot see or change them. Deleting a topic does not reach a recording, even one you added to that topic: the recording stays in your Recordings list, in no topic.

Recently Deleted is cleared out after 30 days, whether or not you open it. Our server does it once a day for every account, and opening Recently Deleted clears anything overdue at that moment too. When a recording is cleared out, its flags and notes are deleted, and so is a transcript kept with it in no topic. A transcript filed in a topic stays there. Just after that, our server asks the storage system to remove its audio, and its audio summary's. Almost always that works. If it fails, or if our server is restarted at the wrong moment, the audio can be left behind — see “Deleting your account and your material”.

Deleting a recording permanently asks the storage system to remove its audio straight away. You can do that from Recently Deleted. Its flags and their notes are deleted in the same step, and so is a transcript kept with the recording in no topic. Almost always the audio goes too. As with a document, that last step can fail, or our server can be restarted at the wrong moment, and then the audio can be left behind. Our server writes a line recording that when it can — see “Deleting your account and your material”. A transcript you filed in a topic is not deleted. It is study material in that topic, and it stays there until you delete it from that topic. It does lose its link to the recording: the note of which recording it came from is cleared, because that recording is gone.

The copy on your phone goes too. Moving a recording to Recently Deleted leaves the phone's copy where it is, so that putting the recording back still plays without a download. Deleting it for good — from Recently Deleted, or when its 30 days run out — and deleting your account both delete the audio file your phone recorded. On a second phone the copy goes the next time the app finds that our server no longer has the recording. See “What is on your phone, and what we have a copy of”.

Sharing a recording is something you do, from your phone. On an iPhone or iPad you can send a recording's audio file, or its transcript as a text file, to another app through the phone's own share sheet: Files, AirDrop, Mail, a messaging app. Nothing is shared until you choose it, and what is handed over is the file itself, never a link to our copy. If the audio is not on this phone, the phone downloads it from us first, which we allow for the account the recording belongs to and no other; a transcript is always downloaded. The phone puts the file in a temporary folder of VIA's, hands it to the app you pick, and removes it when the share sheet closes. We are not told which app you chose or who you sent it to, and we send nothing to that app ourselves. What that app, and anyone you send the file to, then does with it is up to them. A lesson recording can hold other people's voices as well as yours, and the Terms of Service do not allow you to pass those on: share a recording only to move your own file between your own devices and apps.

An audio summary of a lesson. On the Lite and Pro plans, a recording's Study page offers an Audio summary: VIA writes a short spoken summary of that lesson — about 2, 5 or 10 minutes, as you choose — and one voice reads it aloud for you to listen to in the app. Nothing is made until you press Create. Making one takes up to three steps, and each sends something to Google:

• If the recording has no transcript yet, it is transcribed first, exactly as Make a transcript does it: the audio goes to Google's model at its EU endpoint, as set out above, and the transcript is kept with the recording in no topic. That uses one of the day's transcriptions as well as the summary.
• The transcript's text goes to the same Google model that answers your chat messages, in Google's EU multi-region, with an instruction to write a spoken summary from that text and from nothing else.
• The summary's text goes to Google Cloud Text-to-Speech, which reads it aloud. VIA calls it only at its European endpoint. Google's documentation for that endpoint says the data “at-rest and in-use stay within the regional or continental boundaries of Europe”, and Cloud Text-to-Speech is on Google's published list of services that can be configured for data location. It says Europe, which is not quite the same as the European Union, and we would rather quote it than round it off.

The audio that comes back is stored with the recording it summarises, and the text the voice read is not kept anywhere. One recording has at most one summary: making a new one deletes the old one and its audio first. A summary goes when you delete it from the recording's card, when you make a new one, when you delete the recording permanently or Recently Deleted clears it out, and with your account. In each case our server asks the storage system to remove the audio after the record of it is gone, and as with a recording's own audio that last step can fail — see “Deleting your account and your material”. The summary is made on our server, so leaving the app while it is being made does not stop it; if our server is restarted part way through, the summary is marked as not finished and what it used of your week's allowance is given back. Listening to it sends nothing: the app plays the file.

The audio says it was made by AI, in the sound and in the file. An audio summary — of a lesson, or one made in Practice from a topic's materials — is read by a synthetic voice. It begins with a spoken sentence: “Audio summary generated by VIA's artificial intelligence.” A summary in Italian says it in Italian (“Riassunto audio generato dall'intelligenza artificiale di VIA.”), one in English in English, and one in any other language in English. Its audio file also carries a tag that software can read, saying the same: “AI-generated audio by VIA (Google TTS)”. If you share the file, both go with it. The tag can be lost if another app converts the audio; the spoken sentence stays.

