Privacy Policy — Cornerstone

Last updated: 27 October 2026

Cornerstone is a study app for CFA® and FRM® candidates, published by GroundLearn.

The short version

Cornerstone has no analytics, no crash reporting, no advertising and no social login. It works fully without an account, and nothing it stores about your studying leaves your device unless you ask it to.

Version 1.1 adds three things that use the network, and only three: an optional subscription, over-the-air updates, and an optional account that backs your progress up. All three are described in full below. If you create no account and never subscribe, the only outbound request the app makes is a check for a content update.

What the app stores on your device

All of the following is written to your device’s local application storage. Without an account it stays there, and creating one copies across only the study data identified in the section on backup below:

This data is removed when you uninstall the app or clear its storage from system settings. Without an account, nothing above is transmitted, so we cannot access, recover, export or delete it on your behalf.

Subscriptions

Cornerstone Plus is an optional subscription that opens the study segments added after the subscription launched. Everything the app contained before that stays free permanently, and anyone who had already installed the app keeps all of it permanently.

• Payment is taken by Google Play. We never see, receive or store your payment details. Billing, renewal and cancellation are handled entirely by Google under your Play account.
• RevenueCat (RevenueCat, Inc.) is used to check whether a subscription is active. When the app asks, it sends an anonymous identifier that RevenueCat itself generates for this installation, together with the purchase receipt Google issued and basic technical details such as the platform, app version and store country. It is not linked to a name, an email address or a Google account, and none of your study data is sent.
• If you never open the subscription screen and never subscribe, no purchase-related request is made at all.

Promotional codes take no payment and involve no third party. A code is checked against a list inside the app and grants access for a fixed number of days. Nothing is transmitted when you redeem one.

Accounts and progress backup

Creating an account is optional, and the app works exactly as it always has without one. Nothing in the app asks you to sign up, and no feature is withheld if you do not.

If you do create one, your study progress is copied to a database we run on Supabase so that it survives a reinstall or a new phone. What is copied is only what the table above lists as study data:

• your display name, if you set one, and which exam, level and pathway you are studying
• how far through each topic you are, and how many questions you have answered
• your review queue, bookmarks and the days you studied
• your app settings

What is never copied: your subscription status, any promotional code you have redeemed, and anything about your device. Subscription already moves between devices through your Google Play account, so it does not need to be here — and keeping it out means nobody can grant themselves paid access by editing their own record.

• Authentication is by email address and password, handled by Supabase. We store the address so you can sign back in; we never see your password. Addresses are not currently verified, so please type yours carefully — it is how you sign back in.
• Your data is locked to your account at the database level. Every table enforces that a row can only be read or written by the account that owns it.
• You can sign out at any time, which leaves everything on the device untouched.
• To delete your account and its backup, email the address below and it will be removed.

Backup is a best-effort copy rather than a live mirror: the app uploads when it can reach the server and carries on normally when it cannot.

Over-the-air updates

The app checks Expo’s update service (Expo, operated by 650 Industries, Inc.) for a newer version of its content and code. The request carries the app’s version, update channel and platform so that the right update is returned. No personal data and no study data is sent, and nothing about you is stored by that service.

This is what lets a content correction or a retired promotional code reach you in minutes rather than waiting for a store release.

Permissions

• Internet — used for the three purposes above, and for nothing else. Study content is bundled with the app and works fully offline.
• Notifications — requested only if you switch on the daily study reminder in Profile. It schedules a notification locally on your device; nothing is sent to a server. Declining it, or revoking it later in system settings, leaves the rest of the app fully functional.
• Billing — declared so that Google Play can present the subscription purchase sheet.

Third parties

Cornerstone contains no advertising SDKs, no analytics SDKs, no crash-reporting SDKs and no social login. The only third parties that receive anything are Google Play (for payment), RevenueCat (for entitlement checking), Expo’s update service (for updates) and — only if you create an account — Supabase (for the progress backup), each strictly as described above.

Children

Cornerstone is intended for adult candidates pursuing professional finance certifications. It is not directed at children.

Trademarks and affiliation

Cornerstone is an independent study aid. It is not affiliated with, authorised by, endorsed by or sponsored by CFA Institute or the Global Association of Risk Professionals.

CFA®, Chartered Financial Analyst® and GIPS® are registered trademarks owned by CFA Institute. FRM®, Financial Risk Manager® and GARP® are trademarks owned by the Global Association of Risk Professionals.

Contact

Questions about this policy: contactgroundlearn@gmail.com