Privacy Policy

This Privacy Policy explains how Sylloria (“Sylloria,” “we,” “us,” or “our”) collects, uses, discloses, and retains personal information through sylloria.com, app.sylloria.com, our waitlist, public study links, and related products and services (collectively, the “Service”).

The app may not be publicly available when this Policy takes effect. App-specific practices described below apply when the relevant feature becomes available and you choose to use it.

1. Information we collect

Information you provide

We may collect:

• Waitlist information, including your email address, optional school name, and how you reached the waitlist.
• Account information, including your email address, account identifier, role, sign-in method, and authentication records.
• Class and study information, including Classes, Study Targets, dates, subjects, preferences, tutor settings, and study choices.
• Uploaded materials, including files, file names, types, sizes, extracted text, citations, embeddings, classifications, and other information derived from those materials.
• Chats and prompts, including questions, messages, assistant responses, citations, and conversation history.
• Study activity, including quiz questions and answers, grades, attempts, hints, flashcard reviews, generated study materials, weak-area and concept state, Study Path activity, and related timestamps.
• Communications, including information you send in support, privacy, security, feedback, or other messages.
• Billing information, if paid features launch. Payment details may be collected directly by a payment provider identified at checkout and in an updated version of this Policy.

Information collected automatically

When you use the Service, we and our providers may collect:

• IP address, browser and device type, operating system, referring page, requested URL, access time, approximate location derived from IP, and network, security, and diagnostic information.
• Page views, referrers, country-level location, browser information, route performance, and web-vitals data through Vercel Web Analytics and Vercel Speed Insights on the landing site.
• Pseudonymous identifiers and activity used to maintain a public- study session, enforce rate limits, prevent abuse, and measure aggregate use.
• Operational information such as feature, model, success or failure status, error class, latency, token counts, service tier, quota usage, and estimated cost.

For waitlist rate limiting, the server transiently reads a request address and stores an HMAC-derived hash rather than the raw address in the waitlist database. Those rate-limit hashes are scheduled for deletion before they are approximately 24 hours old. Hosting providers may separately process request addresses in their logs.

The landing site does not upload a file when you select a file on its demo upload control. It only routes you toward the app. Files are transmitted only after you use an authenticated upload feature.

Cookies and browser storage

The Service may use cookies, local storage, and session storage to authenticate accounts, maintain sessions, remember interface preferences, maintain pseudonymous public-study sessions, preserve in-progress study work, recover onboarding actions, and protect the Service from abuse.

Some locally stored quiz state may include answers, feedback, hints, and tutor messages. You can clear browser storage through your browser, but doing so may sign you out, reset preferences, or remove local recovery state. The current Service does not use advertising cookies or advertising pixels.

Information we derive

We may derive embeddings, content fingerprints, source classifications, citations, topic labels, source-support results, weak-area and concept state, study recommendations, and reliability or usage measurements from the information above.

2. How we use information

We use personal information to:

• operate, maintain, secure, and provide the Service;
• manage the waitlist and send waitlist, launch, invitation, and early-access testing updates;
• create accounts and authenticate users;
• receive, validate, store, extract, classify, retrieve, and cite materials;
• generate and grade study content and provide tutor help;
• preserve study progress, history, citations, and recovery state;
• personalize private study recommendations and identify review areas;
• respond to support, privacy, legal, and security requests;
• prevent fraud, abuse, unauthorized access, and excessive automated use;
• troubleshoot, measure reliability, forecast cost, and improve the Service;
• enforce our Terms of Service and protect rights and safety;
• comply with legal obligations and valid legal process.

We do not sell personal information or share it for cross-context behavioral advertising. We do not use private study content for advertising.

3. AI processing

When you use an AI feature, Sylloria may send OpenAI the information needed to perform the request. Depending on the feature, this can include your prompt or answer, selected or retrieved excerpts from uploaded materials, recent conversation context, study settings, generated drafts, and request metadata needed for generation, classification, embeddings, grading, routing, or quality checks.

Our current Responses API configuration uses store: false. This prevents the app from intentionally creating a retrievable stored response object, but it does not mean that OpenAI receives no content or that no provider-side retention can occur. Under OpenAI’s published API data controls, API content is not used to train its models by default unless the customer opts in, and default abuse-monitoring logs may retain content for up to 30 days unless different approved controls or law apply.

