Privacy Policy

1. Our Core Privacy Promise

Your privacy is paramount. Encephlo is designed to help you study, not to sell your data.

• We do not sell your personal information to third parties.
• We only process data required to provide the tutoring service.
• Encephlo does not set first-party cookies, tracking pixels, or use cross-site tracking technologies on our website or extension. Third-party service providers (such as Stripe) may use their own cookies for fraud detection and payment security as described in Section 4 below.
• We do not use your personal data to train large language models or other AI models.

2. Information We Collect & Store

Because we do not use first-party cookies, we only collect the information you directly provide to us and the minimal server logs required to keep the application secure and functional.

Information You Provide

• Account Info: Name, Email, and Profile Picture (via Google Login).
• Chat History: We store the text-based conversations you have with the AI Tutor to provide context for future questions and to let you review past sessions.
• Study Data: Information about your courses, decks, flashcards, and study progress.
• Payment Status: We store your subscription status (e.g., "Pro", "Trial"). We DO NOT store your credit card details; these are handled securely by Stripe.

Information Collected Automatically (Server Logs)

• Log Data: We collect basic information that your browser or device automatically sends when you use our Services to prevent fraud and ensure security. Log data includes your Internet Protocol address, browser type, and the date and time of your request.

3. Classroom & Institutional Use (FERPA)

If you joined Encephlo through a course invite code from your professor, this section governs your use. It is the part your institution's privacy office will care about most.

• Our role: where a professor's adoption of Encephlo causes us to process education records, we act as a school official with a legitimate educational interest under FERPA (34 CFR § 99.31(a)(1)(i)(B)), processing those records solely to deliver the tutoring service and under the institution's direction. There is no such thing as a "FERPA certification"; we describe our handling instead of claiming a badge.
• What your professor can see: class-level topics and sticking points, and a per-student line showing how much you used the tutor, a short AI-written summary of what you worked on, and a flag if you look like you need help. Your professor cannot read your conversations. Chat sessions are readable only by the account that created them, enforced in our database security rules rather than by policy alone.
• Course materials: materials your professor uploads, and anything synced from Canvas, belong to your professor and their institution. Our Canvas integration is read-only: we never write to your LMS and never touch the gradebook.
• Cost and payment: students in a professor's course use Encephlo free. No student in a classroom course is charged, and no classroom student's data reaches our payment processor.
• Institutional agreements: we will sign a data processing addendum with your institution. Our template, our completed HECVAT Lite, our subprocessor list, and our FERPA posture statement are all downloadable at encephlo.com/security.
• Deletion: an institution may request deletion of all data affiliated with it; our target is within 30 days for live data.

5. How We Share Data

We do not sell your personal information. We disclose your information only in the following circumstances:

Service Providers

We share data only with the trusted infrastructure providers necessary to run the app:

• Google (Firebase/Vertex AI): For hosting, database, authentication, and the Google Gemini Large Language Model ("LLM") that powers Encephlo.
• Stripe: We use Stripe for payments, analytics, and other business services. Stripe may collect personal data including via cookies and similar technologies. The personal data Stripe collects may include transactional data and identifying information about devices that connect to its services. Stripe uses this information to operate and improve the services it provides to us, including for fraud detection, loss prevention, authentication, and analytics related to the performance of its services. You can learn more about Stripe and read its privacy policy at stripe.com/privacy.
• Resend: We use Resend to deliver transactional email, such as weekly insight digests to instructors. Resend processes recipient email addresses and the content of those emails solely to deliver them.
• Google Analytics (server-side): We send pseudonymous product usage events (for example, that a tutoring interaction occurred, identified by an internal user ID) to Google Analytics from our servers to understand feature usage. Chat content is never sent to analytics, and this does not involve tracking cookies on our site.
• Inworld AI (read-aloud): If you press play on the read-aloud feature, the text you asked to hear is sent to Inworld AI to be turned into speech. Only that text is sent, never your name, email, or account identifier, and nothing is sent unless you press play. Read-aloud can also run on Google's speech service instead.
• Microsoft and Apple (sign-in only): If you choose "Sign in with Microsoft" or "Sign in with Apple," that provider receives the sign-in request and returns basic profile claims (name, email). Choosing a different sign-in method means neither is involved.
• YouTube API Services: Encephlo uses the YouTube API to search for relevant educational videos. By using Encephlo, you are also subject to the Google Privacy Policy. We access only publicly available video metadata (titles, thumbnails, URLs) to display search results. We do not access, collect, or store any YouTube user data on your behalf. You may revoke Encephlo's access to your Google data at any time via the Google security settings page.

Business Transfers

If we are involved in strategic transactions, reorganization, bankruptcy, receivership, or transition of service to another provider, your personal data may be transferred to a successor or affiliate as part of that transaction.

Legal & Safety Obligations

We may share your personal data with government authorities or other third parties if required to do so to comply with a legal obligation, or to protect the safety, security, and integrity of our products, employees, users, or the public.

6. Data Retention & Security

Retention

We retain your personal data for only as long as we need to provide our Services to you. While screen context data is discarded immediately, Account Info and Chat History are retained until you request deletion. We may retain certain data longer if required for legitimate security, safety, or legal reasons.

Security

We implement commercially reasonable technical, administrative, and organizational measures designed to protect Personal Data from loss, misuse, and unauthorized access. All data is transmitted using modern encryption (HTTPS/TLS). However, no Internet or email transmission is ever fully secure or error free.

7. Your Data Rights & Regional Privacy Laws

You have full control over your data. You can view your history within the app dashboard. You may request full deletion of your account and all associated data by contacting support.

U.S. State Privacy Rights

If you are a resident of California, Colorado, Connecticut, Virginia, Texas, or other states with applicable privacy laws, you have specific rights regarding your personal information:

• Right to Know/Access: You have the right to request the specific categories and pieces of personal information we have collected about you.
• Right to Delete: You have the right to request that we delete personal information we have collected from you, subject to certain legal exceptions.
• Right to Correct: You have the right to request the correction of inaccurate personal information.
• Right to Data Portability: You have the right to receive a copy of your personal data in a portable, readily usable format.
• Right to Opt-Out of Sale/Targeted Advertising: Encephlo does not sell your personal information and does not use your data for targeted advertising. Therefore, there is no sale or targeted advertising from which to opt out.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.
• Universal Opt-Out Signals: We honor Global Privacy Control (GPC) and similar universal opt-out signals as required by applicable state laws.
• AI Training Disclosure (Connecticut CTDPA): We do not use, collect, or sell your personal data to train large language models (LLMs) or other artificial intelligence models.

To exercise these rights, please contact us at suraj@encephlo.com. We will verify your identity before processing your request.

8. Children's Privacy (COPPA)

Encephlo is intended for users who are at least 13 years of age. We do not knowingly collect, maintain, or use personal information from children under the age of 13. If we discover that a child under 13 has provided us with personal information, we will take immediate steps to delete such data from our systems. If you are a parent or guardian and believe your under-13 child has provided us with information, please contact us immediately at suraj@encephlo.com.