Privacy Policy

1. Information We Collect

Account information: first name, last name, and email address when you sign up, and your password (hashed by our authentication provider, Supabase — we never see or store it in plain text).

Content you upload: course material and other files you upload to generate flashcards, quizzes, study plans, and practice-chat sessions, along with the AI-generated output and your practice-chat conversation history.

Voice input: if you use the practice-chat "explain it out loud" feature, your spoken answer is converted to text by your browser's built-in speech-recognition feature (e.g., Chrome's Web Speech API) rather than a service we operate. In Chrome, this sends your audio to Google for transcription; we never receive or store the audio itself, only the resulting text, which is processed the same as any other practice-chat message.

Payment information: if you purchase credits, payment is handled entirely by Stripe, our payment processor. We receive confirmation that a payment succeeded and metadata about the purchase (amount, credit pack, timestamp) — we do not receive or store your full card number.

Usage and device information:standard technical data such as IP address, browser type, and error reports (including stack traces) sent automatically when the app encounters an unexpected error, used solely for debugging and reliability.

Bot-protection signals: when you log in or sign up, Cloudflare Turnstile analyzes limited technical signals (not tracking cookies) to confirm you are not a bot, as described in Cloudflare's Privacy Policy.

Schoology integration (optional): if you choose to connect your Schoology account, we store the personal API key/secret you generate from Schoology, with the secret encrypted at rest. We use it to pull your section names and assignment titles, descriptions, due dates, points, and item type from Schoology's API so we can show your upcoming assignments and let you generate flashcards from an assignment's description. Disconnecting Schoology from the integrations page permanently deletes the stored key/secret and all synced assignment data.

2. How We Use Information

• To create and maintain your account and authenticate you;
• To process your uploaded content through our AI provider (OpenAI) and generate study materials and practice-chat responses;
• To process credit purchases and maintain your credit balance;
• To prevent fraud and abuse (e.g., disposable-email and duplicate-account detection, rate limiting, bot detection);
• To diagnose and fix errors and improve reliability; and
• To communicate with you about your account, transactions, or material changes to our Service or policies.

We do not use your uploaded content or account data to train AI models, and we do not sell or share your personal information for cross-context behavioral advertising.

3. Who We Share Information With

We share information only with the service providers necessary to operate the Service, each acting as a processor on our behalf under their own security and privacy commitments:

• Supabase — database, authentication, and file storage;
• OpenAI — processes the text of your uploaded material to generate flashcards, quizzes, study plans, and practice-chat responses;
• Stripe — payment processing for credit purchases;
• Cloudflare — bot/abuse protection on login and signup;
• Schoology — only if you choose to connect your account, to retrieve your assignment data as described above;
• Your browser's speech-recognition provider (e.g. Google, via Chrome) — only if you use the practice-chat voice feature; your browser sends the audio directly to its own transcription provider, not to us, and we receive only the resulting text;
• GitHub — when the app encounters an unhandled error, the error message, stack trace, and the page path (not your account or content data) are sent to a private repository we use for debugging.

We do not share your personal information with third parties for their own marketing purposes. We may disclose information if required by law, to enforce our Terms of Service, or to protect the rights, property, or safety of Vocalized, our users, or others.

4. Cookies

We use only strictly necessary cookies: authentication session cookies (set by Supabase) that keep you signed in, and a cookie set by Cloudflare Turnstile for bot protection during login/signup. We do not use advertising or analytics tracking cookies. See our Cookie Policy for details. If we add analytics or advertising cookies in the future, we will update this policy and request consent where required.

5. Data Retention

We retain your account data, uploaded content, and generated study materials for as long as your account is active. If you delete an upload, its file and associated generated materials are removed from our storage and database. If you delete your account, we delete or anonymize your personal data within a reasonable period, except where we are required to retain certain records (e.g., payment records) for legal or accounting purposes.

6. Your Rights

Depending on where you live — including under the EU/UK GDPR and the California Consumer Privacy Act (CCPA/CPRA) — you may have the right to:

• Access, correct, or delete the personal information we hold about you;
• Export a copy of your data (data portability);
• Object to or restrict certain processing;
• Withdraw consent where processing is based on consent; and
• Not be discriminated against for exercising these rights (CCPA).

You can access, update, or delete most of your data directly from account settings. For anything else, or to exercise these rights, contact us at alialtalqani0@gmail.com. We will verify your request and respond within the time required by applicable law.

7. Children's Privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact us at alialtalqani0@gmail.com and we will delete it.

8. For School and District Users (FERPA / SOPIPA)

If a school or school district formally authorizes or procures the Service for use by its students, we act as a "school official" with a legitimate educational interest in the resulting education records, consistent with the exception in the Family Educational Rights and Privacy Act (FERPA, 20 U.S.C. § 1232g; 34 CFR § 99.31(a)(1)(i)(B)). In that context:

• We use student data only to provide, maintain, and improve the Service for that school's students, and for no other commercial purpose;
• We do not sell student personal information and do not use it to build a profile for advertising or marketing, consistent with California's Student Online Personal Information Protection Act (SOPIPA, Cal. Bus. & Prof. Code § 22584);
• We will delete or de-identify student data at the school's request, or when the underlying account is deleted, subject to the retention terms in Section 5; and
• We will execute a district or state student data privacy agreement (e.g., a National Data Privacy Agreement) governing our handling of student data upon request from an authorizing school or district.

Outside of a formal school authorization, a student who signs up for the Service directly, on their own account and not through a school-issued or school-directed process, is using it as an individual consumer, and the practices in Sections 1–7 above apply.

9. International Transfers

Our service providers may process and store information in countries other than your own, including the United States. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for transfers of personal data from the EEA, UK, or Switzerland.

10. Security

We use reasonable technical and organizational measures to protect your information, including encrypted connections (HTTPS), database row-level security so users can only access their own data, hashed passwords, and rate limiting on sensitive endpoints. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email or an in-app notice before they take effect.

12. Contact Us

Questions about this Privacy Policy or your data can be sent to alialtalqani0@gmail.com.