NativeTutor AI ("we", "us", "the Service") is built around one principle: collect the minimum, protect what we hold, and put control in your hands.
1. Information we collect
Account data
Email, display name, password hash, language and subject preferences, age range (if provided).
Content you provide
Chat messages, uploaded PDFs and images, notes you paste, drawings, voice recordings, flashcards, quiz responses, and study plans.
Usage data
Anonymous analytics about how features are used (page views, feature interactions, error reports). Collected only with your consent — see Cookie Policy.
Device data
Browser type, operating system, language, IP address (truncated for analytics), push subscription endpoint if you opt in.
2. AI interactions
Conversations with the AI tutor, uploaded files used for OCR, and your stated weak topics are processed to generate responses and personalize your learning. We do not use your data to train AI models. Prompts may transit our AI gateway providers (currently Google Gemini and OpenAI), which contractually do not retain or train on prompts sent through the API.
3. Cookies & analytics
We use strictly necessary cookies (session, security, language preference) and — only with your consent — analytics cookies via PostHog. See our Cookie Policy.
4. Uploaded files
Files live in private, role-protected storage. Only you (and observers you explicitly authorize, e.g. a parent or teacher) can read them. You can delete any file at any time from the Upload tab.
5. Data retention
- Active accounts: retained while in use.
- Inactive accounts: notified after 12 months, deleted after 18 months.
- Backups: rolling 30-day window.
- Voice recordings: deleted within 24 hours unless you save them.
6. Third-party services
- Supabase — managed database, auth, storage
- Cloudflare — hosting and CDN
- Google AI Gateway, OpenAI — AI model inference
- PostHog — anonymous analytics (with consent)
- Email — transactional email delivery
7. Your rights (GDPR / CCPA)
You have the right to access, rectify, export, restrict, and delete your data. You can also object to processing or withdraw consent. Manage all of this in Settings → Privacy, or see our GDPR page.
8. International users
Data may be processed in the EU and the US. Where applicable, we use the EU Standard Contractual Clauses for transfers.
9. Children's privacy
The Service is intended for users aged 13+. EU users under 16 require verifiable parental consent (GDPR-K). We do not knowingly collect data from children under 13. If we discover such data, we delete it immediately.
10. Security
Industry-standard encryption in transit (TLS 1.2+) and at rest. Row-level security on every user table. Two-factor authentication available for all accounts.
11. Changes
If we change this policy materially, we'll notify you by email and in-app at least 30 days before changes take effect.
12. Contact
Privacy questions: privacy@nativetutorai.com. Data Protection Officer: dpo@nativetutorai.com.