Practice made from your materials. In a topic's Notebook, the Practice tab can make a quiz, a set of flashcards or an audio summary from that topic's materials and from its chats. You pick which materials and chats, how many questions or cards or how long, and for an audio summary you may type what to focus on. Nothing is made until you press Create, and only what you ticked is sent. A file you ticked that VIA is still reading is waited for; if it cannot be read, it is left out and the Practice list says so:

• If a lesson you ticked has no transcript in the topic yet, it is transcribed first, exactly as Make a transcript does it: its audio goes to Google's model at its EU endpoint, as set out above, and the transcript is filed in that topic's materials. That uses one of the day's transcriptions for each such lesson. On a plan with no transcriptions such a lesson cannot be ticked.
• The text of the materials you ticked — notes, the text read from PDFs, from Word, PowerPoint, Excel and OpenDocument files and from web pages, video transcripts and lesson transcripts — and of the chats you ticked — what you wrote in them and what VIA answered, a quiz or flashcards in them written out as their text, but not their photos, files or recordings — up to 200,000 characters in all, and up to eight of the photos you ticked, as images, together with the focus you typed, go to the same Google model that answers your chat messages, in Google's EU multi-region, with an instruction to make the quiz, the cards or a spoken script from those materials and from nothing else.
• For an audio summary, the script's text goes to Google Cloud Text-to-Speech at its European endpoint, exactly as for an audio summary of a lesson.

What is made is kept in the topic until you delete it, and it is a copy: deleting a material it was made from leaves it as it is. It goes when you delete it from the Practice list, when you delete the topic permanently or Recently Deleted clears it out, and with your account. For an audio summary our server then asks the storage system to remove the audio after the record of it is gone, and that last step can fail as it can for your other files — see “Deleting your account and your material”. It is made on our server, so closing the app does not stop it; if our server is restarted part way through, it is marked as not finished and the allowance it used is given back. Answering the quiz or going through the cards sends nothing, as with any quiz or set.

Speaking to VIA out loud

Speak is a spoken conversation with the study assistant about one topic's materials. You open it from inside a topic, you talk, and it answers out loud. It is the second thing in VIA that opens your microphone, and it is the only one that sends your voice anywhere as you speak.

Your voice goes to Google while you are talking, not afterwards. That is what makes it a conversation rather than a recording: the sound from your microphone is passed straight through our server to Google's model, which listens and replies in the same connection. Our server is in the middle of it — that is how the assistant is able to look things up in your own materials — but it is passing the audio along rather than keeping it.

The audio itself is not stored. The transcript is. Neither we nor your phone keeps the sound of your voice or of the reply: nothing is written to your private storage, nothing is written to our database, and there is no file to play back afterwards. What IS kept is the writing: what you said and what VIA answered are saved into that topic's chat as ordinary messages, marked as spoken, and they are deleted with the chat — exactly like a message you typed. If you delete the chat, the topic, or your account, they go with it; see “Deleting your account and your material”.

The microphone stays on while VIA is speaking, unless you turn that off. That is what lets you stop a reply by talking over it instead of tapping, and on an iPhone or iPad it is how Speak starts out: the switch “Interrupt by speaking” is on. While it is on, the sound from your microphone goes through our server to Google's model for the whole of a Speak conversation, not only while it is your turn. That includes other people: while the microphone is on, the voices of anyone else in the room can be picked up and sent too, along with whatever else it hears. Your phone tries to remove VIA's own voice from that sound before it leaves the phone; this takes out most of it, not always all. The sound is not stored, exactly as above, but what Google's model makes out as words is written into the chat as what you said, whoever said it.

You are told before the first time, and the switch is always in front of you. Before your first Speak conversation on a phone, the app shows a notice: “While VIA talks, your microphone stays on so you can interrupt her by speaking. It can also pick up people around you. You can switch to tap-to-interrupt anytime.” You answer “OK” or “Use tap-to-interrupt”. From then on the switch “Interrupt by speaking” is in the Speak bar for as long as a conversation is open. With it off, the microphone is closed while VIA is speaking and you tap to interrupt; turning it off in the middle of a reply cuts that reply at once. Turning it on takes effect from your next conversation. Your choice is kept on the phone and is not sent to us. Where the app cannot keep the microphone on, it is closed while VIA is speaking, you tap to interrupt, and there is no switch to show.

