← Socrates AI

Socrates AI — Privacy Policy (DRAFT)

This is a working draft, not an attorney-reviewed or legally finalized policy. It is written to be technically accurate to the current product as of this revision — every product/technical claim below was verified directly against the current codebase, and, this revision, against each listed service provider's own current public terms (cited inline in §7/§11). This revision changes the scope: Socrates AI is offered to students in Egypt and internationally (see §1–§2), and Egypt's Personal Data Protection Law is now the primary framework. No attorney has reviewed this policy — this is a deliberate, informed decision by the operator to publish on a best-effort basis rather than delay launch for formal legal review. Real compliance risk remains, most materially around guardian consent for minors (§14) and transfers of data out of Egypt (§20) — both are documented as known, unresolved gaps rather than glossed over. Every section that previously carried a [LEGAL REVIEW REQUIRED] marker has been resolved with a real position this revision (either a scoping decision, a directly-sourced provider fact, or an honest statement of an unconfirmed fact) — none of those bracket markers remain in the document. That does not mean this policy is legally certified; it means every open question has a real, stated answer instead of a placeholder, and the operator has accepted the risk of not having those answers reviewed by counsel.

Last technical review: 9 October 2026 (latest). Effective date: not yet published.

⚠ Revision history, most recent first:

1. Introduction

Socrates AI is a study application that helps students turn homework, photos, and documents into flashcards, quizzes, and tutoring conversations, and tracks study activity (notes, flashcards, quizzes, streaks, and related study-progress indicators) to help students study more effectively. Socrates AI also publishes a set of free, original study-guide articles that anyone can read without an account (see §15 for why this matters for advertising). This policy explains what information we collect, how it's used, who we share it with, and the choices available to you.

Socrates AI is offered to students in Egypt and internationally. The team is based in Egypt and sells paid plans in Egyptian pounds, so the primary legal framework this policy is written against is Egypt's Personal Data Protection Law (Law No. 151 of 2020, "PDPL"). Because students elsewhere use the app too, we also describe how we handle obligations under the U.S. Children's Online Privacy Protection Act (COPPA) for U.S. children under 13 (§14), and we honor GDPR-style rights (access, correction, deletion, objection and portability) for any user who asks, wherever they live (§21). This scoping decision has not been reviewed by an attorney — see the notice at the top of this document — and the known gaps it creates are disclosed in §14 and §20 rather than glossed over.

2. Who We Are / Data Controller

Socrates AI is an independent, unincorporated project. It is built and operated by a small team of individuals — referred to throughout this policy as "the Socrates AI team," not by the names of any individual — and is not operated by a registered company, corporation, LLC, or any other legal entity in any jurisdiction. There is no separate legal person that owns or controls Socrates AI at this time; the team members operating it are the ones responsible for it. If that changes in the future (e.g. the project is incorporated), this section will be updated to name the entity and its jurisdiction of incorporation.

Contact information for privacy questions: support@socratesai.app. This is our general contact address — there is no separate, privacy-only inbox at this time, so a privacy question sent here reaches the same team that handles general support. You can also reach us through the contact form at /contact on our website — both routes deliver to the same inbox, so use whichever is more convenient.

Where this policy refers to "our website," "this app," or gives a canonical URL, that means https://www.socratesai.app — our permanent domain.

Geographic scope: Socrates AI is intended for students in Egypt and internationally. The website is not geo-blocked. The team is based in Egypt.

3. Information We Collect

We collect information in three ways: information you give us directly, information generated by your use of the study features, and information collected automatically about how you use the app. The sections below break this down by category.

4. Information You Provide

5. Information Collected Automatically

6. How We Use Personal Information

We use the information above to:

Why we're allowed to use it (legal basis):

Egypt's PDPL generally expects consent for processing personal data, with exceptions that include performing a contract with you and complying with the law. We have not had an attorney confirm that each use above fits a PDPL basis; this mapping is the operator's own good-faith reading.

