Privacy Policy

This Policy covers personal information processed for Promptlyr’s website, mobile apps, and related study services. The operator is Promptlyr, the registered company operating the service in California, United States; contact promptlyr.ai@gmail.com for privacy questions and requests.

The information processed depends on the features you use. You can read these legal pages without creating an account. A school-specific signed agreement may separately define our role when processing information on a school’s instructions. Our ordinary consumer service is not represented as a school-managed service.

We receive information directly from you, from your device and use of the Service, from people you collaborate with, and from integrations or sign-in and payment providers you use.

• Account and profile: account ID, email, authentication records, names or profile images you or your sign-in provider supply, preferences, and onboarding answers. Optional study information can include school, major, year, interests, goals, current or target GPA, available study time, and learning preferences.
• Chats and generated work: prompts, messages, conversation history and titles, selected models, responses, writing-tool inputs and results, image-generation requests and outputs, and associated file references. Relevant previous content may be reused as context in later requests.
• Files, notes, and media: uploaded PDFs, documents, images, audio, file names and metadata, extracted text and transcripts, handwriting and ink strokes, annotations, note pages and folders, previews, generated media, and report files. Handwriting tools may send a writing sample or a selected page region for recognition or generation.
• Learning and planning: courses, syllabi, assignment details and deadlines, calendar events, grades exposed by an authorized connection, quizzes and flashcards, answers and scores, session durations, activity timestamps, streaks, mastery estimates, recommendations, and inferred study preferences or saved memories.
• Connections and collaboration: Canvas domain, integration tokens or private calendar-feed URLs, synchronization metadata, imported course records, note membership, invitations, and content shared with you. An installed extension may pass selected school content to Promptlyr.
• Billing and usage: Stripe customer and subscription IDs, plan and payment status, transaction references, billing periods, credit balances, feature usage and token counts. Legacy or available app-store entitlements may include product, transaction, and expiration information. Payment providers handle payment details; our app does not provide its own card-number storage form.
• Support and feedback: messages, bug descriptions, reproduction steps, category, account ID, platform, page path, and any information you choose to send. Authorized operators can review support submissions and files submitted for a report-review feature.
• Technical data: IP address, request and error logs, device/browser or app information available to the service, authentication and security events, and diagnostic or rate-limit information. Some logs can contain request details or file metadata.

When available and permitted by your device settings, you can capture a photo, select a file, or use voice input. Selected images and audio may be uploaded for AI analysis, transcription, storage, or generation of study materials. A device or browser speech-recognition service may also process voice input. Recording other people may require their permission.

If you choose to share location, the device may provide precise latitude and longitude and an accuracy value. The website’s location feature can save those coordinates with your profile and add location context to AI conversations while sharing remains enabled. A location you type can also be included in searches and prompts. Location is not necessarily limited to a city or general region.

You can decline optional permissions and use features that do not require them. Change device permissions in your operating-system or browser settings. Revoking a device permission prevents new access but does not by itself delete coordinates, recordings, or other information already saved. Use available app controls or contact us to withdraw location sharing or delete saved information.

We use account information to authenticate you and manage your account; your content and authorized school data to run requested features and synchronize work; study activity and memory to personalize explanations, planning, and recommendations; billing and usage information to provide entitlements and process payments; and technical and support information to troubleshoot, secure, maintain, and improve the Service.

We also use relevant information to prevent abuse, enforce our terms, investigate complaints, respond to privacy requests, comply with legal obligations, and establish or defend legal claims. We do not use personal information for advertising or sell it. Product personalization and feature-usage measurement are distinct from advertising.

Generated recommendations and inferred study information may be inaccurate. They help you study; they are not official grades or decisions about admission, employment, credit, or legal rights. You may correct underlying information or request deletion of relevant personalization data.

Using an AI feature sends the information needed for that feature to one or more providers. This can include your prompt, prior messages, attachments, extracted text, transcripts, selected note regions, study memories, course context, and location you have chosen to share. Comparing models sends relevant input to multiple providers. Supporting tasks such as titles, moderation, recognition, or fallback responses can use a provider other than the model selected in the interface.

