Privacy Policy

1. Information we collect

Account information

When you continue with Google, we receive the stable Google Account identifier (sub), verified email address, display name, and optional profile image included in the verified Google ID token. We do not receive your Google password.

Learning content

We store extracted source text, source references, generated courses, quiz attempts, and Tutor conversation turns so the service can provide your course library, progress, and contextual follow-ups.

Technical information

Essential session and CSRF cookies are used to authenticate requests and prevent cross-site request forgery. Infrastructure may process standard request metadata and security logs.

2. What is not retained by the application database

• The uploaded PDF binary is read for extraction but is not stored by the application database.
• Pencil canvas images are processed for feedback but are not stored by the application database.
• Google passwords and Google access tokens are never requested.

Hosting, proxy, or model-provider logs may have separate short-lived operational retention that must be documented in the final subprocessor list.

3. How we use information

• Authenticate your account and maintain essential sessions.
• Extract and structure material into a private course.
• Generate slides, explanations, quizzes, Tutor answers, and Pencil feedback.
• Display your course library and learning progress.
• Protect the service, debug failures, and comply with applicable law.

4. AI processing and service providers

Course generation and feedback may send the relevant source, lesson context, question, or Pencil image to the AI model provider configured for the deployment. Google Identity Services verifies login. Hosting and database providers process data to operate the service. The final production policy must name each provider, purpose, processing location, and retention commitment before public launch.

5. Retention and deletion

Account information, extracted sources, courses, quiz attempts, and Tutor turns are retained while your account remains active. Account sessions expire after 30 days unless revoked earlier. You can export your current application data or permanently delete your account and associated courses from My Class. Backup deletion timing must be added after the production backup system is selected.

6. Cookies

SY Class uses only essential account-session, CSRF, login-CSRF, and private-course access cookies. These cookies are required for authentication and request security, not advertising.

7. Sharing

We do not sell personal information. Information is disclosed only to service providers needed to operate SY Class, when you direct us, or when required by law. Public sharing of a course is not enabled by default.

8. Your choices and rights

From My Class you can export account and course data, sign out, or permanently delete the account. Depending on your jurisdiction, additional access, correction, objection, restriction, portability, or complaint rights may apply. A verified privacy-request channel must be published before launch.

9. Security

SY Class verifies Google ID token signature, audience, issuer, expiry, and verified email status. Application sessions use random tokens, store only HMAC verifiers, use HttpOnly and SameSite cookies, and require CSRF verification for account mutations. No system can guarantee absolute security.

10. Children and international use

The current self-service product is not designed for children below the digital-consent age applicable in their location. A final age policy, operator jurisdiction, cross-border transfer mechanism, and regional disclosures must be set before public launch.

11. Contact and changes

Human Gate: the operator’s legal name, physical or registered address, privacy contact, and complaint route are not yet configured and must be published before external production use. Material changes will be posted with a revised effective date.