Spoken lines are marked, and you can delete any one of them. Above the first spoken line of a chat the app says “Automatic transcription, may include other voices”. If a line is not yours — somebody else's words, picked up by the microphone — or you simply do not want it kept, hold the small voice mark under that line and choose Delete. That one line is removed from our database for good and the rest of the chat stays. It works for what VIA said too, and it is available once the conversation has ended.

Your voice is used to hold the conversation and for nothing else. VIA does not use it to recognise you or anyone else and makes no voiceprint, so it is not handled as biometric data. Nor does VIA try to work out a mood, a level of attention or anything else about a person from how they sound.

The Speak bar says you are talking with an AI for as long as a conversation is up: “You're talking with VIA, an AI. It can make mistakes: check important things against your material.” A new, empty chat says the same under its greeting.

A reply you cut off is saved as much of it as you heard. If you tap to interrupt while VIA is talking, the part it had already said is kept and marked as interrupted, and the rest is not kept at all — because you never heard it. If you stop it by talking over it, the part kept can run a moment past what you heard, because the cut is then made by Google's model and not counted by your phone.

Where it goes. Speak reaches Google's Gemini 3.8 Live model, a generally available model, at Google's EU endpoint. Google processes this audio as our processor, under Google's Cloud Data Processing Addendum, which we accepted in our Google Cloud console, and VIA calls the model at Google's EU endpoint. Any processing outside the EU/EEA is covered by the Standard Contractual Clauses that are part of that addendum. See “The AI part, and where it happens”.

What you said is also used to name the chat, and the topic if it has no name yet, by a separate request to a different model. Once your first spoken exchange in a chat is saved, the text of what you said — the written transcript, never the recording — is sent to Google's model to suggest a name for the chat, and, if the topic is still called “New topic”, in a second request to suggest a name for the topic. These are the same requests a typed first message makes, to the same model at Google's EU multi-region as a typed chat, not to Speak's. What VIA said back is not sent for either. How the names are chosen, kept and replaced is under “The AI part, and where it happens”.

What the assistant is given. The same thing it is given in a typed chat: the material in the topic you opened Speak from, and your question. It is not given your email address or any account identifier, and it cannot search the web. It has three tools and all of them stay inside that one topic: looking things up in its material, making flashcards, and making quizzes. When you ask about your materials it must look them up rather than answer from its own knowledge — see “The AI part, and where it happens”.

Flashcards you ask for out loud are written by a second request, to a different model. When you ask for flashcards in Speak, we send Google's model three things: what it understood you to want, the text of what you had said so far in that exchange, and the material in that topic. This goes to the same model at the same place as a typed chat, Google's EU multi-region, not to Speak's model. The cards it writes are saved into the chat on your screen as a message of their own, marked as spoken, and they are kept and deleted exactly like the rest of that chat. The assistant is told only how many cards were made, not what is on them, so it does not read them out. If no cards can be made, nothing is saved and the assistant says so.

Quizzes you ask for out loud are written the same way. When you ask for a quiz in Speak, we send Google's model what it understood you to want, the text of what you had said so far in that exchange, and the material in that topic, to the same model at the same place as a typed chat, Google's EU multi-region, not to Speak's model. If none of what you said in that exchange was turned into text, the text of your most recent message in that chat is sent in its place, so that the quiz is written in the language you use there. The quiz is saved into the chat on your screen as a message of its own, marked as spoken, and kept and deleted exactly like the rest of that chat; you take it on your screen, and your answers are kept nowhere, as with any quiz. The assistant is told only the quiz's title and how many questions it has, not the questions, the choices or the answers, so it cannot read them out. If no quiz can be made, nothing is saved and the assistant says so.

It runs on iPhone only for now, and a conversation has a length limit. On Android the button says so rather than failing. A conversation reconnects by itself if the connection drops, and what you had already said and heard is kept when it does.

Speak is counted by the second. Every second a conversation is connected counts, whoever is talking, and it counts even if your phone drops the connection. On Free it counts against your Speak minutes for the day, which start again at midnight, Italian time. On Lite and Pro it counts against your week's usage, which starts again on Monday at midnight, Italian time: an estimate for each second while you talk, replaced by what the conversation really cost us when it ends. When either runs out the conversation ends and the app tells you so; with less than half a minute left, a new one does not start. What is kept is a number, with your other usage counts (see “What we store while you use VIA”). Nothing of what you said is in it.

