Last updated: October 28, 2026
This Privacy Policy explains how PupilBot (“we,” “us,” or “our”) collects, uses, stores, and protects your personal data when you use our web application, iOS application, Telegram bot, and MCP connector (collectively, the “Service”).
We are committed to protecting your privacy in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable Romanian data protection law. Please also review our Terms of Service.
The data controller responsible for your personal data is:
When you create an account, we collect:
The core function of the Service is to turn your study materials into practice questions. When you upload material, we collect and generate:
You retain ownership of any material you upload. We process it only to provide the Service to you.
If you subscribe to PupilBot premium via the iOS app (Apple In-App Purchase), we receive from Apple:
If you subscribe via the web (Stripe), we store:
We do not receive or store your payment card details. All payment processing is handled by Apple or Stripe respectively.
If you link a Telegram account, we additionally store:
For billing transparency and reliability, we log internal usage of AI models (model name, token counts, cost in USD, type of operation — e.g. topic extraction, question generation, answer grading) tied to your user ID. Audit logs use hashed (SHA-256) email identifiers rather than plaintext email addresses.
We also record lightweight product-usage events tied to your user ID — which screens you open, when a study finishes processing or fails, when an upload limit or upgrade screen is shown, when a practice session ends, and when a notification is sent or opened. Each event stores an event name, a small context object (for example the screen name or a study ID), and a timestamp. We do not record the content of your study materials, questions, or answers in these events, and we do not use third-party behavioural advertising or cross-site tracking SDKs. If you delete your account, these rows are kept in anonymised form with the user ID removed.
You can connect an AI assistant, such as Claude, to your PupilBot account through OAuth.
The connector reads your studies, topics, questions, answers, feedback, weak spots, due reviews, and progress.
It can also create a study from text that you choose to send through the assistant.
We receive tool names, tool arguments, authentication data, and the client identifier. We do not request your full conversation history.
We store submitted study text and derived practice content in your account. Read tools return existing data without calling an AI provider.
We record tool names and success status as usage events. These events exclude study text and answer content.
OAuth records include the client name, client identifier, redirect addresses, approved scope, token hashes, and expiry times.
The assistant receives each tool result. Its provider handles those results under its own privacy policy and your account settings.
For Claude, see Anthropic’s privacy policy.
Disconnect an assistant in PupilBot Settings under Connected apps to end its access.
Disconnecting does not delete data that the assistant already received. Use that provider’s controls to manage those copies.
In the iOS app and the web app, you can dictate a free-form answer instead of typing it. Dictation starts only when you tap the dictation button. It stops when you stop it, or after 2 minutes.
When you dictate, we process:
We do not store the audio. Our server forwards it in memory and does not write it to disk, to the database, or to logs. We do not store the transcript either: we return it to your device, where you can edit it before you submit it. If you submit it, we store it as your answer (see Section 3.2). We record when dictation starts or fails as product-usage events (see Section 3.7); these events do not contain audio or transcript text.
Dictation is optional; you can always type your answer instead. To stop all dictation, turn off microphone access for PupilBot. On iOS, go to Settings > PupilBot > Microphone. On the web, block the microphone for www.pupilbot.com in your browser’s site settings.
The iOS app requests an attribution token from Apple’s AdServices framework and sends it to our server. We send the token to Apple, and Apple tells us whether the install came from an Apple Search Ads ad. We store Apple’s answer once per account:
We keep Apple’s response as received, but we do not store the token. Apple’s response does not contain your name, email address, or Apple ID. We use it only to measure our own Apple Search Ads campaigns.
To object to this processing, email [email protected], and we delete the attribution data for your account. Deleting your account also deletes it.
We process your personal data for the following purposes, each with a corresponding legal basis under GDPR Article 6(1):
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Account creation & authentication | Account data, OAuth data, auth tokens | Art. 6(1)(b) — Performance of contract |
| Running OCR on uploaded files | Uploaded study material files | Art. 6(1)(b) — Performance of contract |
| Generating topics, questions & grading answers | OCR text, your answers | Art. 6(1)(b) — Performance of contract |
| Transcribing voice dictation (only when you start it) | Microphone audio, transcript, app language, question text | Art. 6(1)(b) — Performance of contract |
| Adaptive scheduling & mastery tracking | Answers, mastery scores, review history | Art. 6(1)(b) — Performance of contract |
| Subscription management | Apple/Stripe transaction data, subscription status | Art. 6(1)(b) — Performance of contract |
| Sending proactive practice reminders via Telegram | Telegram chat ID, scheduled session data | Art. 6(1)(b) — Performance of contract (you opted in by linking Telegram) |
| Transactional email (password reset, welcome) | Email address | Art. 6(1)(b) — Performance of contract |
| Security (fraud prevention, token management) | IP address, device info, auth tokens | Art. 6(1)(f) — Legitimate interest |
| Cost tracking & abuse prevention for AI calls | Token counts, model usage tied to user ID | Art. 6(1)(f) — Legitimate interest |
| Understanding how the Service is used (product analytics) | Product-usage events tied to user ID (screen names, feature usage, timestamps) | Art. 6(1)(f) — Legitimate interest |
| Measuring our own Apple Search Ads campaigns (ad attribution) | Apple Search Ads attribution data (campaign, ad group, keyword and ad identifiers; click date; country or region) | Art. 6(1)(f) — Legitimate interest |
| Improving the Service (aggregated/anonymised metrics) | Anonymised usage data | Art. 6(1)(f) — Legitimate interest |
We do not use your study materials, questions, answers, or dictation audio to train AI models. Anthropic and OpenAI do not use data sent through their APIs to train their models under their API terms. ElevenLabs’ privacy policy allows it to use inputs to improve its models unless the account opts out; we have opted our account out of that use, so ElevenLabs processes your dictation audio only to return the transcript. Each provider processes that data under the API terms and data processing addendum linked from its privacy policy (see Section 7).
