Privacy

a. Information you provide

• Email address
• Account credentials (if you choose password login)
• Uploaded study materials (optional)
• Messages or support requests

b. Information collected automatically

• Device and browser information
• Pages viewed and feature usage
• Approximate location (country/region)
• Log and diagnostic data

c. AI & uploads

If you upload content (notes, assignments, images), we process it to provide study features. We do not claim ownership of your content.

• Create and manage your account
• Provide study guides and AI tools
• Improve accuracy, safety, and performance
• Send login links or service updates
• Prevent misuse or abuse
• Understand usage trends (analytics)

We do not sell personal data.

Some features use AI to generate summaries, explanations, or quizzes. AI outputs can be wrong - always verify with your course materials.

We use a small number of strictly necessary cookies to keep you logged in and to operate the Service. These are always on because the Service cannot function without them.

We also use analytics tools (such as PostHog and Google Analytics) to understand how the Service is used and to improve it. Analytics and other non-essential cookies are loaded only after you give consentthrough our cookie banner — the tools are not initialised at all until then, so no identifier is created and nothing is sent. If you decline, we do not load them. You can change or withdraw your choice at any time using the Cookie preferences control in the site footer; withdrawing also deletes the analytics identifiers already stored on your device.

Record of your consent choice.When you make a choice in the cookie banner we record the choice itself, a random identifier for your browser (so that changing your mind updates your existing record rather than creating a second one), the date and time, your browser’s user-agent string, and a truncated form of your IP address — the network portion only (the first three groups of an IPv4 address, or the first three of an IPv6 address), never the full address. We keep this because a consent record we cannot distinguish from a fabricated one is not a record at all. It is used solely to evidence and honour your choice; it is never used to identify you, to build a profile, or for analytics or advertising. We keep every version of your choice (including a withdrawal) so we can show what you had chosen at any point in time.

If you have an account, your current consent record is stored against your account, and the browser identifier described above is stored with it. We keep that one identifier for a single, specific reason: choices you made in the cookie banner beforeyou signed up are recorded without any account attached, so the identifier is the only thing that lets us find them again when you ask for a copy of your data or ask us to delete it. It is not used to link your browsing to your account, and it is not shared with anyone. It is stored once against your current record — not repeated in your consent history — and it is removed automatically if it no longer points to any pre-signup record.

We do not sell personal information and we do not use it for targeted advertising. We do not show personalized or behavioral ads to students, and we do not enable ad-personalization on the Service.

We may share limited data with service providers who process it on our behalf and under contract:

• Hosting and database infrastructure (Supabase)
• Email delivery (Resend)
• Payment processing, if you upgrade (Stripe)
• Product analytics, if you consent (PostHog, Google Analytics)
• AI processing to generate study features (Anthropic)

We share only what is necessary to operate the Service. We do not sell personal information, and we do not share it for cross-context behavioral advertising.

AI processing: When AI features process your content, we do not send identifiable named student data to third-party AI providers in a form that identifies an individual student. Our AI providers do not use your content to train their general-purpose models.

We may also disclose information if required by law, to protect the safety of users, or in connection with a merger or acquisition (in which case we will notify affected users).

• Account data is retained while your account is active
• Uploaded content may be deleted after processing
• You may delete your account and associated personal data at any time using the “Delete my account” option in your account settings, or by contacting us
• Cookie-consent records (your choice, the truncated network prefix and user-agent described in section 4) are kept for 24 months from the date of the choice, then deleted. This is the period we may need to evidence that a choice was validly given; we do not keep them indefinitely. Deleting your account also deletes the consent records associated with your account and with the browser identifier it carries
• Delivery-failure records. When an email we send cannot be delivered, we record the address it was sent to, the type of failure, and which kind of email it was, so that we can tell you the message did not arrive and avoid sending again to an address that cannot receive mail. These records are deleted after 7 days
• We delete or de-identify personal data when it is no longer needed, subject to legal retention obligations

Children under 13 may not use CramClub.