The AI part, and where it happens

When you ask VIA a question inside a topic, we send Google your question, any photos you attached to it, the recent messages in that chat with their most recent images, and the relevant parts of your own study material, so that the model can answer from your material rather than making something up. Google's model writes the answer and sends it back. Something smaller happens when material is first added, to build the search index listed under “What we store while you use VIA”.

A new topic is named from the first thing you put into it. When you start a topic without giving it a name, VIA calls it “New topic”. The first time you send a message in it, say something to it in Speak, or add material to it, we send the start of that to Google's model and ask it for a short name for the topic: the first 2,000 characters of a message or of the text of what you said, or a material's title and its first 4,000 characters. For a PDF, that is the text the model already typed out of it, not the file again. This is a separate request from answering your question, and it sends nothing else from your topic. If you add two things at almost the same moment, both can be sent, and the first name saved is the one kept. Once the topic has a name, nothing more is sent for this. If you rename the topic yourself, nothing more is sent either, and a name you chose is never replaced. If naming does not work, the topic stays “New topic” and the app does not tell you; the next message or material you add tries again, which is one more request of the same kind. You can always rename a topic yourself.

Each new chat is named from its first message, the same way. A new chat starts without a name. Once your first message in it has been saved — typed, or the text of what you said in Speak — we send the first 2,000 characters of that message to the same Google model, at the same place, and ask it for a short name for the chat in the language you used. This is a separate request from the answer and from the topic's name, and it sends nothing else: not the answer, not your study material. Once the chat has a name, nothing more is sent for this. If you rename the chat yourself, your name is kept, even if it arrives while ours is being worked out, and it is never replaced. If naming does not work, the chat is given the first 60 characters of your message as its name instead, and the app does not tell you. You can always rename a chat yourself.

Adding a PDF sends the whole of it to Google. If reading is interrupted, the same file is sent again. This is a bigger thing than building the search index and we are not going to bury it in there. VIA cannot read a PDF by itself. When you add one, our server first counts its pages, on our server and without sending it anywhere. On Free, a PDF with more than ten pages stops there: it is not sent to Google, it is not read, and the upload it used is given back. On Lite and Pro, a PDF whose pages would use more of your week than you have left stops there too, and can be read later. The app also counts the pages on your phone before it uploads the file, where it can; a PDF it can already tell is over either limit is not uploaded at all, and uses nothing. Otherwise our server sends every page of it to Google's model in a single request and asks it to type out the text; what comes back is what gets stored as your study material, and it is what VIA reads from then on. A PDF that was not read stays stored, as any file you add does, until you delete it. If that read stops before it finishes — our server restarted, or the read took too long — the same file is sent again: by our server on its own, or when you tap Try again. What is sent includes anything on those pages you were not thinking about when you added them — a name in a header, a handwritten note in a margin, whatever is in a photograph on the page.

The model can get it wrong without saying so, and you should know that before you study from it. Where it can see that something is unreadable it marks the spot, and where a picture stood it says so. But we tested it on deliberately poor scans and found the opposite failure too: it sometimes produces clean, confident text for something it could not actually read, with no mark of any kind. There is nothing in VIA that detects that, and we are not going to pretend there is. So check it against the page itself: the file we hold is the PDF you sent, unchanged.

A Word, PowerPoint, Excel or OpenDocument file is read on our own server, and the file is not sent to Google. That is a .docx, .pptx, .xlsx, .odt or .ods file. Our server opens it and takes the text out itself: headings, paragraphs, lists, tables, footnotes and formulas; each slide's text and its speaker notes; each sheet's cell values. No AI model does that reading, and the file goes nowhere to be read. Pictures, charts and anything else embedded in the file are not read at all, and the material's row says so when a file had some. A very long spreadsheet is read only up to a limit, and its row says that too. What comes out is then study material like any other, and that text does go to Google in the ways this section describes for all your material: when the search index is built, when a topic is named from it, and whenever a chat or Practice uses it. A file protected by a password, an older .doc, .xls or .ppt file, or a damaged file is not read, and stays stored until you delete it. On Free, a file over a size limit — about ten pages of text, 20 slides, or 2,000 filled cells — is refused once our server has measured it: its text is not kept, nothing of it is sent to Google, and the upload it used is given back.

