Privacy Policy

1. Plain-English summary

We built StudentVision because students deserve software that doesn't surveil them. We collect the minimum data needed to make the app work, never sell it, never run ads against it, and let you delete it whenever you want. The legalese below explains all of this in detail — but that's the deal.

2. Who this policy applies to

This policy covers everyone who uses StudentVision — through our website, web app, mobile apps, or any other surface we publish. "We", "us", and "StudentVision" mean the team operating studentvision.app. "You" means the person using the service.

3. Information we collect

• Account info: email address, display name, optional school, and an optional avatar or profile background you upload.
• Academic content you create: tasks, notes, study plans, focus sessions, grades you log, goals, and messages you send in chat.
• Canvas data: only when you explicitly connect Canvas — assignments, due dates, and grades synced from your Canvas account using a token you provide.
• Authentication metadata: hashed passwords (we never see the plaintext), session tokens, sign-in timestamps and IP for fraud-prevention.
• Device & usage data: browser, OS, screen size, and anonymized counts of feature usage so we can fix bugs and improve the product. When you sign up, we also record how you found us: the campaign tags on the link you followed, the website that sent you (its name only, not the full address) and any referral code. We do not use third-party advertising trackers.
• Crash & error reports: if the app errors out while you're using it, we log the error message, a technical stack trace, and the page it happened on, tied to your account, so we can diagnose and fix it.
• Payment metadata: if you subscribe to Pro, our payment processor (Stripe) handles your card details directly — we only ever receive your subscription status, plan name, and billing dates. We never receive or store any part of your card number.

4. How we use information

We use the information above strictly to operate, secure, and improve StudentVision. Specifically:

• Render your dashboard, sync your work across devices, and generate AI study aids you request.
• Send transactional emails (verification codes, security alerts, billing receipts).
• Detect abuse — spam, harassment, scraping, or credential stuffing.
• Aggregate, anonymized analytics to understand which features help students most.

We do not use your data to train AI models, target ads, profile you for marketing, or sell to data brokers.

5. AI processing & StudyAI

When you use StudyAI, the prompt you write — plus any context you pin or images you upload — is sent to Google's Gemini API to generate the answer. We don't store your StudyAI chats on our servers; they stay in your browser. We currently use Google's standard Gemini API tier, under which Google may use prompts and responses to improve its products, and Google's reviewers may read them. Please don't put personal information (like your address, phone number, or passwords) into StudyAI.

StudyAI is an AI, not a person, and it can be wrong. We tune it to admit uncertainty rather than guess, but you should always verify important academic facts with your teacher or textbook. It's also instructed to point anyone in crisis to real help (like the 988 Suicide & Crisis Lifeline) and to coach rather than write work you'll hand in.

6. Sharing & sub-processors

We share data only with the providers we need to operate the service:

• Hosting & database: Supabase (PostgreSQL, auth, storage) on AWS infrastructure.
• AI inference: Google (Gemini API). See section 5 for how Google may use StudyAI prompts.
• Email delivery: Supabase sends verification and password-reset emails.
• Payments: Stripe processes Pro subscription payments.
• Error monitoring: when the app crashes or hits an error, we log what happened (the error message, a technical stack trace, and the page it occurred on) so we can fix it — this is linked to your account, viewable only by our admins, and used solely for debugging.

We never sell, rent, trade, or share personal data with advertisers, data brokers, or third parties for their own marketing.

7. Where data is stored

Data is stored in the United States by default. EU and UK users' data may transit through US-based providers — we rely on Standard Contractual Clauses and supplementary safeguards consistent with current Schrems II guidance.

8. Retention & deletion

We keep your data only as long as your account is active or as needed to provide the service. When you delete your account, we erase your personal data within 30 days, except where law requires us to keep records (e.g. billing records — typically 7 years). Anonymized usage stats may be retained indefinitely.

9. Security

• TLS 1.3 for all traffic between your device and our servers.
• AES-256 encryption at rest for the database and file storage.
• Canvas access tokens stored in an encrypted vault that only our sync service can read.
• Messages are encrypted in transit and at rest, but not end-to-end: our servers check messages involving students under 18 for threats and personal information, and our team may review reported content.
• Row-level security on every database table — accounts cannot see each other's data.
• Admin tools are limited to staff accounts and checked on our servers.
• Automated tests and checks run on every change before it goes live.

No system is perfectly secure. If you discover a vulnerability, please email security@studentvision.app. We respond within 72 hours and credit researchers in our hall of fame.

10. Your rights & choices

Regardless of where you live, you can:

• Access a copy of the data we hold about you (Profile → Export Data).
• Correct inaccurate information at any time from Profile.
• Delete your account and all associated personal data (Profile → Delete Account).
• Restrict or object to certain processing.
• Portability: download your data as JSON.
• Withdraw consent for optional processing (e.g. email updates).

To exercise any of these rights, use the in-app controls or email privacy@studentvision.app. We respond within 30 days.

11. Children & teens

Age check: everyone gives their date of birth when they sign up (or the first time they sign in, for older accounts). We use it only to apply the protections below; it is never shown on your profile.

Under 13: StudentVision needs a parent or guardian's permission before a child under 13 can use it. If you sign up with email and are under 13, no account is created and nothing you typed is saved. If an account was already created (for example by signing in with Google), it is paused: nothing else in the app loads or is saved, and we keep only the date of birth, the account's sign-in email and, if the child gives it, a parent's email so we can contact them about approval. If a parent doesn't approve within 30 days, the account and its information are permanently deleted. If you believe a child under 13 is using StudentVision without permission, email us and we'll delete the account.

Ages 13–17: if you are a minor, you confirm a parent or guardian agrees to this policy and the Terms. VisionChat has extra protections for students under 18: direct messages and calls only with accepted friends, no suggestions of people you don't know (others can find you only by your exact username), no school-wide or grade-wide feeds, and phone numbers, email addresses and home addresses are blocked in chats and posts. Messages are checked automatically for threats and personal information, and anything flagged may be reviewed by our team. Parents may request access to or deletion of their child's data by emailing privacy@studentvision.app.

A plain-language summary of these protections is on our Safety page.

12. Schools, FERPA & education records

StudentVision is a consumer product students sign up for individually. We are not a "school official" under FERPA and do not receive education records from schools. If your school deploys StudentVision under a formal agreement, that agreement governs — contact schools@studentvision.app for our Data Processing Addendum and Student Data Privacy Pledge commitments.

13. International users

EU / UK (GDPR): the legal bases we rely on are (a) contractual necessity to deliver the service you signed up for, (b) legitimate interests in keeping the service secure and useful, and (c) your consent for optional things like marketing emails. You may lodge a complaint with your local supervisory authority.

California (CCPA / CPRA): we do not "sell" or "share" personal information as defined by the CCPA. You have rights to know, delete, correct, and opt out of any future sale (though we have no plans to sell). Submit requests via privacy@studentvision.app.

14. Cookies & tracking

We use only first-party cookies strictly necessary to keep you signed in and to remember your preferences (theme, sidebar state). We do not use third-party advertising cookies, fingerprinting, or cross-site tracking pixels.

15. Payments

Pro subscriptions are processed by Stripe, our payment processor. Stripe handles card data and PCI compliance. StudentVision never sees your full card number. Stripe's privacy practices are governed by stripe.com/privacy.

16. Changes to this policy

If we make material changes, we'll notify you in the app and by email at least 14 days before they take effect. The "Version" and "Effective" date at the top will always reflect the current revision.

17. Contact us

Privacy questions: privacy@studentvision.app

Security reports: security@studentvision.app

Schools & districts: schools@studentvision.app