CramClub is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. We ask for date of birth at sign-up and block account creation for anyone under 13.

If we learn that we have collected personal information from a child under 13 without required consent, we will delete that information promptly. Parents or guardians who believe a child under 13 may have provided us information can contact us at support@cramclub.app and we will investigate and delete it.

Users age 13–17

If you are between 13 and 17, you may use CramClub, but you should do so with your parent, guardian, or school's awareness and permission. Please do not upload sensitive personal information. We limit data collection from minors to what is needed to provide the Service, and we do not use minors' data for targeted advertising or to build non-educational profiles.

Parents, guardians, and schools may contact us to review, correct, or delete a student's data. For school-managed accounts, we act on the instructions of the school (see the School Use section below).

When a teacher, school, or district uses CramClub with students, we act as a service provider processing student information on the school's behalf and under its direction.

FERPA

To the extent CramClub processes personally identifiable information from student education records, we act as a “school official” with a legitimate educational interest under the Family Educational Rights and Privacy Act (FERPA), performing a service the school would otherwise perform itself. The school remains in control of those records: we use student education records only to provide the Service to the school, we do not re-disclose them except as directed by the school or as permitted by FERPA, and we do not use them for our own purposes.

California SOPIPA

Consistent with California's Student Online Personal Information Protection Act (SOPIPA), for student data collected through school use we do not:

• engage in targeted advertising to students based on their use of the Service or covered information;
• build a profile of a student except in furtherance of school purposes;
• sell or rent student information; or
• disclose covered information except as permitted for authorized educational or legal purposes.

We maintain reasonable security procedures to protect covered information, and we delete a student's covered information when the school requests it or when it is no longer needed for the educational purpose. Schools and districts can review our School Data Protection Addendum for the full set of commitments.

Depending on your location, you may have rights to access, correct, delete, or export your data, or object to certain processing. The easiest way to delete your account and data or to export your data is directly in your account settings(“Delete my account” and data-export options). You can also contact us at support@cramclub.app and we will respond within the timeframe required by applicable law.

For users in the European Economic Area / UK (GDPR)

• Right to access, rectify, or erase your personal data
• Right to data portability (receive your data in a structured, machine-readable format)
• Right to restrict or object to processing
• Right to withdraw consent at any time
• Right to lodge a complaint with your local data protection authority

Our lawful bases for processing include: consent (for optional analytics — we do not collect marketing consent or run marketing cookies), contract performance (to provide the Service), and legitimate interests (to improve and secure the Service).

For users in California (CCPA/CPRA)

• Right to know what personal information we collect, use, and disclose, and to access it
• Right to correct inaccurate personal information
• Right to delete your personal information
• Right to opt out of the sale or sharing of personal information
• Right to limit the use of sensitive personal information
• Right to non-discrimination for exercising your rights

We do not sell or share personal information as those terms are defined under the CCPA/CPRA, and we do not use or disclose sensitive personal information beyond the purposes permitted by law. To exercise these rights, use your account settings or contact us at support@cramclub.app.

California minors

Because we do not sell or share personal information, no opt-in is required for the sale or sharing of a minor's personal information. Should this ever change, we would obtain opt-in consent before selling or sharing the personal information of any consumer we know to be under 16 (and, for consumers under 13, consent from a parent or guardian), as required by the CCPA/CPRA.

Under California's “online eraser” law (Business & Professions Code § 22581), a registered user under 18 who resides in California may request removal of content or information they posted on the Service. Use the “Delete my account” option, delete individual content directly, or contact us at support@cramclub.app. Note that removal may not be complete or comprehensive in all cases (for example, where the law does not require removal or where content was copied or reposted by others).

We use reasonable administrative, technical, and organizational safeguards to protect your data, including encryption in transit, access controls, and Row Level Security on our database. However, no system is 100% secure, and we cannot guarantee absolute security.

We may update this policy. If changes are significant, we'll notify users.

Email: support@cramclub.app