Two limits on what the model can do and see, both of which are true today:

• VIA gives the model no tools. It cannot search the web, look anything up on a map, or fetch a page while it answers. It sees only what we send it.
• We do not send your email address or any account identifier along with the question.

These requests go to Google's EU multi-region. VIA reaches Google through Vertex AI — Google Cloud's version of the service — with a service account rather than an ordinary API key, and it names the location in every request it sends. The models VIA uses for the requests described in this section are on Google's published list of models it will keep data at rest in the EU multi-region for. “EU multi-region” is a group of locations in Europe rather than one country, which is why no city is named here: we would be naming one we cannot point at.

Speak goes to Google's EU endpoint too, to a model of its own. The model behind Speak is Gemini 3.8 Live, a generally available model, which VIA calls at Google's EU group endpoint (eu). Google processes this audio as our processor, under Google's Cloud Data Processing Addendum, which we accepted in our Google Cloud console, and VIA calls the model at Google's EU endpoint. Any processing outside the EU/EEA is covered by the Standard Contractual Clauses that are part of that addendum. Google does not train on what you say: its Cloud terms require our permission for that, and we give none. If VIA ever switches Speak back to the model it used before 27 September 2026, Gemini 2.5 Flash native audio, that one is called at a single named location in Italy (europe-west8) under the same addendum. See “Speaking to VIA out loud”.

A recording written out goes to that same EU endpoint. The model that writes out a recording is Gemini 3.8 Flash, a generally available model, called at the same place as the model that answers your typed questions. “Recording a lesson” is where what happens to the audio is written out in full.

Google processes these requests as our processor. The models VIA uses for the requests described in this section are generally available models — not previews or test versions — and VIA calls them at Google's EU endpoint. Google processes what you send as our processor, under Google's Cloud Data Processing Addendum, which we accepted in our Google Cloud console. Any processing outside the EU/EEA is covered by the Standard Contractual Clauses that are part of that addendum. The mechanism is named, with how to get a copy of it, under “Where your data is stored”.

Where your data is stored

The way we put it, and the commitment we are making: student data is stored in the EU, with GDPR safeguards for any international transfers.

The specific region is Frankfurt, Germany. We name the region rather than saying "Europe", because "Europe" would include places that are not in the EU and would make the commitment in bold mean less than it says.

Everything that leaves the EU, or that we cannot show stays in it, is named on this page: AI processing by Google of your text, the photos you attach and your audio (what you say in Speak, and a recording you ask to have written out) — sent to Google's EU endpoint, handled by Google as our processor under its Cloud Data Processing Addendum, with any processing outside the EU/EEA covered by the Standard Contractual Clauses in that addendum — under “The AI part, and where it happens”; email delivery, under “Who else touches your data”; and what RevenueCat is told about a purchase, under “Buying a plan”. Each is an international transfer under GDPR.

The safeguard behind each transfer, company by company. When personal data goes to a company outside the European Economic Area, or can be reached from outside it, the GDPR requires a legal mechanism. Two are used here. The EU–US Data Privacy Framework is the European Commission's decision that US companies certified under it protect data adequately. Standard contractual clauses are a contract text written by the European Commission, which each company signs with us as part of its data processing agreement.

Checked on 10 October 2026. On that day the US Department of Commerce's list at dataprivacyframework.gov showed Google LLC, Render, Resend and Cloudflare as active participants in the EU–US Data Privacy Framework, covering data like yours. Supabase and RevenueCat were not on the list, which is why their row names the standard contractual clauses alone.

You can have a copy. Write to privacy@viastudy.app and we will send you the clauses that apply to a company in that table, or tell you where that company publishes them.

Your voice goes to Google's EU endpoint, in both cases where it goes anywhere. A recording you ask to have written out, and what you say in Speak, are each sent to a generally available Google model at that endpoint. Google processes this audio as our processor, under Google's Cloud Data Processing Addendum, which we accepted in our Google Cloud console, and VIA calls the model at Google's EU endpoint. Any processing outside the EU/EEA is covered by the Standard Contractual Clauses that are part of that addendum. Neither is sent unless you start it yourself.

Who else touches your data

These are our sub-processors — other companies that handle some of your data on our behalf so that VIA can work. This list is complete as at the date at the top of this page. It will change as VIA changes, and when it does, this page and that date change with it. Where we know a change is coming, that company's Status says so.