Supported AI routes include OpenAI, Anthropic, Google, DeepSeek, xAI, Mistral, Together AI for some Meta models, AI21, Alibaba/Qwen, Perplexity, and Cohere; enabled routes depend on the feature and service configuration. Writing rewriting uses StealthGPT when available. Media generation can use Runware and its model providers. Search can use Google, Microsoft/Bing, or SerpApi when configured. YouTube transcript features retrieve content from YouTube-related services. A configured handwriting-generation service can receive sample images and text.

An AI feature is not private, on-device processing merely because it is shown inside the app. Provider logging, retention, safety review, model-training rules, and processing locations depend on the provider, endpoint, and contractual settings in use. We do not promise zero retention or a universal no-training rule across all providers. Contact us before submitting information that requires those guarantees. We remain responsible for our own legal duties when we disclose information.

Supabase provides authentication, databases, and related storage or synchronization. Cloudflare R2 stores uploaded and generated file assets where used. Our hosting infrastructure processes requests and operational logs; Redis caching and rate-limit infrastructure may store temporary service data. Stripe processes website payments. Apple and any other applicable app store handle their own store accounts, transactions, and platform services.

Authorized operators can access information needed for support, security, administration, and requested manual report review. A report-review workflow may require sharing the submitted file with the service used to produce that report; obtain clarification before submitting restricted material. Selecting a review feature does not make your document confidential from the person performing that review.

People you invite to a shared note can receive that content and collaboration information. External links, remotely hosted images, embeds, sign-in pages, and payment pages can send technical request information to their operators when loaded. Those operators also have their own privacy notices.

We may disclose information when required by law, to respond to valid legal process, to protect people and the Service, or to resolve fraud and rights disputes. Information may transfer in a lawful business sale or reorganization subject to applicable protections and required notice. A new operator does not receive permission to disregard this Policy.

Account data and saved work can be stored in cloud databases and object storage. Browser cookies, local storage, session storage, IndexedDB, and mobile app files can also retain sign-in state, preferences, chat or study caches, documents, note assets, previews, and offline changes. See Cookies & Device Storage for more detail.

Some unsynchronized edits may exist only on your device. Removing browser data, uninstalling the app, or switching devices can remove those copies before synchronization. Conversely, uninstalling or clearing local data does not delete cloud data. Exported files and copies shared with other people remain wherever you or the recipients saved them.

We retain account records and saved content as needed to provide the account and features you use, and address deletion requests as described below. Retention depends on the type of record, the feature, whether it is still needed for the purpose collected, and any applicable legal duty. Information is not automatically erased merely because you close a chat, sign out, disconnect Canvas, or cancel a plan.

Some history and report features are temporary and may remove older items. A feature’s expiry or removal from view is not a guarantee that every database record, file object, log, backup, or provider copy has been deleted at the same time. We do not promise universal seven-day deletion or permanent archival storage. Export important work and contact us for a deletion request rather than relying on an assumed automatic expiry.

After a valid deletion request, we remove or deidentify information as required by law, subject to necessary and lawful exceptions such as billing records, fraud prevention, disputes, or legal holds. Backups and provider-held copies may require separate deletion or expiry procedures. Any retained information remains subject to applicable privacy obligations and may not be kept indefinitely merely because it could be useful.

The personalization export’s lookback limit is not a retention limit for all activity records. If you believe a child under 13 has provided personal information, use the child-privacy request process described in Parents & Children.

Email promptlyr.ai@gmail.com to request access, a copy, correction, deletion, or information about processing. Use “Privacy request” in the subject and identify the account and request. You may contact us without signing in. Please do not attach sensitive documents or another person’s full records to the initial request.

