Privacy Notice
This notice explains how your personal data is handled, following the Data Privacy Act of 2012 (R.A. 10173).
What we collect. Your name, username, email address, sex, whether you're a government employee, exam level, and a secure scrambled copy of your password (never the password itself). As you study: progress, scores, notes and settings. If you use them: messages, shared files, profile photo, question reports, reports about other members, the members you block, and group-study activity (sessions and their recaps are deleted after 3 days). For payment: the last 6 digits of your payment reference number, the amount shown on your receipt, and the receipt screenshot if you upload one (the screenshot is read automatically to confirm the transfer, then kept only until the administrator checks it, usually the same day, and deleted). For security: the devices you sign in on.
Why. To run your account and sync your progress, to confirm payments, to let you study with friends, to reset your password by email, to keep accounts secure, and to improve questions. Usage is counted in totals only (for example, how many members practiced today); individual answers and messages are never included in those counts.
Who sees it. Friends and group-mates see your name, scores and topic mastery, never your password, email or individual answers. The administrator can see account details and payment proofs to manage the site. Your data is not sold or shared with advertisers. Kaya's smart answers may send your question (not your name or account) to an AI service, Google Gemini or Anthropic Claude, which writes the answer for us under its terms for business use; we don't send them your profile, messages or progress. In Group Study Live, the host or a coach may record a session (the screen, voices and their camera); everyone sees a REC sign while it records. Recordings go straight to the recorder's own Google Drive or device and are not stored by ReviewTayo. Voice and video calls go directly between the two devices, or through a relay server when a direct connection isn't possible; ReviewTayo doesn't record or keep them.
Reporting and blocking. You can report a member or one of their messages from their profile or the message's menu, and block them. A report sends the administrator the reason, your note and a copy of the reported message so it can be checked; the member isn't told who reported them. Blocking stops messages, calls, friend requests and study invites between you, and hides their group-chat messages from you.
How long. Your data is kept while your account exists. Shared chat files expire automatically. When you delete your account in Settings, your progress, messages, files and payment records are removed; copies in the site's private backups are replaced as backups rotate. Backups are kept on the server and in the site owner's private Google Drive (hourly, with daily copies for a week and monthly copies for a few months), and are used only to recover the site if its data is lost. Google accounts. If you connect Google Drive (to save Group Study Live recordings, or the owner's backups), ReviewTayo only creates, reads and deletes the files it saves there, uses your Google email address only to show which account is connected, and never shares this data or uses it for anything else.
The ReviewTayo Android app. The app opens this website and keeps the same data. With your permission it uses the camera and microphone only for voice and video calls and Group Study Live, and notifications for study reminders, messages and incoming calls; reminders are scheduled on your phone. To ring your phone for a call when the app is closed, the app gets a notification token from Google Firebase, which we keep with your account until you sign out or delete it. A call keeps running in the background with a notification you can use to end it. If you sign in with Google, we receive your Google account ID, name and email address. If you buy full access in the app, Google Play handles the payment: we receive only the order number and a purchase token to confirm it, never your card or Google Play account details.
Deleting your account. In the website or the app, open Settings › Account › Delete account and confirm with your password (accounts made with Google type the username instead). This removes your account, synced progress, messages, files and payment records right away. If you can't sign in or don't have the app, ask for deletion on the Delete your account page: we confirm it's you through your account's email, then delete the same data within 7 days.
Your rights. You can see and correct your details in Settings, download your progress, or delete your account at any time. You may also ask the administrator about your data, object to its processing, or file a complaint with the National Privacy Commission.