Last updated: October 12, 2026
This Privacy Policy explains how PupilBot (“we,” “us,” or “our”) collects, uses, stores, and protects your personal data when you use our web application, iOS application, Telegram bot, and MCP connector (collectively, the “Service”).
We are committed to protecting your privacy in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable Romanian data protection law. Please also review our Terms of Service.
The data controller responsible for your personal data is:
When you create an account, we collect:
The core function of the Service is to turn your study materials into practice questions. When you upload material, we collect and generate:
You retain ownership of any material you upload. We process it only to provide the Service to you.
If you subscribe to PupilBot premium via the iOS app (Apple In-App Purchase), we receive from Apple:
If you subscribe via the web (Stripe), we store:
We do not receive or store your payment card details. All payment processing is handled by Apple or Stripe respectively.
If you link a Telegram account, we additionally store:
For billing transparency and reliability, we log internal usage of AI models (model name, token counts, cost in USD, type of operation — e.g. topic extraction, question generation, answer grading) tied to your user ID. Audit logs use hashed (SHA-256) email identifiers rather than plaintext email addresses.
We also record lightweight product-usage events tied to your user ID — which screens you open, when a study finishes processing or fails, when an upload limit or upgrade screen is shown, when a practice session ends, and when a notification is sent or opened. Each event stores an event name, a small context object (for example the screen name or a study ID), and a timestamp. We do not record the content of your study materials, questions, or answers in these events, and we do not use third-party behavioural advertising or cross-site tracking SDKs. If you delete your account, these rows are kept in anonymised form with the user ID removed.
You can connect an AI assistant, such as Claude, to your PupilBot account through OAuth.
The connector reads your studies, topics, questions, answers, feedback, weak spots, due reviews, and progress.
It can also create a study from text that you choose to send through the assistant.
We receive tool names, tool arguments, authentication data, and the client identifier. We do not request your full conversation history.
We store submitted study text and derived practice content in your account. Read tools return existing data without calling an AI provider.
We record tool names and success status as usage events. These events exclude study text and answer content.
OAuth records include the client name, client identifier, redirect addresses, approved scope, token hashes, and expiry times.
The assistant receives each tool result. Its provider handles those results under its own privacy policy and your account settings.
For Claude, see Anthropic’s privacy policy.
Disconnect an assistant in PupilBot Settings under Connected apps to end its access.
Disconnecting does not delete data that the assistant already received. Use that provider’s controls to manage those copies.
We process your personal data for the following purposes, each with a corresponding legal basis under GDPR Article 6(1):
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Account creation & authentication | Account data, OAuth data, auth tokens | Art. 6(1)(b) — Performance of contract |
| Running OCR on uploaded files | Uploaded study material files | Art. 6(1)(b) — Performance of contract |
| Generating topics, questions & grading answers | OCR text, your answers | Art. 6(1)(b) — Performance of contract |
| Adaptive scheduling & mastery tracking | Answers, mastery scores, review history | Art. 6(1)(b) — Performance of contract |
| Subscription management | Apple/Stripe transaction data, subscription status | Art. 6(1)(b) — Performance of contract |
| Sending proactive practice reminders via Telegram | Telegram chat ID, scheduled session data | Art. 6(1)(b) — Performance of contract (you opted in by linking Telegram) |
| Transactional email (password reset, welcome) | Email address | Art. 6(1)(b) — Performance of contract |
| Security (fraud prevention, token management) | IP address, device info, auth tokens | Art. 6(1)(f) — Legitimate interest |
| Cost tracking & abuse prevention for AI calls | Token counts, model usage tied to user ID | Art. 6(1)(f) — Legitimate interest |
| Understanding how the Service is used (product analytics) | Product-usage events tied to user ID (screen names, feature usage, timestamps) | Art. 6(1)(f) — Legitimate interest |
| Improving the Service (aggregated/anonymised metrics) | Anonymised usage data | Art. 6(1)(f) — Legitimate interest |
We do not use your study materials, questions, or answers to train third-party AI models. Where AI providers are used to power features of the Service, we rely on their contractual no-training commitments (see Section 7).