Because study materials are central to the Service, we want to be specific about how they are handled:
We share personal data only with the following third-party service providers (processors), strictly for the purposes described:
Each processor listed below is bound by a data processing agreement, or by API terms with equal effect, that requires it to protect your personal data to a standard at least equal to this Privacy Policy. Apple (Sign in with Apple, App Store purchases, Apple Search Ads attribution) and Telegram (the Telegram messaging platform) operate their services to you directly as independent controllers and protect your data under their own privacy policies to the same standard; we share with them only the data listed in the table.
| Provider | Purpose | Data Shared | Location |
|---|---|---|---|
| Cloudflare (R2) | Storage of uploaded study material files | Uploaded image files (tied to user account) | EU-preferred regions |
| Hetzner Online GmbH | Application and database hosting | Account data, study content, answers, and usage records | Germany (EU) |
| Ollama Cloud | OCR text extraction | Uploaded page images | International cloud processing |
| Anthropic | Text refinement, topics, questions, answer grading, tutor replies, and dictation transcript cleanup | Study text, questions, answers, dictation transcripts, and relevant practice context | USA / international processing |
| ElevenLabs | Speech-to-text for voice dictation (only when you dictate) | Microphone audio of your dictated answer, app language | USA (EU-US Data Privacy Framework) |
| OpenAI | Text processing and practice features, if configured | OCR text, generated questions, your answers, dictation transcripts | USA (EU-US Data Privacy Framework) |
| Apple | Sign in with Apple, subscription/payment processing (IAP), push notifications (APNs) & Apple Search Ads attribution (iOS) | Apple ID, transaction IDs, subscription status, APNs device token and the content of each notification we send (practice reminders, study-ready notices with the study title, replies from our support team) together with the identifiers the app needs to open the right screen (study/material ID, support message ID), AdServices attribution token | USA (EU-US Data Privacy Framework) |
| Stripe | Web subscription & payment processing | Email, billing details (card details handled by Stripe, never by us), subscription status | USA / Ireland (EU) |
| Resend | Transactional email delivery (password reset, welcome) | Email address, email content | USA (EU-US Data Privacy Framework) |
| Telegram | Practice reminders & bot conversations (only if you link Telegram) | Chat ID, question text, your answers, grading messages | Global |
We do not sell your personal data. Apart from sending Apple the AdServices attribution token that Apple created on your device (see Section 3.10), we do not share data with advertisers or ad networks. We do not engage in profiling for marketing purposes. We do not use your data to train third-party AI models.
Your personal data is primarily stored on servers within the European Union (Cloudflare R2 EU regions, Hetzner Germany, our own application database). Where data is transferred to service providers outside the EU (Anthropic, Apple, ElevenLabs, OpenAI, Resend in the USA; Ollama Cloud internationally; Telegram globally), such transfers are protected by:
We retain your personal data only for as long as necessary to fulfil the purposes described in this policy:
| Data Category | Retention Period |
|---|---|
| Account data | Until you delete your account |
| Uploaded study materials & derived content (OCR text, topics, questions, answers, mastery) | Until you delete the material or your account |
| Voice dictation audio and transcripts | Not stored by us. Our server forwards the audio to ElevenLabs during the dictation (2 minutes at most) and returns the transcript to your device. A transcript that you submit is kept as your answer (see above). ElevenLabs may keep a copy of the audio and transcript in the request logs for our account under its API terms, and its privacy policy says it keeps voice-derived data for no longer than 3 years after the last interaction. To have that copy deleted, email [email protected]; we forward the request to ElevenLabs and confirm to you when it is done. |
| Push notification device token | Until Apple reports the token invalid or until you delete your account |
| Apple Search Ads attribution data | Until you delete your account |
| Subscription data | Until you delete your account (Apple/Stripe retain their own records independently for accounting and tax purposes) |
| Refresh tokens | Access lasts until expiry or revocation. MCP refresh tokens expire after 180 days unless renewed. Token records remain until account deletion. |
| MCP client registrations and authorization codes | Client registrations remain for connection support. Authorization codes expire after 10 minutes and permit 1 use. |
| Product usage events, including MCP tool events | No fixed automatic expiry. Account deletion removes the user identifier; anonymous event records remain. |
| Password reset tokens | 1 hour or until used, whichever comes first |
| Telegram link codes | 15 minutes or until used, whichever comes first |
| AI usage telemetry (model name, token counts, cost) | Retained for billing transparency and operational integrity |
| Webhook logs (Apple, Stripe) | Retained for operational integrity and accounting |
Account deletion removes your account, studies, answers, and associated files in Cloudflare R2. Usage records remain with user identifiers removed, as described above.
Under the GDPR, you have the following rights regarding your personal data:
How to exercise your rights: Email [email protected] with the subject line “GDPR Request.” You may also delete your account and all associated data directly within the Service. We will respond to all requests within 30 days.
PupilBot uses a JWT-based authentication system, not traditional browser cookies for session management.
The Service is not directed at children under the age of 16 (the GDPR age threshold for consent to data processing in most EU member states; some member states set a lower limit, no lower than 13). We do not knowingly collect personal data from children under 16 without verifiable parental consent. If we become aware that we have collected personal data from a child under 16 without such consent, we will take steps to delete that data promptly. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at [email protected].
We implement appropriate technical and organisational measures to protect your personal data, including:
We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page will be revised accordingly. For material changes that affect how we process your personal data, we will notify registered users by email. Previous versions of this policy are available upon request.
For privacy-related inquiries or to exercise your GDPR rights, please contact us:
We will respond to all GDPR requests within 30 days of receipt.