Sylloria does not currently train or fine-tune its own general- purpose AI model on private uploads, chats, or answers. We will provide notice and obtain any consent required by law before materially changing that practice.

4. How we disclose information

Service providers

We use providers to host, store, secure, authenticate, analyze, transmit, and process information for the Service.

These providers may use their own subprocessors. They process information to provide services to Sylloria, subject to applicable terms, contracts, and law.

Teachers, creators, and other users

Private account study content is not visible to teachers, other students, or the public by default. If an authorized creator publishes a public study link, anyone with the link may be able to access that experience. The creator may receive aggregate information such as usage counts, common topics, completion, or quiz performance. The current product is not intended to show the creator an identified participant’s private transcript or an authenticated student’s private Study Space.

Other disclosures

We may also disclose information:

• when you direct us to share or export it;
• to professional advisers under appropriate confidentiality obligations;
• to comply with law or legal process, enforce agreements, investigate abuse, or protect rights, property, security, or safety;
• in connection with a financing, merger, acquisition, reorganization, bankruptcy, or sale of business assets; or
• in aggregated or deidentified form that cannot reasonably be linked to you.

5. Retention

We retain personal information only for as long as reasonably necessary to provide the Service, preserve requested study history, secure the Service, resolve disputes, and meet legal obligations.

• Waitlist contact information is retained while early access is active and while reasonably needed for invitations and permitted communications, unless you unsubscribe or request deletion and no legal exception applies.
• Waitlist rate-limit hashes are scheduled for deletion before they are approximately 24 hours old.
• Account and study information is generally retained while your account is active and for a reasonable period afterward.
• Removing a Class or source may initially archive it to preserve related citations, grading, chats, quizzes, and study history. Archiving is not the same as deletion.
• Public-study and operational records are retained for the period reasonably needed to provide the experience, report aggregate activity, enforce limits, maintain security, and resolve disputes.
• Provider copies and backups may remain until they are deleted or overwritten under applicable provider and backup schedules, subject to legal holds and applicable law.

6. Your choices and privacy rights

Depending on where you live, you may have the right to request access to, a copy of, correction of, or deletion of personal information; to withdraw consent; to object to or restrict certain processing; or to appeal a denied request.

Submit a request to help@sylloria.com. We may verify your identity and authority before fulfilling a request. Some information may be exempt when retention is permitted or required for security, fraud prevention, legal compliance, or legal claims. We will not discriminate against you for exercising a privacy right.

You may unsubscribe from promotional or early-access email using the method in the message or by contacting us. We may still send non-promotional account, security, transactional, or legal notices.

7. Do Not Track and Global Privacy Control

Some browsers send Do Not Track or Global Privacy Control signals. The current Service does not sell personal information, share it for cross-context behavioral advertising, or allow advertising networks to track users across unrelated websites. Because we do not currently perform those activities, these signals do not change how the Service operates. If our practices change, we will update this disclosure and honor signals where required by law.

8. Children and teens

The Service is not directed to children under 13, and we do not knowingly collect personal information from a child under 13. If you believe a child under 13 submitted information, contact help@sylloria.com so we can investigate and take appropriate action.

Users who are under the age of legal majority where they live may use the Service only with the permission of a parent or legal guardian. Sylloria will not offer school-directed use involving children or student education records without the additional notices, consent, contracts, security, and deletion controls required for that use.

9. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information. These include authentication, private file storage, owner-scoped database controls, restricted service credentials, request and file validation, usage limits, and security headers.

No security measure is perfect, and we cannot guarantee that information will never be accessed, lost, altered, or disclosed without authorization. Contact help@sylloria.com if you believe you found a vulnerability or security incident.

10. International processing

Sylloria is controlled from the United States. Our providers may process information in the United States and other countries where they operate. Those countries may have different data-protection laws than your country.

The Service is initially intended for users in the United States. We will provide any additional notices, choices, legal bases, or transfer safeguards required before intentionally offering the Service in other jurisdictions.

11. Changes to this Policy

We may update this Policy. The updated version will state a new effective date. For material changes, we will provide additional notice through the Service, by email, or as required by law. We will obtain consent before using previously collected information for a materially different purpose when required.

12. Contact us