Privacy Policy

Account information — When you sign up, we collect your email address and, if you sign in with Google, your name and profile photo. You can optionally add a display name, username, and bio.

Content you create — Study sets, flashcards, tutor sessions, quiz results, form responses, class information, and any other content you generate through the platform.

Usage data — Which features you use, when you use them, and how often. We use this to improve the product, not to profile you for advertising.

AI interaction logs — Messages sent to AI features (Study Buddy, Tutor, Quiz Battle opponent, Mock Trial) are processed by Anthropic and may be stored temporarily to provide the service and to detect misuse.

To provide the service — displaying your sets, processing AI requests, running quizzes, and maintaining your account.

To improve features — aggregated, anonymized usage patterns help us prioritize what to build next.

To send essential emails — account confirmations, magic links, and critical service notices. We do not send marketing emails without explicit opt-in.

We never sell your data. We have no advertising business. Your data is not monetized.

Supabase — Our database and authentication provider. Your data is stored in Supabase's cloud infrastructure (AWS, us-east-1).

Vercel — Our hosting provider. Handles HTTP requests and edge delivery.

Anthropic — Processes messages sent to AI features. See Anthropic's privacy policy for how they handle API data. We have zero-data-retention configuration where available.

Nobody else. We do not share data with advertisers, data brokers, or analytics platforms.

All data is encrypted in transit (TLS 1.2+) and at rest.

Row-level security policies in Supabase ensure that users can only access their own data — and only public data they're entitled to see.

We limit access to production systems to the minimum number of people necessary.

We don't store plaintext passwords — authentication is handled via Supabase Auth (magic links, OAuth).

Access — Download all your data via Settings → Privacy → Download my data.

Deletion — Delete your account via Settings → Privacy → Delete account. Your data is permanently removed after a 30-day grace period.

Correction — Update your profile, name, or username in Settings at any time.

Portability — The data export is in JSON format, machine-readable and portable.

Withdraw consent — Delete your account at any time. Withdrawal stops all future processing; historical data is removed after the 30-day window.

We use only essential cookies required for authentication (Supabase session cookies). These cannot be disabled without breaking the login flow.

We do not use advertising cookies, cross-site tracking pixels, or third-party analytics scripts (no Google Analytics, no Facebook Pixel).

Our servers are located in the United States. By using this service, you consent to your data being processed and stored in the US.

If you are in the European Economic Area (EEA), you have additional rights under GDPR. We process your data on the basis of contract performance (to provide the service you signed up for) and legitimate interest (security, abuse prevention). Contact us to exercise GDPR rights.

You must be at least 13 years old to use this service. We do not knowingly collect data from children under 13.

If you are a teacher whose students include children under 13, please contact us before using the platform — we do not currently have a COPPA-compliant offering for under-13 users. Class features are designed for secondary and higher education.

If we learn that we have collected data from a child under 13 without parental consent, we will promptly delete it.

We will email you at the address on your account before making significant changes to this policy, and will always post the current version here with the last-updated date.

Continued use of the service after changes take effect constitutes acceptance of the new policy.

Questions, requests, or concerns: brian07rt@gmail.com