Privacy Policy

1. Information We Collect

Account information: first name, last name, and email address when you sign up, and your password (stored in hashed form by our authentication provider, Supabase — we never see or store it in plain text).

Content you upload: course material and other files you upload to generate flashcards, quizzes, study plans, and practice-chat sessions, along with the AI-generated Output and your practice-chat conversation history.

Payment information: if you purchase credits, payment is handled entirely by Stripe, our payment processor. We receive confirmation that a payment succeeded and metadata about the purchase (amount, credit pack, timestamp) — we do not receive or store your full card number.

Usage and device information:standard technical data such as IP address, browser type, and error reports (including stack traces) sent automatically when the app encounters an unexpected error, used solely for debugging and reliability.

Bot-protection signals: when you log in or sign up, Cloudflare Turnstile analyzes limited technical signals (not tracking cookies) to confirm you are not a bot, as described in Cloudflare's Privacy Policy.

2. How We Use Information

• To create and maintain your account and authenticate you;
• To process your uploaded content through our AI provider (Anthropic) and generate study materials and practice-chat responses;
• To process credit purchases and maintain your credit balance;
• To prevent fraud and abuse (e.g., disposable-email and duplicate-account detection, rate limiting, bot detection);
• To diagnose and fix errors and improve reliability; and
• To communicate with you about your account, transactions, or material changes to our Service or policies.

We do not use your uploaded content or account data to train AI models, and we do not sell your personal information.

3. Who We Share Information With

We share information only with the service providers necessary to operate the Service, each acting as a processor on our behalf under their own security and privacy commitments:

• Supabase — database, authentication, and file storage;
• Anthropic — processes the text of your uploaded material to generate flashcards, quizzes, study plans, and practice-chat responses;
• Stripe — payment processing for credit purchases;
• Cloudflare — bot/abuse protection on login and signup.

We do not share your personal information with third parties for their own marketing purposes. We may disclose information if required by law, to enforce our Terms of Service, or to protect the rights, property, or safety of Vocalize.ai, our users, or others.

4. Cookies

We use only strictly-necessary cookies: authentication session cookies (set by Supabase) that keep you signed in, and a cookie set by Cloudflare Turnstile for bot protection during login/signup. We do not use advertising or analytics tracking cookies. See our Cookie Policy for details. If we add analytics or advertising cookies in the future, we will update this policy and request consent where required.

5. Data Retention

We retain your account data, uploaded content, and generated study materials for as long as your account is active. If you delete an upload, its file and associated generated materials are removed from our storage and database. If you delete your account, we delete or anonymize your personal data within a reasonable period, except where we are required to retain certain records (e.g., payment records) for legal or accounting purposes.

6. Your Rights

Depending on where you live (including under the EU/UK GDPR and the California Consumer Privacy Act (CCPA/CPRA)), you may have the right to:

• Access, correct, or delete the personal information we hold about you;
• Export a copy of your data (data portability);
• Object to or restrict certain processing;
• Withdraw consent where processing is based on consent; and
• Not be discriminated against for exercising these rights (CCPA).

You can access, update, or delete most of your data directly from account settings. For anything else, or to exercise these rights, contact us at [CONTACT_EMAIL]. We will verify your request and respond within the time required by applicable law.

7. Children's Privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact us at [CONTACT_EMAIL] and we will delete it.

8. International Transfers

Our service providers may process and store information in countries other than your own, including the United States. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for transfers of personal data from the EEA, UK, or Switzerland.

9. Security

We use reasonable technical and organizational measures to protect your information, including encrypted connections (HTTPS), database row-level-security so users can only access their own data, hashed passwords, and rate limiting on sensitive endpoints. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email or an in-app notice before they take effect.

11. Contact Us

Questions about this Privacy Policy or your data can be sent to [CONTACT_EMAIL] or [BUSINESS_ADDRESS].