Privacy policy

ClassFactor, Inc. (“ClassFactor”, “we”, “us”, “our”) provides an AI study platform. You upload your own study material — notes, PDFs, slides, images, audio, video, and links — and ClassFactor turns it into flashcards, quizzes, and timed exams, explains answers through an AI tutor, and schedules your reviews using spaced repetition. The platform is available on the web and through our iOS and Android apps.

This policy applies to those websites and apps and to the related services, features, and support channels we operate (together, the “Services”). It describes how we handle personal data — information that identifies you or can reasonably be linked to you.

This policy does not cover third-party sites or services you reach from ClassFactor, or the practices of a school, employer, or other organization that may separately hold information about you. It also does not replace our Terms of Service (/terms), Cookie Policy (/cookies), Data Processing Addendum (/dpa), or Refund Policy (/refunds), which cover related ground.

ClassFactor, Inc. is the controller of the personal data described in this policy and is responsible for it. You can reach us using any of the addresses in “Contact us” at the end of this page.

We collect only the data we need to run the Services, bill for them, keep them secure, and comply with the law.

We do not sell your personal data, and we do not share it for cross-context behavioral advertising.

We do not permit third-party AI model providers to use your private study content to train their models without your consent.

You can delete your account and your content from inside the product, on the web and in our mobile apps.

Account data. What you provide when you create or manage an account: your name, email address, and password (stored only as a salted hash, never in readable form). If you sign in through a third-party identity provider such as Google, we receive the basic profile information that provider shares with us — typically your name, email address, and profile image.

Study content. The material you upload, paste, link, or record — documents, PDFs, slide decks, images, audio, video, and text — together with everything the Services generate from it: decks, flashcards, questions, quizzes, exams, tutor conversations, scores, review schedules, and progress history.

Usage and telemetry data. How you interact with the Services: features used, study sessions, items reviewed, pages and screens viewed, referring pages, timestamps, error and crash reports, and performance diagnostics. We use this to run, debug, and improve the product.

Device and connection data. IP address (from which we derive an approximate, city-level location), browser type and version, operating system, device model, language and time-zone settings, app version, and identifiers we generate to keep your session working across devices.

Payment data. Your plan (Free, Pro at $12/month, or Medical at $24/month), subscription status, renewal dates, invoices, and billing history. Card details are collected and processed directly by our payment processor, Stripe. ClassFactor never sees or stores full card numbers, CVV codes, or full bank account numbers.

Support and communications. Messages, support tickets, bug reports, and feedback you send us, along with the contact details and any attachments or screenshots included, plus your notification and email preferences.

Cookies and similar technologies. Cookies, local storage, and comparable technologies used to keep you signed in, remember preferences, secure the Services, and — where you consent — measure usage. See the Cookie Policy (/cookies) for the full inventory and your controls.

We do not intentionally collect special categories of data such as health, biometric, or precise geolocation data. If you choose to upload study material that happens to contain sensitive information — for example medical course notes — that material is handled as study content under this policy and is not used to infer anything about you.

To perform our contract with you. Operating the Services: creating and maintaining your account, processing your uploads, generating flashcards, quizzes, exams, and tutor explanations, scheduling spaced repetition, tracking mastery, syncing across your devices, and providing customer support.

To take payment. Processing subscriptions and one-time charges through Stripe, issuing invoices and receipts, applying refunds under our Refund Policy (/refunds), managing renewals and cancellations, and keeping the accounting records the law requires us to keep.

For our legitimate interests in running a functioning, safe product. Securing accounts, detecting and preventing fraud, abuse, and automated scraping, enforcing usage limits, debugging, measuring aggregate product performance, and improving question quality and the accuracy of generated material.

With your consent. Optional analytics and non-essential cookies, marketing and product-update emails, and any feature we describe at the time as opt-in. You can withdraw consent at any time — through the cookie banner, your notification settings, or the unsubscribe link in any marketing email — without affecting the lawfulness of what we did before you withdrew it.

To comply with legal obligations and protect rights. Responding to lawful requests, retaining records we are required to retain, resolving disputes, and protecting the rights, property, and safety of our users, the public, and ClassFactor.