We may reasonably verify identity or authority before releasing or deleting information. Authorized agents may act where applicable law permits. We will respond within the time required by applicable law and explain any lawful refusal, extension, or identity-verification need. Where available, you may appeal a refusal by replying with “Privacy appeal.” You may also complain to your local regulator and will not be unlawfully discriminated against for exercising your rights.

Available controls vary by app version. Account settings include an account-deletion action. The mobile Privacy Hub can export a study-profile snapshot and clear selected activity, memories, or personalization fields. That export is not a complete account export; clearing personalization does not delete all chats, files, assignments, or account records. For a broader request, email us.

Deleting a chat or memory does not necessarily remove facts saved independently in another feature. Deleting shared access does not retrieve recipients’ copies. Disconnecting Canvas removes the connection but leaves imported data unless separately deleted. If any deletion control fails, email us so the request can be completed.

Check subscription cancellation with the billing provider before deleting your account. A privacy request is not conditional on purchasing a plan or giving up your legal rights.

Promptlyr is intended for people ages 13 and older. Children under 13 may not create an account, use the Service, or submit personal information, even with parental permission or through an adult account. We do not offer accounts for children under 13.

A parent or guardian who believes a child has already submitted personal information should contact promptlyr.ai@gmail.com with the subject “Child privacy request.” We will address the request, verify authority as appropriate, and take steps required by law to stop unauthorized processing and remove information. Do not send the child’s school documents, voice recordings, or identity documents with the initial email.

Teenagers require appropriate parental permission and any additional consent or protections required where they live. The Parents & Children notice explains the minimum age and how parents can raise privacy concerns.

Depending on your location and whether a law applies to our activities, you may have rights to know what personal information is processed, access or receive a portable copy, correct or delete it, object to or restrict processing, withdraw consent, and opt out of certain profiling, targeted advertising, or sale/sharing. Some laws provide rights to limit certain uses of sensitive information and to appeal decisions.

For California residents, the categories described above include identifiers; commercial information; internet or electronic activity; education information; audio, visual, and other content; geolocation; and inferences about preferences and study behavior. Account access information, precise location, and some submitted content may be sensitive personal information. Sources, purposes, recipient categories, and retention criteria are described in this Policy. We do not sell personal information or share it for cross-context behavioral advertising, including information about minors. We use sensitive information to provide requested features and for necessary security and legal purposes, not to target ads.

Where European, UK, or similar data-protection law applies, processing necessary to provide an agreed service relies on performance of a contract; optional permissions and other processing requiring consent rely on valid consent; security, troubleshooting, and proportionate service improvement may rely on legitimate interests subject to your rights; and legally required records or disclosures rely on legal obligations. A child’s capacity to consent or contract must be assessed separately. Withdrawing consent does not affect processing already lawfully performed.

Use the contact above to exercise applicable rights or ask about an international transfer. You may complain to the data-protection authority where you live, work, or believe an infringement occurred. We do not represent that every regional privacy statute applies to every account.

Promptlyr and its providers may process information in countries other than where you live. Provider and model selection can affect the destination. We do not promise that all information stays in one country or that choosing a model selects a particular storage region.

Where law restricts international transfers, the appropriate lawful transfer basis and safeguards must apply. Contact us for information about the safeguards relevant to your data. These Terms and your ordinary use of the Service are not a blanket waiver of transfer requirements.

We use measures designed to protect information, including authentication, access controls, transport security where supported, and request validation. Security depends on service configuration and third-party infrastructure. No service is completely secure. We do not represent that all content is end-to-end encrypted or inaccessible to operators and processing providers.

Protect your device, account, shared links, and integration credentials. Report a suspected security issue to our contact address with enough information for us to investigate, without accessing other users’ data or sending live secrets. We will provide breach notices when required by law.

We will identify revisions to this Policy and provide appropriate notice of material changes. Where a new use requires consent, we will obtain it before that use. Contact promptlyr.ai@gmail.com for questions, complaints, or requests. This notice describes our current processing practices. Publishing an updated notice does not by itself authorize a new processing purpose or replace any required consent.