Privacy Policy

1Information We Collect

Account Information

• Username, display name, and email address
• Password (stored as a one-way hash — we never see your actual password)
• Profile details: grade level, school type, and study motivation
• Avatar selection

Education & Learning Data

• Practice answers, scores, and mastery levels
• Study session history and time spent
• AI coaching interactions and tutor conversations
• Misconception patterns identified during practice
• Flashcard progress and review history
• Notes you, a linked parent, or our team add to your study profile
• Files you choose to upload: score reports and support-ticket attachments
• Drawings you send to the AI tutor from the scratch pad

Automatically Collected Data

• IP address and approximate location (country/region)
• Browser type and device information
• Pages visited, features used, and session duration
• Error reports (to improve reliability)

2How We Use Your Information

• Personalized learning: Adapting question difficulty, selecting practice topics, and generating study plans based on your performance
• AI tutoring: Providing real-time coaching, Socratic guidance, and session summaries powered by AI models
• Progress tracking: Showing your mastery levels, strengths, and areas to focus on
• Platform improvement: Analyzing usage patterns to improve features, fix bugs, and develop new capabilities, and using practice results to improve our questions
• Communication: Account and billing emails (sign-in codes, password resets, receipts and renewal reminders), plus study emails such as weekly progress recaps and check-ins. You can turn study emails off in Settings or with the unsubscribe link in any of them; account and billing emails always send
• Sharing you set up: If you link a parent, they see your progress and get a weekly recap by email. If you join a school, program, or tutor's group, its staff can see your progress and practice activity in that program

3AI Processing

Study Scout uses artificial intelligence to power tutoring, coaching, question selection, and study planning. We work with two AI model providers, Anthropic and OpenAI, plus TypeSafe, which runs the classifier that decides when the practice coach should step in. Which model provider handles a given feature is a setting we control, and we may change it — so treat both as able to see the same kinds of data. When you interact with AI features:

• Your answers, misconceptions, and session context are sent to Anthropic or OpenAI for processing, depending on which model that feature is set to use. This can include your first name, messages you type to the tutor, drawings you send from the scratch pad, notes on your study profile, and a score report you upload
• TypeSafe receives a de-identified summary of your recent practice — no name, email, or notes
• We also send question and lesson content to OpenAI behind the scenes to double-check it for accuracy. That check happens away from your session and doesn't include anything about you
• AI responses are generated for you and saved to your account so you can come back to them
• We do not use your data to train AI models, including the de-identified information described in section 5, and Anthropic's and OpenAI's API terms don't allow them to train on it either. TypeSafe receives only de-identified data
• AI interactions are logged for quality assurance and cost tracking

4Data Sharing & Sub-Processors

We do not sell your personal information. We share data only with:

We may also disclose information if required by law, to protect our rights, or to prevent fraud or safety issues.

5Data Retention

What we keep after you delete your account

When an account is deleted, we delete the personal information tied to it. We keep records we need for billing, accounting, security and legal reasons, with account details removed where we don't need them. We also keep de-identified and aggregated information derived from the account's use of Study Scout, such as practice results, which does not identify the student. We use it to improve our questions and to understand how well Study Scout helps students.

• We won't try to re-identify this information, and we share it only as aggregated statistics
• We never use it to train AI models
• We keep de-identified records for about five years; after that only aggregated statistics remain

6Your Rights

Depending on your location, you may have the following rights:

• Access: Request a copy of the data we hold about you
• Correction: Update inaccurate information in Settings → Account
• Deletion: Request deletion of your account and associated data
• Export: Download your data in a portable format (available in Settings → Privacy & Data)
• Restriction: Ask us to limit how we process your data
• Objection: Object to certain types of processing

To exercise these rights, use the tools in Settings → Privacy & Data or contact us at the address below.

7California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You may request the categories and specific pieces of personal information we have collected about you
• Right to Delete: You may request deletion of your personal information (available in Settings → Privacy & Data)
• Right to Opt-Out of Sale or Sharing: We do not sell or share your personal information to third parties for cross-context behavioral advertising, and we have never sold it. From September to early October 2026, our public marketing pages used a Meta advertising pixel to measure ads; we have removed it
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights

We collect the following categories of personal information as described in Section 1: identifiers (name, email), education information, and internet activity information. This information is used for the business purposes described in Section 2.

To exercise your California privacy rights, use the self-service tools in Settings → Privacy & Data or contact us at [email protected]. We will verify your identity before processing your request.

8Children's Privacy

Study Scout is for students 13 and older, including teens under 18. We take extra care with younger users:

• We collect only the minimum information necessary for the learning experience
• Study Scout is not intended for children under 13. Everyone who registers agrees to our Terms, which require users to be at least 13; a parent inviting their student to Study Scout confirms the student is at least 13. We do not knowingly collect personal information from a child under 13, and if we learn an account belongs to a child under 13, we delete it
• Parents can review their child's data and unlink the account through the Parent Portal. To delete a child's account or data, or to withdraw consent, contact us and we'll process the request
• We do not display advertising inside the app or engage in behavioral targeting of any user

9Security

We protect your data with:

• Encryption in transit (HTTPS/TLS for all connections)
• Passwords hashed with bcrypt (industry-standard one-way hashing)
• Access controls that limit each account to its own data and to the students it is authorized to view
• Content Security Policy headers to prevent cross-site scripting
• Rate limiting on authentication endpoints

No system is 100% secure. If we discover a breach affecting your data, we will notify you promptly.

10Cookies & Local Storage

We use:

• Sign-in cookie — a secure, HTTP-only cookie that keeps you signed in
• Security cookies set by Cloudflare to protect against bots and attacks
• Sign-up attribution — which page or campaign first brought you to Study Scout, kept in your browser's storage and saved with your account if you register
• User preferences (theme, sidebar state) stored in localStorage

We do not use third-party tracking cookies, advertising cookies, or analytics pixels.

11Changes to This Policy

We may update this policy from time to time. If we make material changes, we will notify you through the platform or by email. Continued use after changes constitutes acceptance of the updated policy.

12Contact Us