Privacy Policy

1. Who We Are

This Privacy Policy explains how the hosted Tenebrite service collects, uses, shares, and protects your personal data.

Tenebrite LLC (“Tenebrite,” “we,” “us,” or “our”) is the controller of the personal data described in this Privacy Policy. Our mailing address for correspondence is 10814 Dorchester Rd #1047, Summerville, SC 29485, United States. For privacy questions, contact privacy@tenebrite.com.

2. Scope

This Policy applies to personal data we process when you visit the Tenebrite website, sign in, use the Service, or otherwise interact with us. It does not apply to third-party services you connect to (such as GitHub or Google), which are governed by their own privacy policies.

The Service is offered only to residents of the United States. It is not offered in the European Union, the European Economic Area, the United Kingdom or Switzerland, and we block access from those regions (see Section 5).

3. Data We Collect

3.1 You provide directly

• Account data. Email address, display name, and profile image obtained from your OAuth provider when you sign in, and the time zone you choose during setup or in Settings, which we use so that “today”, your planner and your weekly stats follow your local midnight. We also store whether you have chosen, in Settings → AI, to see the tutor’s replies as they are written. For an account that has never subscribed, we store when we sent, or tried to send, the warning that it is about to be deleted (see section 9).
• Subscription data. If you subscribe: the customer and subscription identifiers our payment processor assigns, whether your subscription is active, when your current paid period ends, the date a cancellation takes effect if you cancel, and the date of your first charge along with your AI usage total at that moment, which the 7-day money-back guarantee and its 40% condition are measured from. For each checkout we also keep a record of your agreement to automatic renewal: when you gave it and when the checkout completed, which wording you agreed to, the price and billing period, when we emailed you the confirmation (or that it could not be delivered), and when the subscription ended (see section 9). Card details never reach us (see section 7).
• Content data. Pillars, tasks, notes, focus-session records, chat history with the AI tutor, quiz attempts and quick-review answers, and other material you create in the Service.
• Track requests. If you ask us to build a specialized track, the exam you named and when you asked. We use them to decide which tracks to build. They are deleted with your account and included in your data export.
• Integration data. If you connect a third-party tool, the OAuth tokens needed for sync (stored encrypted at rest) and the workspace identifiers required to read or write data on your behalf.
• Support communications. The contents of emails or messages you send us.

3.2 Collected automatically

• Authentication cookies. A session cookie set by NextAuth to keep you signed in. See the Cookie Notice for specifics.
• Operational logs. Server logs may contain request method, path, status code, IP address, user-agent string, and timing for debugging and abuse-prevention. Retention is governed by our hosting provider’s and database provider’s log-retention policies.
• Abuse-prevention counters. To limit how often sign-in, registration and password-reset can be attempted, we keep short-lived counters keyed by the email address entered or by the IP address the request came from. Each counter covers a window of one hour or less, and is deleted within a day after that window ends.
• Activity log. Sign-ins, creating an email-and-password account, a new sign-in method linked to your account, your acceptance of these Terms and this Privacy Policy, changes to your marketing-email and privacy opt-out preferences, password resets, adding or removing your own AI provider key, “Sign out everywhere”, and data exports are recorded with IP address and browser user-agent. Visible in Settings → Privacy → Recent activity. Entries are deleted after 12 months, except acceptance records (see Section 9); all of it is removed when the account is deleted.
• Local-storage preferences. UI preferences (theme, focus-bar position, dismissed onboarding) are stored in your browser’s localStorage and not transmitted to us.

3.3 From third parties

• Identity providers. When you sign in with GitHub or Google, we receive the basic profile fields you authorize. We do not request scopes beyond email, name, and avatar.

