estalo.
Back to the sitePortuguês

PRIVACY

Privacy Policy

Estalo is an app to train mental math. We collect only what we need for your account, your progress and your subscription. We have no ads and no tracking.

Last updated: October 7, 2026

Who we are

Estalo is operated by Faberi Tecnologia LTDA (Brazilian company registration, CNPJ 69.040.935/0001-06). Faberi is the controller of your personal data under the Brazilian General Data Protection Law (LGPD, Law 13,709/2018).

This policy applies to the Estalo app on iPhone (App Store) and Android (Google Play), and to the estalo.xyz website. On the App Store, the app is published under the developer's individual account.

Contact us at hello@estalo.xyz. This is also the contact of our data protection officer.

Data we collect

Account

To create your account, you choose one way to sign in:

  • Email code: we send a 6-digit code to the email address you enter.
  • Sign in with Apple: we ask only for your email. Apple can give us a private relay email address. We do not receive your name.
  • Google sign-in: we receive the email and the basic profile of your Google account.

We keep your email, the sign-in provider you used and your user ID at that provider. Supabase Auth manages this data.

Learning progress

The app syncs your progress to the cloud, so you keep it when you change devices:

  • unlocked phases, stars and best times;
  • attempts per technique: whether the answer was correct, response time in milliseconds and the day;
  • your streak and daily history;
  • a skill rating;
  • problems you missed recently;
  • settings: whether you finished the introduction, your start phase, the explanation depth and reduce motion.

Subscription

If you subscribe to Estalo Pro, we keep data to unlock your access:

  • the product ID and the store (Apple or Google);
  • the original transaction ID;
  • a hashed key of your store account;
  • purchase, expiry and revocation dates;
  • the purchase environment (sandbox or production).

The app sends the purchase receipt or token to our server. The server checks the purchase with Apple or Google. We do not use this data for any other purpose. We do not receive your card details.

Technical logs

Our hosting providers log technical request data, such as IP address and request metadata. They keep these logs for security and to operate the service.

Data on your device

Estalo works offline first. The app keeps your progress and settings in local app storage on your device. It also keeps a queue of changes that are not synced yet. When you are online again, the app sends this queue to the cloud.

What we do not collect

  • We show no ads.
  • We use no analytics or tracking SDKs.
  • We do not collect the device advertising ID.
  • We do not access your location, contacts, photos, microphone or camera.
  • We do not collect push notification tokens.
  • We do not sell your data or share it for advertising.
  • We do not track you across other apps or websites.

How we use data and legal bases

We use your data on these legal bases (LGPD, article 7):

  • Performance of a contract: to create and keep your account, sync your progress and unlock your subscription.
  • Legitimate interest: to keep the service secure, prevent fraud and keep technical logs.
  • Legal obligation: to keep purchase records when the law requires it.

Who we share data with

We share data only with the processors that make Estalo work:

  • Supabase: database, authentication and server functions.
  • Apple: Sign in with Apple and App Store payments.
  • Google: Google sign-in and Google Play payments.
  • Cloudflare: website hosting. The website sets no cookies and has no analytics.
  • An email delivery provider: sends the sign-in codes.

We can also share data when the law or a competent authority requires it.

International transfers

Some processors handle data outside Brazil. In these cases, we use the adequate safeguards for international data transfers set out in article 33 of the LGPD.

How long we keep data

  • We keep account and progress data while your account exists.
  • We delete technical sync records (idempotency records) after 30 days.
  • When you delete your account in the app, we permanently delete the account and all its cloud data right away: progress, subscriptions and store links. The app also clears the local data on that device and revokes the Sign in with Apple token.
  • Apple and Google keep your purchase history under their own policies.
  • Technical logs follow the retention period of each provider.

See how to delete your account on the Delete account page.

Your rights

Under the LGPD (article 18) and similar laws, such as the GDPR, you can ask for:

  • confirmation that we process your data, and access to it;
  • correction of incomplete, wrong or outdated data;
  • deletion of your data;
  • portability of your data;
  • information about who we share your data with;
  • withdrawal of consent, when consent is the legal basis.

Send your request to hello@estalo.xyz. We answer within 15 days. You can also file a complaint with the Brazilian National Data Protection Authority (ANPD) or with your local data protection authority.

Children

Estalo is a learning app for a general audience. It is not directed to children under 13 (or the minimum age required in your country). We do not knowingly collect data from children.

If you are a parent or guardian and you find that a child sent us data, write to hello@estalo.xyz. We will delete that data.

This website

Cloudflare hosts the estalo.xyz website. The website sets no cookies and has no analytics tools. Cloudflare can log technical request data, such as the IP address, for security and operation.

Changes to this policy

We can update this policy. The date of the last update is at the top of this page. If a change is important, we tell you in the app or by email.

Contact and privacy officer

For privacy questions, or to use your rights, contact our data protection officer.

hello@estalo.xyz