Because study materials are central to the Service, we want to be specific about how they are handled:
We share personal data only with the following third-party service providers (processors), strictly for the purposes described:
| Provider | Purpose | Data Shared | Location |
|---|---|---|---|
| Cloudflare (R2) | Storage of uploaded study material files | Uploaded image files (tied to user account) | EU-preferred regions |
| Hetzner Online GmbH | Application and database hosting | Account data, study content, answers, and usage records | Germany (EU) |
| Ollama Cloud | OCR text extraction | Uploaded page images | International cloud processing |
| Anthropic | Text refinement, topics, questions, answer grading, and tutor replies | Study text, questions, answers, and relevant practice context | USA / international processing |
| OpenAI | Text processing and practice features, if configured | OCR text, generated questions, your answers | USA (EU-US Data Privacy Framework) |
| xAI | Text processing and practice features, if configured | OCR text, generated questions, your answers | USA (Standard Contractual Clauses) |
| Apple | Sign in with Apple & subscription/payment processing (IAP) | Apple ID, transaction IDs, subscription status | USA (EU-US Data Privacy Framework) |
| Stripe | Web subscription & payment processing | Email, billing details (card details handled by Stripe, never by us), subscription status | USA / Ireland (EU) |
| Resend | Transactional email delivery (password reset, welcome) | Email address, email content | USA (EU-US Data Privacy Framework) |
| Telegram | Practice reminders & bot conversations (only if you link Telegram) | Chat ID, question text, your answers, grading messages | Global |
We do not sell your personal data. We do not share data with advertisers or ad networks. We do not engage in profiling for marketing purposes. We do not use your data to train third-party AI models.
Your personal data is primarily stored on servers within the European Union (Cloudflare R2 EU regions, Hetzner Germany, our own application database). Where data is transferred to service providers outside the EU (Apple, OpenAI, xAI, Resend in the USA; Telegram globally), such transfers are protected by:
We retain your personal data only for as long as necessary to fulfil the purposes described in this policy:
| Data Category | Retention Period |
|---|---|
| Guest account data | Until you upgrade the account or until automated cleanup after extended inactivity |
| Registered account data | Until you delete your account |
| Uploaded study materials & derived content (OCR text, topics, questions, answers, mastery) | Until you delete the material or your account |
| Subscription data | Until you delete your account (Apple/Stripe retain their own records independently for accounting and tax purposes) |
| Refresh tokens | Access lasts until expiry or revocation. MCP refresh tokens expire after 180 days unless renewed. Token records remain until account deletion. |
| MCP client registrations and authorization codes | Client registrations remain for connection support. Authorization codes expire after 10 minutes and permit 1 use. |
| Product usage events, including MCP tool events | No fixed automatic expiry. Account deletion removes the user identifier; anonymous event records remain. |
| Password reset tokens | 1 hour or until used, whichever comes first |
| Telegram link codes | 15 minutes or until used, whichever comes first |
| AI usage telemetry (model name, token counts, cost) | Retained for billing transparency and operational integrity |
| Webhook logs (Apple, Stripe) | Retained for operational integrity and accounting |
Account deletion removes your account, studies, answers, and associated files in Cloudflare R2. Usage records remain with user identifiers removed, as described above.
Under the GDPR, you have the following rights regarding your personal data:
How to exercise your rights: Email [email protected] with the subject line “GDPR Request.” You may also delete your account and all associated data directly within the Service. We will respond to all requests within 30 days.
PupilBot uses a JWT-based authentication system, not traditional browser cookies for session management.
The Service is not directed at children under the age of 16 (the GDPR age threshold for consent to data processing in most EU member states; some member states set a lower limit, no lower than 13). We do not knowingly collect personal data from children under 16 without verifiable parental consent. If we become aware that we have collected personal data from a child under 16 without such consent, we will take steps to delete that data promptly. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at [email protected].
We implement appropriate technical and organisational measures to protect your personal data, including:
We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page will be revised accordingly. For material changes that affect how we process your personal data, we will notify registered users by email. Previous versions of this policy are available upon request.
For privacy-related inquiries or to exercise your GDPR rights, please contact us:
We will respond to all GDPR requests within 30 days of receipt.