We use aggregated and de-identified data — data that no longer identifies you or your account — to understand how the Services are used and to improve them. We do not attempt to re-identify de-identified data, and we require the same of anyone we share it with.

AI processing is central to how ClassFactor works, so we want to be specific about it. When you ask the Services to generate flashcards, quizzes, exams, or tutor explanations, we transmit the relevant portions of your study material — which may include the full text or a transcript of what you uploaded — to third-party AI model providers that run the models we use. Those providers return the generated result to us, and we return it to you.

The AI model providers we currently use are OpenAI, Anthropic, and Google. Each processes this content as our service provider, under terms that require them to process it only to deliver the requested output to us, to keep it confidential, to apply appropriate security measures, and not to use it for their own purposes. We may add or change providers as the technology moves; when we do, we will update this list.

Audio and video you upload for transcription are sent to OpenAI to be converted to text. If you use the AI tutor’s voice mode, your microphone audio is streamed from your browser or app directly to OpenAI for the duration of the call, and your speech is transcribed there so the tutor can respond. That audio does not pass through ClassFactor’s servers; we receive and store the resulting transcript as part of your study content.

Images you upload for image occlusion or for conversion into notes are sent to Google or Anthropic for analysis, depending on the feature.

We do not permit these providers to use your private study content or tutor conversations to train or fine-tune their models, and we do not do so ourselves, without your consent. If we ever offer a program where you can opt in to contribute content for model improvement, it will be clearly described, genuinely optional, and revocable.

Providers may retain a short-lived copy of a request for the limited purposes of delivering the response, operating their service, and monitoring for abuse, as permitted by our agreements with them and their own enterprise data policies. They do not retain it for their own product development, and any such copy is deleted on their normal cycle.

Two practical notes. First, AI-generated material can be wrong, incomplete, or misleading; it is a study aid, not an authoritative source, and you should verify anything that matters. Second, please do not upload material you are not permitted to share, or content containing other people’s sensitive personal information, since doing so sends that material to our providers as described above.

We do not use your content or the outputs generated from it to build advertising profiles, and we do not sell either.

ClassFactor may remove, disable access to, or permanently delete any content stored in or generated through the Services at any time, with or without notice to you. Reasons include, but are not limited to: violations of our Terms of Service (/terms) or acceptable-use rules; content that creates legal risk for us or for others, including suspected infringement of intellectual property or privacy rights; security incidents or suspected abuse; responses to valid legal process; and operational, storage, cost, or technical reasons.

We will try to give notice where it is practical and lawful to do so, but we are not obligated to and there are situations — legal orders, security incidents, active abuse — where we will not.

Because of this, you are responsible for keeping your own copies of anything you need. ClassFactor is not a backup service and should not be treated as your system of record. Export or retain a personal copy of any notes, uploads, or generated material you would not want to lose.

Service providers. We share data with vendors who perform work on our behalf. They receive only what they need for that work, are bound by contract to protect it, must act only on our instructions, and may not use it for their own purposes. The vendors we currently rely on are: Railway (application hosting, database, and job queue), Vercel (website and web app hosting), Cloudflare R2 (storage of files you upload), OpenAI, Anthropic, and Google (AI model processing, as described above), Stripe (payments and subscription billing), our transactional email provider (account, security, and notification email), Google Analytics (website and product usage measurement, only where you have consented), and Expo (mobile app build and distribution tooling). We will update this list as our vendors change.

Legal process and safety. We may disclose data when we believe in good faith that disclosure is required by law, regulation, subpoena, court order, or other valid legal process, or is reasonably necessary to enforce our terms, investigate suspected fraud or abuse, or protect the rights, property, or safety of our users, the public, or ClassFactor. Where we are legally permitted to notify you of a request for your data, we will make reasonable efforts to do so.

Business transfers. If ClassFactor is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of its assets, personal data may be transferred as part of that transaction. Any recipient will remain bound by this policy for the data it receives unless and until you are given notice of and agree to a different one.

With your direction. We share data with third parties when you tell us to — for example, when you connect an account or share content you have created.