Apple and Google are not in that table, and that is deliberate. If you sign in with one of them, that company is not handling your data on our behalf: you have an account with it already, and it tells us who you are under its own privacy policy. What it sends us is set out under “Signing in with Apple or Google”. Each of them learns that you use VIA and when you sign in. Neither is sent your study material, your chats or anything else you do in the app.

Buying a plan. Lite and Pro are sold through Apple's App Store. Apple takes the payment, and we never see your card or your billing details. Apple is the seller and handles the payment under its own privacy policy, so it is not in the table above either. To know which plan your account has paid for, the app and our server use RevenueCat, which is in the table. What RevenueCat receives:

• Your VIA account's id. A random code we made up for your account. It is not your email address or your name, and it says nothing about you by itself.
• Your purchase history for VIA, as Apple reports it: which plan you bought and when, each renewal, and whether it was cancelled or refunded.
• Technical details of the phone: its type, its operating system, and when the app last contacted RevenueCat. Like any server the app talks to, RevenueCat also sees the internet address the request comes from.

We send RevenueCat nothing else: not your email address, not your study material, not your chats. It keeps what it receives in the United States, which makes this an international transfer. Its own privacy policy is at revenuecat.com/privacy. When you delete your VIA account, our server asks RevenueCat to delete its record of you as well. Deleting your account does not cancel a subscription — only you can, in your Apple settings; see the Terms of Service.

Deleting your account and your material

You can delete your account from inside the app, under Settings. VIA asks you twice before it does anything — the first time listing everything that goes, the second asking only whether to go ahead — and nothing is deleted until you answer the second. There is no waiting period and no way to take it back.

When your account row is removed, the database removes everything hanging off it in the same operation: your chats and every message in them, your topics, your study material, the search index built from it, your Recently Deleted list, your focus sessions, your jump-to points, your usage record, your recordings with every flag and note on them and their audio summaries, your timetable, and your subject list, the subjects you deleted included. That is not a cleanup job that runs afterwards and might be missed — the database enforces it as part of the same delete. The app's own warning screen lists what goes before you confirm, your lesson recordings and their audio summaries included, and says that the copies kept on the phone go too.

Your files are the exception, and this is the honest version of it. There are four kinds of them now — the lessons you record, audio summaries (of a lesson, or made from a topic's materials), the documents in your topics, and the photos you attach to messages — and none of them is in the database, so the delete above cannot reach them. What happens instead is that we read down where each of your files is before the delete — that record goes with everything else — and then ask the storage system to remove them afterwards. Almost always that works and the files are gone. If that last step fails, or if our server is restarted at the wrong moment, a file can be left behind: your account, your material and every trace of who it belonged to are already gone, and what remains is a file at an address nothing points at any more. Our server writes a line recording that when it can. Once a day our server also compares the files in storage with its records and reports to us every file that no record names, so that we can remove it by hand. That check reports; it does not delete anything by itself.

If you want to lower that risk, delete the things you care about from inside the app first, then delete your account. That works for a document and for a recording: deleting either one permanently asks the storage system to remove its file on its own. A photo filed as a topic's material can be deleted the same way, from the Notebook. For the copy that belongs to the message you sent it in, it works by deleting that chat, or the topic the chat is in.

Your sign-in record goes with it, in the system that holds your email address and your password hash. Those are two different systems and the app asks them in that order, so if the second one cannot be reached your material is gone either way and the app tells you plainly that the sign-in record may still be standing, and asks you to email us so we can remove it by hand.

If you signed in with Apple, we also tell Apple. After your account is deleted, our server asks Apple to disconnect VIA from your Apple Account, which is what removes VIA from your iPhone's Settings, under your name, in Sign in with Apple. If that request fails, your VIA account is deleted all the same and VIA may still be listed there; you can remove it yourself in that same place. If you signed in with Google, the app asks Google to do the same from your phone. If that does not go through, you can remove VIA in your Google Account, under the apps and services that have access to it.

The material kept only on this phone is erased too — your app settings, the things in the first list under “What is on your phone, and what we have a copy of”. We have no copy of any of it, so this is the one part of deleting your account that destroys something outright rather than asking our server to. Your timetable and your subject list are erased from the phone in the same sweep; our copies of them are in the list above and go with the account. So are the copies of your PDFs the app keeps on this phone, which also go whenever you sign out.

The app says so before you confirm, timetable included: its confirmation screen says your timetable is erased from this phone and that our copy of it goes too.