4. How We Use Your Data

• To provide, maintain, and secure the Service.
• To authenticate you and prevent fraud or abuse.
• To send service-related communications — security alerts, password resets, notices before a renewal is charged, and warnings before an account is deleted. These concern your account rather than our products, so they are sent for as long as you have an account and carry no unsubscribe link: switching them off would mean missing a charge you wanted to cancel, or a deletion you wanted to prevent.
• To send product email, only if you opt in. You may withdraw consent at any time: every such message carries an unsubscribe link, and your mail app's own unsubscribe button works too. Unsubscribing takes effect immediately and affects product email only. You can also change it at Settings → Privacy, and we never require you to sign in to unsubscribe.
• To process AI tutor and quiz requests you initiate.
• To understand how the Service is used, in aggregate. We produce de-identified, aggregated statistics — for example how many accounts study a given subject, or how often a feature is used — to decide what to build and improve. These statistics describe groups, never individuals: they contain no name, no email address, and none of your study content, and they cannot be used to single you out. We do not sell them, and we do not use them to advertise to you.
• To build and maintain your learning model. This is the core of what the Service does, so it is worth stating plainly. As you study, we derive and store a per-pillar record of what you have covered, what you appear to be solid on, misconceptions observed during lessons, and questions left open. Some of it is calculated from your quiz results; some is produced by sending a condensed transcript of a tutor conversation to our AI sub-processor (see Section 7) and storing the summary it returns. That condensation runs automatically at the end of a lesson or when a conversation grows long, not only when you ask for it. The resulting model is used to personalize your tutoring, to schedule concepts for review, and is shown back to you on your dashboard. It is never sold, never used to advertise to you, and never shared with anyone other than the sub-processors listed in Section 7.
• Note on accuracy. Parts of that model are AI-generated inferences about your learning, not verified facts, and they can be wrong. They are presented to you as observations for that reason. Deleting a pillar removes its learning model with it, and deleting your account removes all of it.
• To debug, monitor performance, and improve features.
• To monitor for, investigate, and enforce violations of our Acceptable Use Policy and to protect our users and the public. This may include reviewing content you submit (including messages to the AI tutor) where reasonably necessary to investigate a suspected violation, and warning, suspending, or terminating accounts that violate the AUP.
• To comply with legal obligations and enforce our Terms.

5. Where the Service Is Offered

Tenebrite is offered only to people in the United States. It is not offered in the European Union, the European Economic Area, the United Kingdom or Switzerland, and we block access from those regions: based on the country our hosting provider derives from your IP address, sign-in, the app and checkout are unavailable there. We use that country only to make this decision and do not store it. These legal pages remain readable from anywhere.

This Privacy Policy is written for the United States and does not address the data-protection laws of the regions above.

6. How We Share Your Data

We do not sell personal data. We share it only as follows:

• Service providers (processors). Vetted vendors who help us run the Service under contractual confidentiality and security obligations — see Section 7.
• Integrations you initiate. When you connect a third-party tool, we transmit the data necessary to perform the sync you requested.
• Legal and safety. When required by law, valid legal process, or to protect rights, property, or safety.
• Business transfers. In connection with a merger, acquisition, or asset sale, subject to confidentiality.

7. Sub-processors

Current sub-processors include:

• Supabase — database, authentication store, file storage. Hosted in the United States. See supabase.com/privacy.
• GitHub, Inc. — OAuth identity provider. GitHub also stores our daily backups (Section 9), inside the private repository that holds the Service's code, and deletes each one after 30 days. Every backup is encrypted with AES-256-GCM before it is stored. Hosted in the United States. See docs.github.com/site-policy/privacy-policies.
• Resend — email delivery. Receives your email address and the contents of the message being sent to you, for service messages such as password resets and notices about your account, and for product email if you have opted in. It is not sent your study content. See resend.com/legal/privacy-policy.
• Google LLC — OAuth identity provider. Google Drive also holds a second copy of our backups (Section 9), encrypted with AES-256-GCM before upload; the key is never stored with it, so Google cannot read it. Each copy is deleted after 30 days. Separately, where the tutor's video recommendations are available, we query the YouTube Data API to find real videos. That search runs from our servers, not your browser: Google receives a short search phrase derived from what you asked about, together with our own API key, and does not receive your identity, your account, or your IP address. Results are cached and reused across accounts, so the same question asked by different people is usually one search. The preview cards then load thumbnail images directly from Google's image server, which does disclose your IP address and browser user-agent to Google — see the Cookie Notice, Section 4. See policies.google.com/privacy.
• Vercel Inc. — application hosting and content delivery for the Service. Hosted in the United States. See vercel.com/legal/privacy-policy.
• Stripe, Inc. — payment processing and subscription management. Receives your billing name, email address, and payment details, plus an opaque customer identifier we store to match your subscription to your account. Card numbers are collected by Stripe directly on their hosted checkout and billing pages and never reach our servers. See stripe.com/privacy.
• Anthropic, PBC — AI inference for the tutor, quiz, and rubric features. Receives the study content needed to answer each request (your messages to the tutor, task titles, quiz answers being graded) together with an opaque request context; we do not send your email or account identity. Per Anthropic's API terms, inputs and outputs are not used to train models. If you use your own Anthropic API key, your requests are governed by your own agreement with Anthropic. See anthropic.com/legal/privacy.
• Functional Software, Inc. (Sentry) — error reporting on the hosted Service, if and when enabled. Receives technical error data only (error type, stack trace, browser/OS, an opaque account identifier); we strip request bodies, cookies, authentication headers, and all study or chat content before anything is sent, and browser-side reporting is disabled for users with an active privacy opt-out (GPC or Settings → Privacy). See sentry.io/privacy.

