Privacy Policy

• Your notes are yours. We process them only to build your study content.
• We don't sell your data, and we don't use your notes for advertising.
• AI processing is done through a third-party AI provider under terms that do not allow them to train models on your content via our API usage.
• Payments are handled by Stripe — your card details never touch our servers.
• You can delete your documents, study sets, or whole account at any time.

• Account information — name, email, and (for password accounts) a hashed password. We never store passwords in plain text.
• Your study materials — the documents, images, and text you upload, and the concepts, questions, flashcards, and maps derived from them.
• Study activity — answers, confidence ratings, mastery scores, streaks, session results, and tutor conversations. This is the data that powers your progress tracking.
• Billing information — your plan, subscription status, and AI-credit usage. Card details are collected and stored by Stripe, not by us.
• Technical basics — logs such as IP address and request metadata, used for security (for example, rate limiting) and debugging.

We do not collect precise location, contacts, or advertising identifiers.

To run the Service: extracting study content from your uploads, grading answers, tracking mastery, generating tutor responses, metering AI credits, processing subscriptions, keeping the Service secure, and responding to support requests. We do not sell personal information and we do not use your content for third-party advertising.

When your materials are processed, relevant text (and images, for handwriting transcription) is sent to our AI provider (currently OpenAI) to generate your study content, and tutor questions include excerpts of your materials as context. We use API terms under which the provider does not use this data to train its models. AI output can be inaccurate — see the Terms of Service for what that means for you.

We use a small set of infrastructure providers to run the Service, each processing data only to provide their service to us: hosting and serverless compute (Vercel), a managed Postgres database and authentication (Neon), file storage for uploads (Vercel Blob, stored under unguessable keys), AI processing (OpenAI), and payments (Stripe). We do not share your data with anyone else except when required by law or to protect the Service and its users.

Data is encrypted in transit (TLS) and at rest with our providers. Passwords are hashed with bcrypt. Every query is scoped to your account, uploads are stored under opaque keys, session cookies are signed, and the Service enforces rate limiting and other abuse protections. No system is perfectly secure, but if we learn of a breach affecting your data we will notify you as required by law.

Your content stays in your account until you delete it. Deleting a document or study set removes it and its derived content; deleting your account removes your personal data, uploads, and study history from our production systems, with residual copies in encrypted backups expiring on a rolling basis. Billing records are kept as long as accounting and tax law requires. To delete your account, use the account page or contact us at support@example.com.

You can access and edit your profile in Settings, export or delete your materials, and cancel your subscription anytime. Depending on where you live (for example, GDPR in the EU/UK or CCPA in California) you may have additional rights — access, correction, deletion, portability, and objection. Email us and we'll honor them.

The Service is not directed to children under 13 (or the applicable minimum age of digital consent), and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.

If we make material changes to this policy we will give notice in the app or by email before they take effect.

Privacy questions or requests: support@example.com.