The phone's own copies of your recordings are erased too. Deleting your account deletes the audio files the recorder wrote on this phone, with the timetable, subject list and settings named above. A second phone you were signed in on deletes its copies the next time the app is opened there and finds the account gone, or when you delete the app.

With something left out of that, on a phone that has had VIA installed since before the app began keeping each account's material separately: a copy of your timetable and subject list from before that change can still be sitting in the phone's own storage. Nothing in VIA reads it — not the app, and not anybody who signs in on that phone afterwards — and it goes when the app does.

In our database, the one thing that survives is the caption timing named at the end of “What we store while you use VIA”, because it is public information about a video and holds nothing of yours.

You can also email us at privacy@viastudy.app and ask us to do it for you. That route still works, and it is the one to use if the app cannot reach us or if the sign-in record was the half that was left behind.

An account nobody uses is deleted after 24 months. “Uses” means opening VIA while signed in. When an account has gone unused for 24 months less 30 days we send its email address a warning, in Italian and in English, naming the date. If the app is opened and signed in during those 30 days the account stays and the count starts again; if not, the account is deleted exactly as if you had deleted it yourself from Settings, with everything described in this section. Nobody is deleted without that email having been sent, and an account with a paid plan running is not deleted this way. This does not cancel a subscription, which only you can do, in your Apple settings.

You can also delete things one at a time inside the app, without deleting your account: deleting a topic removes its material, its search index and its chats, with every photo sent in them, along with it, and deleting a single piece of study material removes that one. You can delete a single chat, from its “…” menu in the Notebook. That removes it for good, with every message in it, typed or spoken, the flashcards and quizzes VIA wrote into it, and the photos sent in it. Like a piece of study material, a chat does not go to Recently Deleted and cannot be put back, so the app asks you first. The topic stays, and so does its material: a photo you sent in the chat was also filed there as a separate copy, and that copy is not touched. If it was the topic's last chat, the topic is given a new, empty one. You can delete a recording too — see “Recording a lesson”. Each of these asks the storage system to remove any uploaded file or audio too, with the same caveat as above — the record goes for certain, the file goes in all but the unlucky cases. A transcript kept with a recording, in no topic, is different. The app has no button to delete it on its own. It is deleted when you delete the recording permanently.

You can delete a single spoken line. In a chat, hold the small voice mark under a line that was said in Speak and choose Delete: that line is removed for good and nothing else in the chat changes. See “Speaking to VIA out loud”. A typed message cannot be deleted on its own; it goes with its chat.

Recently Deleted

When you delete a topic or a recording it goes to Recently Deleted rather than disappearing. The screen shows them together in one list, with the ones that have seven days or fewer left at the top. Each is deleted for good after 30 days, and you can put either back before then.

The 30 days are enforced by our server, once a day, for every account — whether or not you ever open that screen. Opening Recently Deleted clears out anything overdue at that moment as well, so the list you see is exact. Because the job runs daily, an item can outlive its 30 days by up to a day. You can always delete a topic permanently yourself from that screen, which takes effect at once.

The same is true of a recording: until its 30 days are up its audio is still in our storage and its flags and notes are still kept. You can also delete a recording permanently from this screen. That deletes its flags and their notes at once, and a transcript kept with it in no topic; a transcript filed in a topic stays there. It also asks the storage system to remove its audio, and its audio summary's if it has one, which almost always works — see “Recording a lesson”. A permanent delete, by you or by the daily job, also removes the copy on your phone.

How long we keep things

The rule is short: what is in your account stays until you delete it or your account, and the table gives every case that has a time of its own.

Cookies

These pages set no cookies. They load no font and nothing from any other site — only their own text and one stylesheet. One page is different: the one the link in a sign-up confirmation email opens. It shows the VIA logo, from this site, and runs a few lines of its own script that pick English or Italian from your browser, tell a link that worked from one that has expired, and remove the sign-in details the link carries from the address bar without keeping or sending them anywhere. There is nothing here to track you with.

The app sets no cookies either, and contains no analytics, no advertising and no crash-reporting service. What it saves on your phone is the material under “What is on your phone, and what we have a copy of”, plus the bookkeeping that keeps that material apart: which account is signed in, whether the one-off move to per-account storage has already run, and whether a change to your timetable is still waiting to be sent to your account. That last one is a yes-or-no and holds none of the timetable itself. All of it is there to make the app work rather than to watch you.