We do not sell your personal data for money or other valuable consideration, and we do not share it for cross-context behavioral advertising, as those terms are defined under California law. We have not done so in the preceding twelve months, including for anyone under 16.

We keep your personal data while your account is active and for as long as we need it to provide the Services. Your account data, study content, and progress history are kept until you delete them or delete your account, because they are what the product is for — a deck you made two years ago is still yours to review. Usage and telemetry data and server logs are kept for a limited period for debugging, security, and abuse investigation, and are then deleted or aggregated into figures that no longer identify you. Support conversations are kept while they are open and for a reasonable period afterwards so we have the history if you write back. Billing and transaction records are kept for as long as tax and accounting law requires.

You can delete individual uploads, decks, quizzes, and exams at any time from inside the product. You can delete your entire account from your account settings on the web and in the mobile apps. Account deletion is confirmed by email, so it cannot be triggered by someone with momentary access to your device.

Account deletion is immediate and permanent. When you confirm it, we delete your account together with the data attached to it — your uploads, decks, cards, quizzes, exams, tutor conversations, and progress history — in a single cascading deletion. There is no waiting period during which you can change your mind, and we cannot restore an account once it is gone, so export anything you want to keep first. The confirmation link we email you is valid for one hour; after that it expires and you would need to start the request again. Copies may persist for a limited additional period in routine backups and server logs until those are rotated on their normal cycle, after which they are overwritten.

Some records survive account deletion because we are required to keep them. These include billing and transaction records retained for tax, accounting, and audit purposes; records needed to comply with a legal obligation, resolve a dispute, or enforce our agreements; and security and abuse records where retention is necessary to protect the Services. We keep the minimum needed for those purposes and no longer.

Deletion of your ClassFactor account does not by itself delete records held by Stripe about payments you made; Stripe retains transaction records under its own obligations and policies.

We protect personal data with a combination of technical and organizational measures. These include encryption of data in transit using TLS; storage on infrastructure from established cloud providers that encrypt data at rest at the platform level; passwords stored only as salted hashes; time-limited signed URLs for access to uploaded files, so they are not publicly reachable; role-based access controls that limit internal access to staff who need it for their job; network and infrastructure isolation; logging and monitoring of access to production systems; and review of code changes that affect security-sensitive areas.

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. We do not promise that the Services will be free of vulnerabilities or that unauthorized access will never occur.

You also play a part: use a strong, unique password, do not reuse it elsewhere, keep your devices updated, and tell us promptly if you believe your account has been accessed without your permission.

If a breach affecting your personal data occurs, we will notify affected users, and any regulator that must be told, without unreasonable delay and within the deadlines set by the laws that apply to you.

To report a suspected vulnerability or security issue, email security@classfactor.com.

ClassFactor is intended for users aged 13 and older. The Services are not directed to children under 13, we do not knowingly create accounts for them, and we do not knowingly collect personal data from them.

If we learn that we have collected personal data from a child under 13, we will delete the account and the associated data promptly. If you are a parent or guardian and believe a child under 13 has provided us personal data, email privacy@classfactor.com with enough detail to identify the account and we will investigate and delete it.

Users between 13 and the age of majority in their state should review this policy with a parent or guardian before creating an account.

There is no route into ClassFactor for a child under 13, including through a school, tutor, or other organization. An educator can build study material with ClassFactor and share it, but everyone who studies it needs their own account and must be 13 or older to have one.

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act gives you specific rights over your personal information. This section describes them and how to use them.

Categories of personal information we have collected in the preceding twelve months: identifiers (name, email address, account identifier, IP address); customer records information (billing and subscription details, with card data handled by Stripe); commercial information (plan purchased, subscription and transaction history); internet and other electronic network activity (usage, telemetry, device, and interaction data); geolocation data limited to approximate, city-level location derived from IP address; audio, electronic, visual, or similar information where you upload audio, video, or images as study material; professional or education-related information you choose to include in your study content or profile; and inferences drawn from your study activity, such as topic mastery estimates used to schedule reviews.

Sources of that information: you (directly, when you register, upload material, subscribe, or contact us); your devices and browsers automatically as you use the Services; identity providers such as Google when you choose to sign in through them; and our service providers, including Stripe for payment status.