7. AI Tutor and AI Processing

When you send a message to the AI tutor, or upload material for flashcard/quiz/mind-map generation, that content is sent to a third-party AI provider to generate a response. Which provider and model handles a given request depends on your subscription tier and Socrates AI's internal routing logic at the time of the request — this can change as we add, remove, or reprioritize providers, and is not something we commit to keeping fixed.

The providers currently integrated (as of this revision) are:

Cerebras was previously listed as a provider candidate and has since been fully removed from the app — it is not integrated today, and any reference to it elsewhere should be treated as stale.

Provider data-use facts, checked directly against each provider's own current public terms this revision:

We still do not independently guarantee any provider's practices beyond what's quoted above — provider terms can change, and this is a snapshot as of this revision, not a live-monitored commitment. If you have sensitive concerns about a specific provider, review that provider's own current terms directly.

Do not enter information you would not want processed by a third-party AI system — including anyone else's personal information, or highly sensitive personal details unrelated to your studies.

8. Uploaded Files, Photos, PDFs, and Study Materials

You can upload homework photos, PDFs, and (in some flows) PowerPoint files to generate flashcards, quizzes, or a milestone breakdown, and you can separately save files to your Study Binder for long-term storage and citation.

We recommend avoiding uploads containing anyone else's personal information, or sensitive information beyond what's needed for your studies.

9. Study Activity, Personalization, Gamification, and Recommendations

We calculate and display study-progress indicators — including XP, streaks, levels, mastery/"Brain Power" indicators, and similar — based on your study activity (time studied, quiz accuracy, flashcard review outcomes, and similar signals described in §5). These are computed to show you your own progress and to power in-app recommendations (e.g. which topics to review). These indicators don't affect pricing, eligibility, or any decision outside of what's shown back to you, so they are not automated decisions with legal or similarly significant effects on you (the kind that data-protection laws such as the PDPL and GDPR treat specially). This is the operator's own good-faith reading, not a determination made by an attorney.

Season Pass, XP and Laurels. To run the Season Pass we keep, for your account: a record of each XP or Laurel award or purchase (what it was for, the amount and the date), your XP for the current season, your Laurel balance, the titles and frames you own and which ones you've chosen to show, and whether a recently broken streak can still be repaired. All of it is calculated from the study activity described above (study time, flashcard reviews, quizzes, homework checks, streaks); we don't collect anything new to run it. Whether you get the premium track depends only on your plan. This record is visible only to you, is not included in the study report a parent or teacher can see, is not used for advertising, and is deleted with your account (§18).

10. How We Share Information

We share information only in the following circumstances:

We do not sell personal information. See §15 for the current, accurate state of advertising — real ad-integration code exists, but as of this revision no advertisement has actually been shown to any user.

11. AI Providers and Other Service Providers

See §7 for AI providers. Non-AI service providers currently integrated, with DPA status checked directly against each provider's own current public terms this revision:

If you enable push notifications, your browser vendor's own push-delivery infrastructure is also involved, as described in §5 — that's governed by your browser vendor's own terms, not a service we separately contract with.

12. Payments and Subscriptions

Paid plans are sold as one-time Study Passes in Egyptian pounds (see our Terms of Service §5). Whether a payment method is open at a given time is shown at checkout; when it isn't, nothing is charged and nothing below is sent.

What our payment partners receive:

What we store for each purchase: the plan, term and number of days, the amount and currency, which payment partner was used, the partner's payment reference, the purchase status, and when it was paid and when the pass ends. This is payment metadata, not card data. We use it to activate your pass, handle refunds and disputes (Return & Refund Policy), and keep accounting records. It is deleted with your account (§18).

Refunds: if we refund a card payment, Paymob processes it back to your card. If we refund a historical Fawry cash payment, we ask for bank, InstaPay or mobile-wallet details in the name of the account holder or their guardian, and use them only to send that refund.

Stripe: code for Stripe card subscriptions exists but is switched off, and no payment goes through Stripe today. If it's ever turned on, we'll update this section first.

