Privacy Policy

Effective 6 August 2026 · Applies to the AAIA Exam Prep — AI Audit iOS application

1. Who we are

AAIA Exam Prep — AI Audit (the “App”) is an offline-first study application for the ISACA Advanced in AI Audit (AAIA) certification exam, developed and operated by Vishwesh Pratap Singh (“we”, “us”, or the “Developer”), trading as Vishwen Labs, who is also the seller of record on the App Store.

For anything relating to this policy or your data, write to support@vishwenlabs.com. Email is our only support and privacy channel, and it is answered by the person who builds the App.

This policy describes the App as it actually behaves rather than a general template. If a capability is not listed here, the App does not have it.

2. Scope

This policy covers the App and the data handled in connection with it. It does not cover Apple's own processing when you use the App Store, which is governed by Apple's Privacy Policy. Our company-wide policy is at /legal/privacy; where the two differ, this page governs for this App.

3. We do not ask you to identify yourself

The App has no account, no sign-up, no login and no cloud sync. We never ask for your name, email address, phone number, employer or certification status. There is nothing to log in to, and no profile of you exists on our side.

Because of this we hold no personal information about you and cannot identify, contact or single you out.

4. Data that stays on your device

Every lesson, question, flashcard and mock exam ships inside the App, so it works with no network connection at all. Everything the App records about your studying is written only to its local storage on your device, inside the iOS app sandbox, where other apps cannot read it.

Stored on your device	What it is for
Lessons completed and reading position	Resuming where you stopped; module progress
Quick-check and practice answers	Explaining what you missed; the review screen
Per-question attempt history	Your readiness estimate and weak-area targeting
Flashcard review schedule	Spaced repetition — when each card is next due
Practice and mock exam sessions	Resuming an unfinished attempt; score history
Bookmarked questions	The bookmarks list
Daily activity and readiness snapshots	Streaks, the activity calendar, the readiness trend
Preferences	Appearance, exam date, daily goal, reminder time, haptics

None of this is transmitted to us. You can erase all of it at any time: Settings → Reset study progress clears every item above except your preferences and your purchase, and deleting the App removes everything permanently and immediately. If you use iCloud Backup or an encrypted device backup, your device may include the App's local data in that backup under your agreement with Apple; that backup is controlled by you and Apple, not by us.

5. Data processed when you subscribe

The App makes network requests for exactly one purpose: processing and restoring the optional Premium subscription. It contacts the payment-validation service once at launch to confirm whether a purchase already exists, so that Premium unlocks without you having to ask.

Payment is taken by Apple through your Apple Account. We never receive or see your name, billing address or card details — what we learn is limited to whether a valid purchase exists.

To recognise an active subscription, unlock Premium and support Restore purchases, the App uses RevenueCat, Inc. (a United States company) as a subscription-management processor. RevenueCat processes:

Data	Why
A randomly generated, pseudonymous app-user identifier	Associating a purchase with an app installation so it can be validated and restored. It is not linked to your name or email — the App never has them.
Purchase and receipt information from Apple: product, price, currency, transaction and renewal timestamps, subscription status	Validating the subscription, preventing fraudulent purchases, and keeping Premium accurate across reinstalls and devices.
Basic technical context — device model, OS version, locale, app version — and the IP address of the connection	Operating the validation service securely and correctly.

RevenueCat receives none of your study data. It acts on our behalf under its own published commitments; see the RevenueCat Privacy Policy. Where the GDPR or a comparable law applies, our legal bases are performance of a contract (delivering the subscription you bought) and our legitimate interest in preventing fraud.

6. Analytics

This version of the App transmits no analytics or telemetry of any kind. No usage events, no crash reports, no device fingerprinting, no session recording.

The App includes a Share anonymous analytics switch in Settings, reserved for a possible future update. In version 1.0 it governs nothing that leaves the device. If we ever add analytics we will update this policy and the App Store privacy labels before doing so, and the switch will be honoured from the first release that includes it.

7. Notifications

The optional daily study reminder is a local notification scheduled entirely on your device. There is no push service, no device token and no server that could send you anything, which is why reminders work in airplane mode. We cannot see whether a reminder fired or whether you acted on it.

The App never asks for notification permission on its own, and does not ask during onboarding. iOS will only prompt you if you deliberately set a reminder in Settings → Study reminder. You can turn it off there, or in iOS Settings, at any time.

8. What the App never does

• No advertising, ad networks or advertising identifiers (IDFA). The App presents no App Tracking Transparency prompt because it has nothing to track.
• No tracking across apps or websites, and no data brokers.
• No selling or sharing of personal information — including no “sale” or “sharing” as those terms are defined under the California Consumer Privacy Act.
• No profiling, scoring or automated decision-making about you as a person.
• No access to your camera, microphone, location, photos, contacts, calendar, health data or files. The App declares no such permissions at all.
• No social login and no SDKs from social networks.

9. Children

The App is a study aid for a professional certification and is not directed to children. It is rated 4+ only because it contains nothing objectionable, not because it is designed for young children. We do not knowingly collect personal information from anyone, including children under 13, because we do not collect personal information at all.

10. Your rights

Privacy laws including the GDPR, the UK GDPR and the CCPA give you rights to access, correct, delete and port your personal data, and to object to its processing.

We can honour these trivially, because we hold nothing: we have no personal data about you to disclose, correct, export or erase. Your study data is already entirely in your hands — it is on your device, and you can delete all of it from within the App.

For the purchase records held by Apple and RevenueCat, write to support@vishwenlabs.com. With the App Store transaction identifier from your receipt we can ask RevenueCat to delete the pseudonymous record associated with it. Requests are answered within 30 days. If you are in the EEA or UK you also have the right to lodge a complaint with your local supervisory authority.

11. Retention

Study data persists on your device until you reset it or delete the App; we impose no retention period on data we cannot see. RevenueCat retains purchase records for as long as needed to support entitlements and to meet Apple's and its own legal obligations, per its policy.

12. International transfers

Because no personal data of yours reaches us, there is no international transfer to describe on our side. Purchase validation is performed by RevenueCat on infrastructure in the United States, under the safeguards described in its privacy policy.

13. Security

Study data never travels, which removes most of the risk surface entirely. On device it is protected by iOS app sandboxing and by your device passcode and encryption. Purchase-validation traffic is encrypted in transit with TLS. No system is perfectly secure, but the strongest protection here is architectural: there is no central store of user data to breach.

14. Changes to this policy

If we change how the App handles information we will update this page and revise the effective date above. Material changes — in particular any that would begin collecting data we do not collect today — will also be reflected in the App Store privacy labels and the App's release notes before the change ships.

15. Contact

Questions about this policy, or about privacy generally: support@vishwenlabs.com. We aim to reply within two business days.