Business and commercial purposes for collecting it: providing and maintaining the Services, generating study material, processing payments, providing support, securing accounts and preventing fraud, debugging and improving the product, and complying with legal obligations. These purposes are described in more detail above.

Disclosures for a business purpose: we disclose the categories above to the categories of recipients described in “How we share data” — service providers (hosting, AI model providers, payment processing, email delivery, analytics, support tooling), legal and regulatory authorities where required, and parties to a business transfer.

We do not sell personal information and we do not share it for cross-context behavioral advertising. We have not done so in the preceding twelve months. Because of this there is nothing for you to opt out of, but you may still submit a “Do Not Sell or Share My Personal Information” request and we will confirm our practice in writing.

Your rights: the right to know what personal information we have collected, used, disclosed, and the categories of sources and recipients; the right to a copy of the specific pieces of personal information we hold about you, in a portable format; the right to delete personal information we have collected from you, subject to legal exceptions; the right to correct inaccurate personal information; the right to opt out of sale or sharing; the right to limit the use of sensitive personal information, which is not applicable because we do not use sensitive personal information for purposes that trigger this right; and the right not to be discriminated or retaliated against for exercising any of these rights.

Non-discrimination: we will not deny you the Services, charge you a different price, provide a different quality of service, or penalize you in any way for exercising your privacy rights. We do not offer financial incentives in exchange for personal information.

How to submit a request: email privacy@classfactor.com from the address on your ClassFactor account. You can also handle some of this yourself — your account settings let you review and correct your profile, export your decks and cards as a file, delete individual content, and delete your whole account. For a copy of everything else we hold about you, email us and we will put it together. We will verify your identity before acting on a request to know, correct, or delete — usually by confirming control of the email address on the account, and for more sensitive requests by asking for additional information that we use only for verification. We respond within the timeframes required by law, generally 45 days, with one 45-day extension where necessary and with notice to you.

Authorized agents: you may use an authorized agent to submit a request on your behalf. The agent must provide written, signed permission from you, and we may ask you to verify your own identity directly with us and to confirm that you authorized the agent, unless the agent provides a valid power of attorney.

Comprehensive state privacy laws — including those in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states as their laws take effect — give residents of those states rights that are similar to the California rights described above. Where such a law applies to you, you generally have the right to confirm whether we process your personal data and to access it; to obtain a portable copy; to correct inaccuracies; to delete personal data you provided or that we obtained about you; and to opt out of targeted advertising, of the sale of personal data, and of profiling in furtherance of decisions that produce legal or similarly significant effects.

We do not sell personal data, do not use it for targeted advertising, and do not engage in profiling that produces legal or similarly significant effects about you, so those opt-outs have nothing to act on. We honor them as confirmations of that practice, and we honor recognized universal opt-out signals such as Global Privacy Control where the law requires it.

To exercise any of these rights, email privacy@classfactor.com or use the tools in your account settings. We apply the same verification process described in the California section and respond within the deadline set by your state’s law.

Appeals. If we decline your request, we will tell you why. Residents of states that provide an appeal right — including Virginia, Colorado, Connecticut, Texas, Oregon, and Montana — may appeal that decision by replying to our response or emailing privacy@classfactor.com with the subject line “Privacy request appeal”. We will review the appeal and respond in writing within the period your state’s law allows. If we deny the appeal, we will provide a method for you to contact your state attorney general to submit a complaint.

We do not discriminate against anyone for exercising rights under any state privacy law.

Our iOS and Android apps collect the same categories of data described in this policy: account data, study content, usage and telemetry, device data, support communications, and subscription status. The disclosures we make in Apple’s App Privacy “nutrition label” on the App Store and in Google Play’s Data safety form are intended to describe the same collection and use described here. If you ever see a discrepancy between those disclosures and this policy, tell us at privacy@classfactor.com so we can correct it.

Device permissions. The apps ask for permission before accessing anything sensitive on your device. Microphone access is used to record audio you want turned into study material and to speak with the AI tutor by voice. Camera and photo library access are used when you capture or select images of notes, slides, or textbook pages to upload. Files and storage access is used to select documents you choose to upload. Notification permission is used to send study reminders and account alerts you have enabled.