13. Cookies, Analytics, and Similar Technologies

We do not use cookies for authentication. Sign-in is handled via a token stored in your browser's local storage, not a cookie.

We use three analytics tools.

For shared flashcard links, our own database also counts page views, completed practice runs and signed-in save requests. These records contain the internal share ID, event name and time; only a signed-in save includes the visitor's account ID. They contain no card text, IP address or user agent. A signed-in save can also produce a PostHog event under the account's existing analytics consent settings.

Cloudflare Web Analytics measures page views and page-load performance. It is cookieless: it sets no cookies and stores nothing in your browser, and it does not identify you or your account. It runs for every visitor, including minor accounts, since it collects no personal profile.

PostHog (product analytics and session recording, U.S. cloud, us.i.posthog.com) shows us how the app is used so we can improve it. What it does, exactly as the code (services/analytics.ts) configures it:

We also use Google Analytics (GA4), a third-party analytics tool — real, standard gtag.js page-view/session tracking. Google Analytics, as currently integrated, has none of the restrictions above: it loads and records activity for every visitor, on every page, regardless of account type — including an under-13 account before it is deleted. This is a known, disclosed limitation of the current integration, not an oversight; we are stating it plainly rather than implying protections that don't exist. Google Analytics sets two first-party-appearing cookies that are actually set by Google (_ga and a property-specific _ga_... cookie, ~2-year duration) to distinguish visitors and persist session state — see our Cookie Policy for the exact names. We do not use any advertising/marketing pixel tool separately from this (no Meta pixel, no attribution/marketing scripts), and error/performance logs (page-performance metrics and error reports) still go only to our own server logs, with message/homework content deliberately excluded from those, from Google Analytics, and from PostHog.

If real display advertising is ever turned on (see §15), Google's advertising infrastructure would set its own cookies or similar technologies on the public study-guide pages specifically — never inside the authenticated study app — subject to a real consent mechanism we have not yet built. As of this revision, no such cookie has ever actually been set, because no ad has ever actually been shown — see §15 for exactly why.

Fonts are served from our own servers. An earlier version of this policy said our sign-up page loaded fonts from Google Fonts; the app now serves its own copies of those fonts, so opening the app sends no request to Google for them.

For the full real inventory of every cookie and browser-storage entry we set, see our Cookie Policy.

14. Children's and Minors' Privacy

Socrates AI is for students aged 13 and over. Two child-privacy rules matter most for our users: Egypt's PDPL, which treats anyone under 18 as a child and generally requires a guardian's consent to process a child's personal data, and the U.S. COPPA, which applies to children under 13. This section says exactly what the app does and names the gap that remains.

How sign-up works:

Known, unresolved gap (students aged 13–17, Egypt): Egypt's PDPL generally requires a guardian's consent for anyone under 18. We rely on the student's confirmation that their school or legal guardian has authorized them. A student ticking a box is not itself proof of a guardian's consent. Where a school provides Socrates AI to its students, obtaining any consent it needs from parents or guardians is the school's responsibility; we have not verified that for any school. Our Terms of Service also ask students under 18 to get a parent's or guardian's permission before buying a Study Pass. A parent or guardian can contact us at any time to review, correct or delete their child's data.

COPPA (U.S.): because Socrates AI does not allow accounts for children under 13, we don't ask for or record parental consent under COPPA. The earlier email-link consent step (which we had disclosed did not meet COPPA's "verifiable parental consent" standard) has been removed, and any account found to belong to a child under 13 is blocked and deleted as described above.

We do not currently show any advertising to any user, including minors — real ad-integration code exists (§15), but as of this revision no ad has actually rendered anywhere, so there is currently no behavioral-advertising exposure for minor accounts to describe. Study-progress/gamification features (§9) apply the same way to minor and standard accounts; no separate data-minimization path exists for minors beyond the consent gate itself.

