Privacy Policy

Studimoe collects only the information necessary to provide our educational services. The categories of information we collect are:

1.1 Account Information

• Email address : used for magic-link authentication and account identification.
• Full name : used to personalize your experience.
• Academic year : used to tailor features to your academic level.

1.2 Assignment Data (from LMS Platforms)

When you use our Chrome extension with supported Learning Management Systems (Canvas, Blackboard, Google Classroom, or PrairieLearn), we collect:

• Assignment title, course name, due date, and points possible.
• Assignment URL and the LMS platform identifier.
• Assignment status (pending or submitted) and the time it was scraped.

1.3 AI-Generated Content

• Study guides : title, summary, key concepts, and practice questions generated from your assignments.
• Citations : source type, title, authors, publisher, publication date, URL, and formatted citations (APA, MLA, Chicago).
• Notes : title, content, and tags you create.
• Writing style profiles ("Tone Sheets") : AI-analyzed voice characteristics, commonly used words, language level, grammar patterns, and punctuation usage derived from documents you upload. The raw text of uploaded documents is not stored : only the AI-extracted analysis is saved.
• AI chat messages are streamed in real time and not persisted to our database.

1.4 Billing Information

• Stripe customer ID, subscription ID, subscription status, plan tier (free/pro), and subscription period end date.
• We never handle, process, or store payment card information. All payment data is processed directly by Stripe. See Section 5 for details.

1.5 Browser Extension Data

Our Chrome extension stores data locally in your browser, including:

• Authentication tokens (obfuscated for security).
• Scraped assignments pending sync.
• Sync state, configuration settings, and activity logs.

This local data never leaves your browser except when explicitly synced with our servers.

1.6 Error Reports

In production environments only, the extension may send error messages, stack traces, page context, timestamps, and user-agent strings to our error-reporting endpoint. These are logged server-side for debugging and are not persisted to any database.

We use your information solely to operate, maintain, and improve the Studimoe application. Specifically:

• Assignment sync: To scrape, store, and sync your LMS assignments so they appear on your Studimoe dashboard.
• AI features: To generate study guides, provide AI chat responses, analyze writing style, and format citations using your assignment context.
• Authentication: To verify your identity and maintain secure access to your account.
• Billing: To manage your subscription, process payments via Stripe, and provide access to Pro features.
• Service improvement: To diagnose bugs, monitor performance, and enhance our features using anonymized or aggregated data.
• Communication: To send you service-related notifications (e.g., subscription changes, security alerts).

We do NOT use your information for:

• Selling, renting, or trading your data to any third party.
• Advertising, marketing, or building user profiles for external purposes.
• Training third-party AI models with your personal or academic data.
• Any purpose unrelated to the operation of Studimoe.

3.1 Where Your Data Is Stored

• InstantDB : Our primary database for user accounts, assignments, notes, study guides, citations, tone sheets, and billing metadata. All user-scoped data is protected by row-level permissions ensuring each user can only access their own records.
• Chrome Extension Local Storage : Auth tokens, pending assignments, and configuration stored locally in your browser via chrome.storage.local.
• Server-Side Logs : Ephemeral console logs on our hosting infrastructure (Vercel). Not persisted to any database.

3.2 Security Measures

• Token-based authentication with Bearer token verification on all API endpoints.
• Row-level permissions in InstantDB: every user-scoped entity requires auth.id == data.userId.
• Input validation using Zod schemas on all API request bodies.
• Rate limiting on all endpoints to prevent abuse (e.g., 20 requests/user/minute on sync API).
• Prompt injection defenses in AI system prompts and input sanitization (angle-bracket removal, character limits).
• Token obfuscation in Chrome extension storage (XOR-based deobfuscation).
• Anti-enumeration protections on signup code verification.
• CORS protection with strict origin checking for extension-to-web communication.
• Admin SDK server-side only : administrative credentials are never exposed to the client.

While we implement commercially reasonable security measures, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security of your data.