Every one of these permissions is optional. The app requests them only in the moment the related feature is used, and declining a permission only disables that feature — it does not block you from using the rest of the app. You can grant or revoke any permission at any time in your device’s operating system settings (iOS Settings > ClassFactor, or Android Settings > Apps > ClassFactor > Permissions). We do not access your microphone, camera, or photo library in the background.

Push notifications. If you enable notifications, Apple or Google issues a device push token that we store and use solely to deliver the notifications you asked for — study reminders, streak and review prompts, and account or security alerts. We do not use push tokens for advertising. You can turn notifications off inside the app or in your device settings, and turning them off in device settings stops delivery regardless of your in-app preferences.

Advertising identifiers. ClassFactor does not use the Apple Identifier for Advertisers (IDFA), the Google Advertising ID (GAID/AAID), or any comparable mobile advertising identifier. We do not run advertising in the apps, do not track you across other companies’ apps or websites, and do not present the App Tracking Transparency prompt because we do not engage in tracking as Apple defines it.

Account and data deletion. As required by Apple App Store Review Guideline 5.1.1(v) and Google Play’s user data deletion policy, you can delete your ClassFactor account and its associated data from inside the app — go to Settings, then Account, then Delete account — and confirm by email. You can do the same from your account settings on the web, and you can request deletion by emailing privacy@classfactor.com from your account address. Deleting the app from your device does not delete your account; use one of the routes above. What happens to your data on deletion, and what records survive it, is described in “Retention and deletion”.

Purchases. All ClassFactor subscriptions are processed by Stripe, whether you subscribe on the web or from within a mobile app. We do not sell subscriptions through Apple In-App Purchase or Google Play Billing. When you start a subscription from a mobile app, the app opens Stripe’s secure checkout page in your browser; payment details are entered there and go to Stripe, not to the app and not to us. Apple and Google therefore do not receive purchase data about you from ClassFactor.

We use cookies, local storage, and similar technologies to keep you signed in, remember your preferences, protect against fraud and abuse, and — where you consent — measure how the Services are used so we can improve them. Strictly necessary cookies are always on because the Services cannot function without them.

You can accept or decline non-essential cookies through our consent banner, change your choice at any time from the cookie settings link, and block or delete cookies in your browser settings. Blocking essential cookies will break sign-in and other core features.

Our full cookie inventory, the analytics tools we use, and your controls are described in the Cookie Policy (/cookies).

ClassFactor is offered in the United States only at launch, and we process and store personal data in the United States. Our hosting, storage, and AI model providers may operate infrastructure in more than one US region.

If you access the Services from outside the United States, you should be aware that your data will be transferred to and processed in the United States, where privacy laws differ from those in your country. We do not currently offer the Services in the European Economic Area, the United Kingdom, or Switzerland, and this policy does not make representations about GDPR or UK GDPR transfer mechanisms. If we begin offering the Services in those regions, we will update this policy before doing so.

We may update this policy as the Services change or as the law requires. When we do, we will revise the “last updated” date at the top of this page and post the updated policy here.

If the changes are material — for example, a new category of data, a new purpose, or a new category of recipient — we will give you advance notice by email to the address on your account, by an in-product notice, or both, before the change takes effect. Where the law requires your consent for a change, we will ask for it rather than assume it.

Continuing to use the Services after an update takes effect means the updated policy applies to you. If you do not agree with a change, you can delete your account as described above. If you want to see the version of this policy that applied on a particular date, email privacy@classfactor.com and we will send it to you.

Privacy questions, requests, and complaints: privacy@classfactor.com. Legal notices: legal@classfactor.com. Security reports: security@classfactor.com. General help: support@classfactor.com. Billing: billing@classfactor.com.

You can also reach us through the form on our Contact page (/contact). Privacy requests are handled by our privacy team at privacy@classfactor.com, which is the contact of record for anything in this policy.

We aim to answer privacy requests within the timeframes set by applicable law and to reply to general questions promptly. If you are not satisfied with our response, you may contact the attorney general or consumer protection authority in your state.