15. Advertising and Rewarded Ads

This section changed materially this revision. The prior draft said no advertising infrastructure existed at all. That's no longer accurate: real Google AdSense integration code now exists in the app. What hasn't changed is the practical outcome — no advertisement has actually been shown to any user, on any page, as of this revision. Both things are true at once, and the rest of this section explains why.

Display advertising (Google AdSense). We've integrated Google AdSense display-ad code, but it's built with "deny by default" logic so an ad can only ever appear on our public, non-authenticated study-guide content pages (original educational articles anyone can read without an account) — and never anywhere inside the authenticated study app (the tutor, quizzes, flashcards, notes, dashboard, or any other logged-in screen), and never while an active study or focus session is running. Beyond that page restriction, as of this revision:

If and when we do turn on real display ads, they will — per how the code is built — only ever appear on the public study-guide pages, never inside the study app and never during active studying, and we will update this policy with real detail (what Google AdSense collects, what cookies it sets, and what consent choice you'll be given) before that happens, not after.

Rewarded "watch an ad" bonus (Free plan). Separately, the Free plan has a "Watch a Short Ad" button that grants +3 bonus chat messages for the day (up to 3 times a day). On the Free plan a small notice after your 4th and 8th message offers the same bonus; it does not show or claim to show an ad. As with display advertising above, real integration code for this now exists — Google's IMA SDK (Interactive Media Ads), the standard Google product for playing a rewarded video ad in a web page — but as of this revision it is not turned on: no ad tag has been configured for this deployment, so no real video advertisement has ever actually been shown to any user through this button. To describe today's actual behavior accurately: clicking it does not show you a real video advertisement or any third-party ad creative. It runs a short (about 1.2-second), clearly-labeled simulated delay — the button's own tooltip in the app says this is a simulated ad watch with no ad network configured — and then calls our server, which grants the bonus. Only the bonus-granting logic behind it is real (and it is genuinely real — the grant is atomic, server-enforced, and capped, not just cosmetic). If and when a real ad tag is configured, this button will play a genuine IMA SDK rewarded video ad instead, the bonus will only be granted after that real ad's own completion signal fires (never on a skip, close, or error), and we will update this section with real detail (what the IMA SDK/Ad Manager collects, what it sets, and what consent choice you'll be given) before that happens, not after — same commitment §15 already makes for display advertising above.

We do not use behavioral advertising based on a student's study performance or study behavior anywhere in the app today, and — pending legal review — do not intend to for minor accounts if display advertising is ever turned on.

16. Gamification and Student Profiling

See §9. In short: study-progress indicators (XP, streaks, mastery, Season Pass tiers and Laurels, and similar) are calculated from your own study activity to show your own progress, power in-app recommendations and run the Season Pass. They are not used for advertising and do not currently drive any decision beyond what's displayed to you. Laurels can't be bought with money and no reward is random.

17. Data Retention

This changed materially this revision — a real, automated retention schedule now exists. Study content, chat history, and account data are retained for as long as your account exists, plus up to 30 days after you request account deletion (§18) — after that, your data is permanently and automatically deleted, not just deactivated. This is a real, code-enforced schedule (a daily automated job, not a manual promise), not an aspirational statement.

Exceptions we're not going to pretend don't exist: backup retention, and what happens to data already sent to a third-party AI provider before your deletion request (§7-8), are both outside our codebase's direct control — we don't currently make a specific promise about either. Data outside the account-deletion path (e.g. content you choose to keep by simply not deleting your account) is retained indefinitely while your account remains active, since there's no separate expiration on top of that.

18. Data Deletion

This is now a real, automated, self-service process — not the manual one an earlier revision of this policy described. You (or, if you're under 18, your parent or guardian) can request account deletion from Settings. That starts a real 30-day grace period, during which:

If the request is never cancelled, an automated job permanently deletes your account 30 days after the request:

What we still don't make a specific promise about: backup retention, and what happens to data already sent to a third-party AI provider before your deletion request (§7-8) — both are outside our codebase's direct control.

To request deletion, use Settings (if you have account access), or contact us at support@socratesai.app or the contact form — see §2.