Why we are allowed to use your data

The GDPR lets us use personal data only for a reason it names — a legal basis. The table gives ours for each thing VIA does. Three of them appear: contract (Article 6(1)(b)), meaning we need the data to give you the service you signed up for; legal obligation (Article 6(1)(c)), meaning a law requires it of us; and legitimate interest (Article 6(1)(f)), meaning we have a fair reason that does not override the interests of the person the data is about. VIA itself — your account, your chats, your materials, your recordings, Speak — rests on contract.

We do not rely on your consent for any of these, so there is no consent for you to withdraw. When your phone asks whether VIA may use the microphone, the camera or your photos, that is your phone's own permission and you can turn it off in its settings at any time. Where the basis is legitimate interest you can object, and we will stop unless we have a compelling reason not to — see “Your rights”.

Your rights

Under the GDPR — the EU's data protection law — you are the data subject, the person the data is about. You can ask us:

• for a copy of the data we hold about you (access);
• to correct something that is wrong (rectification);
• to delete it (erasure);
• to stop using it for a while, keeping it untouched, while a question about it is settled (restriction);
• to hand you what you gave us in a common file format, so that you can take it to another service (portability);
• to stop a use that rests on legitimate interest (objection).

Deleting is the one you can do yourself, from Settings in the app — see “Deleting your account and your material”. For the others write to privacy@viastudy.app. We answer within one month and it costs you nothing. We handle them by hand, because VIA has nothing built into it that exports your data for you: a copy, or the data you take elsewhere, is the material listed under “What we store while you use VIA”, sent to you as files.

You can complain to a data protection authority: in Italy, the Garante per la protezione dei dati personali; elsewhere, the authority of the country you live in.

No decision about you is made by a machine alone. VIA builds no profile of you and takes no automated decision that has a legal effect on you or affects you in a similarly serious way. The one thing it refuses automatically is an account below the minimum age, and that is a fixed rule applied to what you entered, not a judgement about you.

Parents, and people who are in a recording, can write to the same address. A parent or guardian of someone under 18 can ask us about that person's account, or to close it. Someone who is in a lesson recording has the rights above over that recording — see “Recording a lesson”.

Changes to this page

When what VIA does changes, this page changes and the date at the top changes with it. If a change is a significant one we tell you in the app. What an earlier version of this page said, where it now says something different, is listed below.

Changelog

• 10 October 2026. The page gained a one-screen short version, the controller's details, the legal mechanism behind each transfer, how long things are kept, and the full list of your rights. Personal-data requests now go to privacy@viastudy.app.
• Your age. The page used to say you typed your age in whole years, and that a refusal told you the minimum age. Sign-up now asks the month and year you were born, and a refusal names no age.
• Recently Deleted. The page used to say the list was cleared only when you opened it, so an item could stay past its 30 days. Our server now clears it every day.
• The recording on your phone. The page used to say nothing in VIA deleted the phone's copy of a recording, not even deleting your account. The app now deletes it with the recording and with the account.
• Files left behind. The page used to say no job went looking for a file left in storage after its record was deleted. A daily check now reports such files to us.
• Speak. The page used to say the microphone could stay on while VIA spoke without saying you could turn that off. There is now a notice before the first conversation, a switch in the Speak bar, a note on spoken lines, and a way to delete one.
• The microphone. An earlier version said VIA used your microphone only while you were recording a lesson, and that a recording was the one place your voice could leave your storage. Both stopped being true when VIA gained Speak.
• Flashcards. An earlier version said your flashcards never reached our servers. That was true of the deck the app used to keep on your phone. VIA now writes cards into a chat message, which we hold with the chat.
• Photos. An earlier version said a photo sent in a topic's chat did not appear in the topic's materials. It is now filed there too, as a second copy.
• Recordings written out. The page used to say a recording was written out by a Preview model at Google's global endpoint, outside the EEA. It is now written out by a generally available model at Google's EU endpoint.
• Where typed questions are processed. The page used to say we could not tell you where Google runs the model that answers them. It now says what we can point at: generally available models at Google's EU endpoint, Google as our processor, and standard contractual clauses for any processing outside the EU/EEA.
• Audio summaries. The page used to say only that an audio summary's file carried a tag saying it was made by AI. A summary now also begins with a spoken sentence saying so.
• Sign-up. Sign-up now has a second box to tick, saying you understand that VIA is an AI and its answers may contain errors, and we keep when you ticked it.
• Unused accounts. The page used to give legal obligation as our basis for deleting an account nobody uses. It is contract, together with the GDPR's storage limitation principle.