Privacy Policy
Last updated: March 2026
1. Information We Collect
We collect: (a) Account information — email address and name when you register. (b) Usage data — courses you create, videos watched, notes taken, quiz results, and learning activity. (c) Technical data — IP address, browser type, and device information for security and analytics. We do not collect payment information directly — this is handled by Stripe.
2. How We Use Your Information
We use your data to: provide and improve the Service; personalise your learning experience (resume positions, progress tracking); send account-related emails (confirmations, password resets); analyse usage patterns to improve features; and comply with legal obligations. We do not sell your personal data to third parties.
3. Data Storage
Your data is stored on Supabase (PostgreSQL database hosted on AWS in Tokyo, Japan). Backups are maintained for 7 days. We use industry-standard encryption for data in transit (HTTPS/TLS) and at rest.
4. Third-Party Services
We use the following third-party services: YouTube API (Google) — to fetch video data; Stripe — for payment processing; OpenAI — to generate AI-powered quizzes, notes, and flashcards (anonymised video transcripts are sent); PostHog — for product analytics (anonymised usage events); Vercel — for hosting. Each provider has their own privacy policy.
5. AI Features
When you use AI features (quiz generation, note transcription, flashcards), anonymised content from YouTube transcripts or your notes may be sent to OpenAI's API. We do not send any personally identifiable information to OpenAI. You can opt out of AI features by using the manual alternatives.
6. Cookies
We use essential cookies for authentication (Supabase session tokens) and local storage for preferences (e.g., onboarding state). We do not use advertising cookies. Analytics events are sent without cookies via PostHog.
7. Data Retention
We retain your account data for as long as your account is active. You can request deletion of your account at any time from the Profile page. Upon deletion, your personal data is removed within 30 days, except where required by law.
8. Your Rights
Depending on your location, you may have the right to: access the personal data we hold about you; correct inaccurate data; request deletion of your data; export your data in a portable format; object to processing of your data. To exercise these rights, contact us at hello@scribeo.app.
9. Children's Privacy
Scribeo is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us immediately.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes via email or a notice within the Service. Your continued use after changes constitutes acceptance of the updated policy.
11. Contact Us
For privacy-related questions or to exercise your rights, contact us at hello@scribeo.app.