19. Data Security

We use industry-standard practices including encrypted connections (HTTPS/TLS), database-level access controls that restrict each account to its own data, secure password handling (via our authentication provider, never stored by us in plaintext), server-side-only handling of API keys and secrets, rate-limiting and abuse protections on sensitive endpoints, and restricted administrative access. We do not hold any third-party security certification (e.g. SOC 2, ISO 27001), and we make no claim that any system is unbreachable — no organization can guarantee absolute security, and we do not claim to.

20. International Data Transfers

Your data leaves Egypt. Most of our providers are outside Egypt: our app server and Study Binder file storage (Railway, United States company), our database and authentication (Supabase), email (Resend, mainly in the United States), analytics (Google, PostHog's U.S. region, Cloudflare) and every AI provider in §7 process data abroad, mostly in the United States. Paymob, and our historical payment partner Fawry, are Egyptian.

Known, unresolved gap: Egypt's PDPL restricts transferring personal data outside Egypt and ties it to licensing by Egypt's Personal Data Protection Center. We have not registered with or obtained a licence from the Center. This is disclosed here rather than hidden, and it should be resolved (or confirmed not to apply to a project of this size) with legal advice. For users where GDPR applies, several providers offer their own transfer mechanisms (Standard Contractual Clauses — see §11 for Supabase, Resend and Google); we haven't layered a separate transfer promise on top of theirs.

Where Study Binder files and handwritten notes are stored: the Railway storage bucket that holds Study Binder files (§8) is in Railway's US West region, in California, United States, and the Railway database that holds handwritten notes (§8) is in Railway's US West region, in the United States. Both are outside Egypt, so the transfer gap above applies to them too.

21. Your Privacy Rights

Egypt's PDPL gives you rights over your personal data, and so do other laws depending on where you live (for example GDPR in the EU/UK, or state laws such as California's CCPA/CPRA in the United States). We honor every right below for any user who asks, wherever you live, without first deciding which specific law applies. Today, every one of these is handled manually: you (or, where applicable, a minor's guardian) contact us, and we address the request directly. We aim to respond within 30 days.

Your rights:

Where applicable, a guardian may exercise these rights on behalf of a minor's account. You can reach us at support@socratesai.app or the contact form with any request, and we will address it — this works the same way regardless of which specific legal right(s) apply to you.

If you're not satisfied with our answer, you can complain to your local data-protection authority — in Egypt, the Personal Data Protection Center.

22. Account/Data Export

You can download a complete copy of your data yourself. In Settings → Privacy, "Download all my data" saves one JSON file with everything we store for your account: your profile and settings, every chat and message, notes, flashcards and review history, ready-made deck progress, quiz results, homework checks, assignments, study time and streak records, Study Binder collections, mind maps, handwritten notes (sketches) with their strokes and saved earlier copies, the list of files in your Binder (name, type, size and dates), shared decks, report sharing with parents or teachers, invites, purchases and receipts, Season Pass progress and rewards, push notification subscriptions, Google Classroom data, and your AI usage records. The file is built by our server from your own account only and sent straight to you. Three things are deliberately left out: password-reset and consent token hashes, the encrypted Google Classroom access token and push notification encryption keys (security secrets, not information about you), and other people's account ids on shared records. The files you uploaded to the Binder are listed but not packed into the JSON file; download them from the Binder. The older "Export PDF Report Portfolio" (a readable PDF summary of study time, streak, notes and flashcards, built in your browser) is still there for sharing with teachers or parents. If anything is missing or you'd rather we send it, contact support@socratesai.app.

23. Google Classroom Integration

Opt-in, student-initiated, read-only. Nothing here happens unless you explicitly click "Connect Google Classroom" and complete Google's own consent screen — we never access your Google account otherwise.

What we request and why:

What we explicitly do not request: any Google Drive scope. When a teacher's assignment or announcement includes an attached file, we show it as an "Open in Classroom" link only — we never fetch the file's contents. This is a deliberate scoping decision (a Drive scope would require Google's separate, heavier third-party security assessment), not an oversight.

