Privacy policy
The short version: signed out, your study data never leaves your browser. Signed in, it is stored against your account so it follows you between devices. We do not sell anything to anyone, and you can download or wipe everything from Settings without asking us.
What is stored, and where
- Study data, signed out — in your browser only. Your courses, exam dates, sets, cards and practice history are saved in your browser's local storage on the device you are using. Nothing is sent to us. Clearing your browser data deletes it, and it does not follow you to another device.
- Study data, signed in — on our database. The same study data is stored against your account so it syncs to any device you sign in on. It is held in Supabase (Postgres, hosted in the United States) under row-level security, which means the database itself rejects any read of your rows by another account. When you sign out, the copy on that device is erased.
- Accounts. An account stores your email address, a display name and a handle. Passwords are never stored in readable form — Supabase Auth holds a one-way hash. If you sign in with Google, Google tells us your email address and name and nothing else; we never receive your Google password and have no access to your Google account. Accounts are optional: the whole site works signed out.
- Material you upload to the AI set builder. Text you paste or files you attach are sent to our AI provider to draft a set, and to us only for as long as that request takes. They are not published, not shown to other users, and not used to train any model. Do not upload anything you do not have the right to share.
- Your study profile. If you fill in a level, school, programme or current courses in Settings, those four fields are stored with your study data and sent along with your requests to the AI set builder so it can write at the right level. They are never included in anything you publish and are never shown to other users. Leave them blank and nothing is sent. When nothing is attached to a request and you have left the option on, the AI provider may run up to three web searches to find a course outline or published learning objectives; the search terms are drawn from your request and profile, not from your study history.
- Payments. If you buy a plan, Stripe collects and holds your card details and billing address under its own privacy policy; we never receive your card number. We store the Stripe customer and subscription identifiers, the plan name, its status and the renewal date, so the app knows what you are entitled to. Nothing else about the payment is kept here.
- Free-draft and abuse counters. To offer one draft without an account and to stop that from being abused, the server keeps a counter keyed by a one-way hash of your IP address and of a random device cookie. The hash cannot be turned back into an address, the raw values are never stored, and the entries are deleted after 60 days of inactivity.
- Server logs. Our host records standard request logs, including IP address and user agent, for security and abuse prevention, and discards them on its own schedule.
Cookies and measurement
No cookies are set for advertising or analytics until you choose on the consent banner. Local storage is used to remember your study data, your sign-in session, your plan and your consent choice; that is functional storage, not tracking, and the site cannot work without it. One functional cookie, cs_dev, holds a random device identifier used only for the free-draft counter described above; it identifies this browser to us and nobody else.
If advertising is enabled in future, third-party ad providers may set cookies or use device identifiers to serve and measure ads, subject to your consent choice. You can change that choice at any time by clearing this site's data in your browser. Where Google advertising is used, Google's own practices are described at policies.google.com/technologies/partner-sites.
What we never do
- Sell or rent personal information.
- Use your uploaded material to train models.
- Show your private sets, courses, exam dates or scores to anyone else.
- Email you anything but sign-in links, password resets and account notices. There is no marketing list.
- Build advertising profiles from what you study.
Your choices
Settings has a button that downloads everything we hold for you as a single JSON file, and one that erases all practice history. Signing out clears your data from that device. To delete an account and everything stored against it, write to asarrett@chalkset.com from the address on the account and it is removed within 30 days — a self-service delete button is being built. For anything else — access, correction, or a question about how any of this works — the same address reaches us and we respond within 30 days.
Depending on where you live you may have rights under the GDPR, the UK GDPR, or US state privacy laws including the CCPA, such as the right to access, correct, delete or port your data and to object to certain processing. We honour these requests regardless of where you live.
Age
Chalkset is not directed to children under 13 and we do not knowingly collect personal information from them. If you believe a child under 13 has provided us information, contact asarrett@chalkset.com and it will be deleted. Users between 13 and the age of majority should have a parent or guardian review these terms.
Changes
If this policy changes materially, the date above changes and a notice appears on the site. Continuing to use Chalkset after that means you accept the revision.
Who to contact
Chalkset — asarrett@chalkset.com