We will update this list when sub-processors change.

8. Where Your Data Is Processed

Every sub-processor in Section 7 is a United States company. Some of them may process data outside the United States, including our hosting provider’s content-delivery network and Google Drive, where the encrypted backup copy described in Section 9 is kept.

9. Retention

We retain personal data for as long as your account is active, with three exceptions. A quiz or quick review you start but don’t submit is deleted after a day: until you submit it, we hold its questions and its answer key on our servers, so the answers never reach your browser before you have answered. A tutor conversation archived with “Finish lesson” (listed under Past lessons) is deleted 12 months after it was archived; any lesson recap it produced stays in your notes, and your current conversation is kept while your account is active. Activity-log entries (Section 3) are deleted after 12 months, except the records of your accepting these Terms and this Privacy Policy, which are kept while your account is active because they show what you agreed to and when. As with account deletion below, copies in existing backups go when those backups pass out of the 30-day window. Account deletion is immediate: deleting your account (Settings → Security → Delete Account, or the same control on the subscription or terms page described in Section 11) runs a synchronous cascade across every table tied to your profile (see Section 11 for the list of rights this satisfies), and also removes your uploaded avatar, your note attachments, and the rate-limit counters recorded against your account and email address. We also take an encrypted backup of the database and of uploaded files once a day, and store it off-site with GitHub, with a second encrypted copy in Google Drive (see Section 7), so that an outage or data-loss event does not destroy your work. Each backup is retained for up to 30 days and is then deleted, in both places. Deleting your account removes your data from the live service immediately; copies inside existing backups are removed as those backups pass out of the 30-day window. So that a restore can never bring a deleted account back, we keep a record that the account was deleted — its internal identifier and the date, nothing else — for 35 days, and leave every account on that record out of any restore.

If you sign up but never start a subscription, we do not keep your account indefinitely. An account that has never had an active subscription is deleted after 30 days, together with everything tied to it. At least 7 days before that happens we email you at the address on the account, so you have the chance to subscribe and keep your work, or to download a copy of your data first (Download your data, on the subscription or terms page the Service shows you when you sign in). That notice is a service message and is sent whether or not you have opted in to marketing email. If that email cannot be delivered to the address on the account, the account is deleted once it is 60 days old instead. If you subscribe at any point, this does not apply to you.

Payment records are the exception. Deleting your account cancels your subscription so no further charge is made, but it does not erase your customer record at our payment processor (Stripe). Stripe retains transaction, invoice, and payment-method records under its own legal, tax, and anti-fraud obligations, on its own retention schedule, and we cannot delete them on your behalf. To ask Stripe directly about the data it holds, see its privacy policy at stripe.com/privacy.

Separately, if you have ever been charged, we keep a minimal billing record after deletion so that we can establish or defend legal claims — principally a payment dispute, which can be raised with a card issuer months after the account is gone. That record holds only your payment-processor customer identifier, which version of these documents you accepted and when, the IP address and browser user-agent recorded at that acceptance, your first and most recent charge dates, and a single total of the AI usage on your account. It contains no name, no email address, and none of your content. We delete it 180 days after your most recent charge. Accounts that were never charged have no such record, because there is no claim to defend.

If you have ever subscribed, we also keep a record that you agreed to automatic renewal, because California’s automatic renewal law requires a business to keep proof of that agreement for at least three years, or for one year after the subscription ends, whichever is longer. For each checkout it holds when you agreed and when the checkout completed, which version of the wording you agreed to, the price and billing period, when we sent your confirmation email (or that it could not be delivered), when the subscription ended, and our payment processor’s identifiers for the checkout, the subscription and your customer record. It contains no name, no email address, no IP address and none of your content. It is kept after you delete your account, and we delete it once both periods have passed; while your subscription is still running, the one-year period has not started.