Turning an assignment into a study set. If you ask for flashcards or a quiz from a Classroom assignment, that assignment's title and description are sent to our AI provider to write them (§7). We only offer this while every AI provider we use is on terms that don't use what it's sent to train its models; while that isn't confirmed, the option is switched off.

Google API Services User Data Policy. Socrates AI's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular: we use Classroom data only to show you your own courses and assignments and to build study material you ask for; we don't sell it, use it for advertising, or use it to train general AI or machine-learning models; and no person at Socrates AI reads it except with your permission, for security, or to comply with the law.

What we store: a cache of your courses/assignments (kept current the same way the rest of your study data is), and your Google refresh token — encrypted at rest (AES-256-GCM) — so you don't have to reconnect every session. We never store your Google password; authentication happens entirely on Google's own consent screen.

Retention and deletion: the cached course/assignment data and the encrypted refresh token are deleted when you disconnect Classroom (on the Classroom page), or when your account is deleted (§18). Either way we also ask Google to revoke Socrates AI's access, so it disappears from your Google account's list of connected apps. You can check or remove it yourself at any time at myaccount.google.com/permissions.

Verification status: this integration's Google OAuth consent screen is going through Google's own verification process for these scopes. Until that completes, Google may show new users an "unverified app" warning during connection, and/or limit how many total accounts can connect — this is Google's own safeguard for apps requesting this class of scope, not something specific to Socrates AI's actual data handling described above.

On-request handwriting recognition

Status (3 October 2026): this feature is a beta that is switched off; no page is sent for recognition until it is switched on. Notebooks are not automatically sent to an AI model. If a signed-in student on Plus, Pro or Ultra chooses Read this page, the browser makes a bounded PNG of that page and sends it to our server. The image includes visible strokes and typed text, which may include personal information written on the page. Image/PDF attachments are currently excluded. The recognition prompt does not include the student's email, account ID or notebook title.

The server uses the existing plan-specific vision routing and cost guard. It selects one configured vision provider: the first in the plan's vision list whose highest possible cost for one page is within the $0.05 guard. With today's list prices that excludes Gemini, so the page goes to a model reached through OpenRouter; which one depends on the plan. It does not send the page to all providers. If Gemini is ever selected, the Gemini free-tier data-use warning in section 7 applies to handwriting images as well. Either way, avoid names and personal details on a page you ask the AI to read. An unchanged page uses its stored result instead of another recognition call. The image is processed in memory and is not stored as an additional recognition image on Railway. The notebook itself remains stored under the notebook storage policy.

Railway stores the transcription, mathematical LaTeX, approximate line positions, content hash, model identifier and estimated or reported call cost. Earlier page-version transcriptions are retained until the note or account is deleted; search only returns results matching the current contents. Recognition results and the separate daily quota ledger are included in account export and removed during account deletion. Quota records older than 30 days are deleted by a scheduled daily server job, with startup catch-up; dormant accounts are included without requiring another recognition attempt. AI-call accounting follows the existing logging retention policy.

Searching stored handwriting does not call an AI model. Ask the tutor and Make flashcards send the recognised text through the existing tutor or flashcard pipeline when the student chooses those actions. We identify it as an uncertain transcription, and handwritten-source flashcards need review before scheduled revision. Avoid putting passwords or sensitive information in a page you ask an AI to read.

24. Changes to This Privacy Policy

We may update this policy as the product changes — for example, as we add or change AI providers, turn on real advertising, add a payment method, or implement automated retention/deletion. We will update the "last technical review" note above every time we do. For routine/minor updates, that revision-date change is the notice. For a material change — meaning a change that meaningfully expands how we use or share your data beyond what this version describes — we will additionally: post a visible notice in the app (not just a changed date buried in this document), and, where the change affects a minor account specifically, send a new notice to that account's guardian rather than relying on the guardian noticing the date changed. This is the operator's own commercially-reasonable commitment, not a statutory notice period mandated by a specific law.