Studimoe integrates with the following third-party services. Each service has its own privacy policy and terms of service:

• InstantDB : Primary database and authentication provider.
  Data shared: User accounts, assignments, notes, study guides, citations, tone sheets, and billing metadata.
• OpenAI (via Vercel AI SDK / Vercel AI Gateway) : AI model provider for chat, study-guide generation, tone-sheet analysis, and citation formatting.
  Data shared: Chat messages, assignment context, document content for analysis, and citation source text. AI chat messages are not persisted to our database. OpenAI processes data under its own data-processing terms.
• Vercel : Hosting platform and AI Gateway proxy.
  Data shared: Server-side logs, deployment metadata, and routed AI API requests.
• Stripe : Payment processing and subscription management.
  Data shared: Your email address and Studimoe user ID (as metadata) for customer creation. Stripe handles all payment card data directly. We receive only customer ID, subscription ID, status, and period-end date back via webhook.
• Bing (Microsoft) : Web search used by our AI chat tool.
  Data shared: Search queries sent to Bing for public web results. No API key is used; results are scraped from public search pages.
• Google Chrome Extension APIs : Local browser storage, tab management, and scheduled alarms.
  Data shared: Data stored locally in your browser only. Nothing is shared externally.
• Learning Management Systems (Canvas, Blackboard, Google Classroom, PrairieLearn) : Source of assignment data scraped by our extension.
  Data shared: Assignment title, course, due date, points, and URL scraped from pages you visit. Authentication to these platforms is handled via your existing browser session; we do not store your LMS credentials.

All payment processing is handled exclusively by Stripe. Studimoe never receives, processes, or stores your credit card or banking information.

When you subscribe to a Pro plan:

• We send your email address and Studimoe user ID to Stripe to create or locate your customer record.
• Stripe handles the entire checkout process, including payment-card entry and fraud detection.
• Stripe sends webhook events to our server to update your subscription status (active, past_due, canceled, etc.) and plan tier (free/pro) in our database.
• You can manage your subscription, update payment methods, or cancel at any time through your Stripe customer portal.

Stripe's privacy policy and terms of service apply to all payment-related interactions.

Studimoe uses AI models (primarily OpenAI's GPT models) to provide features such as:

• AI chat responses based on your assignment context and writing style.
• Study-guide generation from assignment titles and context material.
• Writing-style analysis to create Tone Sheets from documents you upload.
• Citation formatting in APA, MLA, and Chicago styles.

Important notes about AI processing:

• Chat messages are streamed in real time and not stored in our database.
• Raw uploaded documents for Tone Sheet analysis are not stored : only the AI-extracted characteristics (voice, grammar patterns, etc.) are saved.
• AI-generated outputs (study guides, citations, tone sheets) are stored in InstantDB under your user account and are accessible only to you.
• AI-generated content is probabilistic and may contain inaccuracies. You are responsible for verifying any AI output before using it.
• We do not use your personal or academic data to train third-party AI models.

We retain your data for as long as your account is active or as needed to provide our services. You may request deletion of your account and all associated data at any time by contacting us at support@studimoe.com.

Upon account deletion:

• All assignments, notes, study guides, citations, and tone sheets associated with your account will be permanently removed from InstantDB.
• Authentication records and billing metadata will be deleted.
• Local data stored by the Chrome extension on your device will remain until you remove the extension or clear browser storage.

We will fulfill deletion requests within a commercially reasonable timeframe. Some data may be retained for legal, regulatory, or legitimate business purposes (e.g., tax records related to Stripe payments).

Studimoe is designed for students of all ages. We comply with applicable student privacy laws, including the Family Educational Rights and Privacy Act (FERPA) in the United States. When acting as a "school official" on behalf of educational institutions, we:

• Use student data only for educational purposes authorized by the institution.
• Do not sell, share, or use student data for any non-educational purpose.
• Maintain reasonable administrative, technical, and physical safeguards to protect student data.

If you are under 13 (or the minimum age in your jurisdiction), you may use Studimoe only with the consent of a parent or guardian.

Depending on your jurisdiction, you may have certain rights regarding your personal data:

• Access: You can view all of your data (assignments, notes, study guides, citations, tone sheets) directly in your Studimoe dashboard.
• Correction: You can update your profile information (name, academic year, theme preference) in account settings.
• Deletion: You can request account deletion by contacting support@studimoe.com.
• Portability: You can export or view your data through the dashboard interface.
• Objection: You may object to our processing of your data by contacting privacy@studimoe.com.

To exercise any of these rights, please contact us. We will respond within the timeframe required by applicable law.

Studimoe is operated from the United States. If you are accessing our services from outside the United States, please be aware that your data will be transferred to, stored, and processed in the United States. Our third-party service providers (InstantDB, OpenAI, Vercel, Stripe) may also process data in jurisdictions where they operate.

By using Studimoe, you consent to the transfer of your data to the United States and other jurisdictions as described above.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. If we make material changes, we will notify you through the platform, via email, or by updating the "Last Updated" date at the top of this page.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Privacy inquiries: privacy@studimoe.com
• General support: support@studimoe.com
• Legal inquiries: legal@studimoe.com
• Academic integrity concerns: integrity@studimoe.com