10. Security

Tenebrite implements the following safeguards. Deployment-level controls (network policy, key management, backup encryption) are managed by us as the operator.

• HSTS with a two-year max-age on hosted deployments; HTTPS-only transport.
• AES-256-GCM encryption of stored bring-your-own-key AI provider credentials with a dedicated server-held key.
• Row-level security enabled on every table as defense-in-depth; all queries also filter by user_id at the application layer.
• Off-site backups encrypted with AES-256-GCM, retained for up to 30 days and then rotated out (see Section 9).
• Persistent, atomic rate limiting on public APIs.
• Content Security Policy with per-request script nonces; production drops 'unsafe-inline' fromscript-src.
• OAuth account linkage by verified email only (GitHub primary email must be verified; Google must reportemail_verified).
• Per-account session revocation (“Sign out everywhere” in Settings → Security) and an audit log of security-relevant events whose entries are never edited (how long they are kept is in Section 9).

No method of transmission or storage is 100% secure. If we become aware of a personal-data breach affecting you, we will notify you and applicable regulators within the timelines required by applicable law.

11. Your Rights

Subject to applicable law, you may have the right to:

• Access the personal data we hold about you. Available in-product as a JSON export via Settings → Privacy → Download your data. If you have no active subscription, or have not yet accepted an updated version of our Terms or this policy, the Service shows you the subscription or terms page instead of Settings, and the same Download your data control is there.
• Correct inaccurate or incomplete data. Available in-product on every relevant surface (pillars, tasks, profile).
• Delete your data (right to erasure). Available in-product via Settings → Security → Delete Account, or on the subscription or terms page described above, gated by a type-to-confirm prompt to prevent accidents.
• Portability: the export referenced above is a single JSON file containing every row tied to your account, except a quiz or quick review you have started but not yet submitted, which holds its own answer key and is deleted within a day; its result is included once you submit it.
• Withdraw consent where we relied on consent. The privacy opt-out toggle in Settings → Privacy is the primary control; Sec-GPC: 1 from your browser is honored equivalently.
• Restrict or object to processing. For an equivalent of "stop processing" the practical answer is to delete your account or, on a hosted instance, contact the operator.
• Lodge a complaint with your state attorney general or another consumer-protection authority.

Rights requests beyond the in-product controls may be sent to privacy@tenebrite.com.

12. California Residents (CCPA / CPRA)

California’s consumer privacy law (the CCPA, as amended by the CPRA) applies to businesses above certain size thresholds, which Tenebrite does not currently meet. We offer California residents these rights anyway: to know what categories of personal information we collect, why we collect them, and the categories of third parties we share them with; and to request deletion, correction, and portability of their information. We will not discriminate against you for exercising any of them.

We do not sell or share personal information for cross-context behavioral advertising as those terms are defined under California law.

Global Privacy Control. We honor browser-issued Global Privacy Control (GPC) signals as a valid opt-out request. Detection runs server-side on every request; you can also record an explicit opt-out under Settings → Privacy, which surfaces both your browser signal and your manual preference and explains which one is active.

To submit a request, email privacy@tenebrite.com. You may use an authorized agent; we will require verification of their authority. We will not retaliate for exercising your rights.

13. Accounts Outside the United States

The Service may be used only by residents of the United States (see Section 5 and the Terms of Service). If we learn that an account belongs to someone outside the United States, we may close it and delete its data as described in Section 9. Questions about this can go to privacy@tenebrite.com.

14. Children

The Service is not directed to children under 13 (or the higher age of digital consent in your jurisdiction). See our Children’s Privacy Notice.

15. Automated Decision-Making

We do not make decisions about you that have legal or similarly significant effects solely through automated means. AI tutor output is informational and is generated at your request; it is not used to evaluate or score you for any external purpose.

16. Changes to This Policy

We may update this Policy. We will revise the “Effective” date and, for material changes, give reasonable in-product notice before the change takes effect.

17. Contact

Privacy questions may be sent to privacy@tenebrite.com. The operator is identified in Section 1.