Contact Us

support@socratesai.app — see §2. Location: Cairo, Egypt. Socrates AI is operated by the Socrates AI team as an unincorporated project; there is no separate legal entity to name here. This section will be completed with a legal-entity name only if and when one is actually formed.

Operational health and budget records

The server stores aggregate daily response-status counts and latency buckets in the server-only Railway database for up to 31 days. These records contain no student identifiers, page contents, request URLs or handwriting. Writes are buffered briefly; sudden process termination can lose the unflushed counters. AI budget reservations contain a random call identifier, UTC date, reserved/settled amount and settlement state, rather than prompts or student identifiers. They are retained for up to 90 days; uncertain failed calls retain their reservations for the day's cost guard. Provider invoices may differ from these estimates. When account-file cleanup fails, account metadata is retained for the scheduled deletion retry so storage keys are not lost before files are removed.

Reliability records

When a student sends a chat request, Railway temporarily stores the generated answer and numbered stream events so the same request can reconnect without generating or charging for another answer. These records are private to the student, expire from replay after 24 hours and are deleted by scheduled cleanup (within the following day). The replay store holds a request fingerprint, not the raw prompt or uploaded file. Account export and deletion include these records.

File-processing timing records include an account and file identifier, timing values and a character count; they contain no extracted text or image. They are kept on Railway for 30 days, with scheduled daily deletion. Aggregate request and routing measurements contain no raw question or file content. Public study-content jobs contain only the shared generated study set, curriculum-scoped cache key and expiry; private uploaded documents are excluded.

Temporary direct chat uploads

When you attach an image, video or scanned PDF to the tutor, the browser may upload the binary file to our private Railway-compatible object-storage bucket using a five-minute signed upload URL. Chat then sends a file identifier rather than the file's Base64 representation. The server verifies your ownership, file size, checksum and format before sending the file to an eligible vision provider under the routing described above. This does not change which AI providers are eligible to process attachments.

Railway Postgres keeps the file identifier, owner, type, filename, size, checksum and expiry. Access expires after one day. The daily retention job deletes expired objects and their metadata; unsuccessful deletion is retried rather than silently discarding the record. Account deletion also deletes these temporary objects before deleting the account. Account export includes owned file metadata; file bytes are not embedded in the JSON export. Existing Binder files have their separate retention rules.

Operational model reliability measurements

Routing records the requested model and provider, workload category, success or failure category and response timings without prompt contents, file contents or student identifiers. These operational attempt records are retained for 30 days. The owner dashboard reports successful-attempt median/p95 alongside failure, timeout and rate-limit counts. This log cannot be filtered by an individual student's plan because it contains no account identity.

Durable ingestion, optional reranking and local exports

Requested syllabus, YouTube-transcript and administrator distillation jobs are queued in the server-only Railway Postgres database. Job payloads may include the supplied document text or bytes; they do not include the access token or student email. Payloads expire within one day. Jobs check the current account eligibility before running, and account export and deletion include owned jobs. They use the same AI provider disclosures and cost guard as other requested generation.

An optional operator-configured private semantic reranker may receive the question and bounded source excerpts. It is disabled unless its endpoint is configured. The built-in ranking remains available when it is disabled or fails. Configuration must use a controlled endpoint under the applicable source-processing policy.

Python runs in a new browser worker in an isolated frame. The interpreter is downloaded from the Pyodide runtime CDN, which receives ordinary network metadata such as the IP address. Our code runner does not upload the student's program to a server execution service. When you request AI test cases, the code checker sends the problem description to an eligible AI provider without including the program. If you separately paste code into tutor chat, the usual AI chat disclosures apply. Worker termination bounds execution time; it does not guarantee a particular device's memory capacity.

Anki export sends only the selected card IDs, question and answer text, and deck title to our authenticated app server. The server builds a temporary file and removes it after the response; it does not call an AI provider or store a new deck. Export includes text and mathematical notation, not media or the student's revision history.