Privacy Policy
SchooledUp Inc. (“SchooledUp”, “we”, “us”) is accountable for the personal information it handles under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). This policy explains what we collect, why, who we share it with, how long we keep it, and your rights. We are an independent vendor and are not affiliated with any school, college, or university.
1. Personal information we collect
- Account: your email address and authentication credentials.
- Content you upload: documents, images, audio, PDFs and text you add to the service, and the text we extract from them (which may include your name, course information, and study notes).
- Derived data: the notes, tasks, summaries, flashcards, and study plans we generate from your content.
- Integration data: tokens and content for services you connect, such as Google, Microsoft/OneNote, Notion, and email forwarding.
- Quercus, Brightspace or Moodle data from the browser extension:if you install the SchooledUp extension, the course information it reads from your Quercus account, or from your school's Brightspace or Moodle (see section 9).
- Feedback you send: what you write, any screenshots you attach, and the page, app version and browser you sent it from. Sending it means you agree we may look at your account to investigate; we only read it, never change it.
- Usage & technical data: log and usage records, and — subject to your consent — product-analytics events.
2. Why we use it
We use your information only to provide the service; to keep it secure and prevent abuse; to debug and maintain it; and to meet our legal obligations. We do not sell your information, and we do not use your content to train AI models.Where our AI providers support it, we route requests with settings that instruct them not to train on your content and to minimise how long they retain it; some providers' retention for their own abuse-monitoring or legal-compliance purposes is outside our control and is described in their policies.
3. Please don't upload restricted information
SchooledUp is for ordinary study material. Do not upload government or student IDs, official transcripts, grades or disciplinary records, medical, counselling, disability or accommodation information, financial or payment data, passwords or access keys, intimate or unlawful images, or confidential, exam-bank or answer-key material. We automatically screen uploads and block restricted content outright — a rejected upload is never stored. See our Upload Policy for the full list.
4. Service providers (subprocessors) and why
To run SchooledUp we share data with the following providers, only as needed to provide the service:
| Provider | Purpose | Data it receives |
|---|---|---|
| OpenRouter (routing to Google Gemini) | AI text & vision extraction | Uploaded text and images |
| Groq | Audio transcription (primary) | Audio you upload |
| Deepgram | Audio transcription (fallback) | Audio you upload |
| OpenAI (Whisper) | Audio transcription (last resort) | Audio you upload |
| Supabase | Database, authentication, file storage | All account content and files |
| Purelymail | Email mailbox & ingest | Forwarded email content |
| Sign-in; Docs/Tasks/Calendar integrations | Auth tokens, profile, integration content | |
| Microsoft | OneNote integration | Auth tokens, exported note content |
| Notion | Notion integration | Auth codes, exported note content |
| Vercel / Railway | Web / API hosting | All request traffic |
| Cloudflare Turnstile | Bot / CAPTCHA protection | Challenge data |
| Google Analytics | Product analytics (consent-based) | Usage / page-view events |
5. Cross-border processing
Some of our providers process or store data outside Canada, including in the United States. While your information is in another country, it may be accessible to that country's courts, law enforcement, or national-security authorities under its laws. We require our providers to protect your information to a comparable standard, but we cannot override foreign lawful-access powers.
6. Retention
We keep personal information only as long as necessary for the purposes above, then delete or de-identify it, per our retention schedule. You can delete individual uploads anytime in the app, or your entire account via Settings (gear icon in the bottom navigation) → Delete account. Summary of default retention periods:
| Data category | Default retention |
|---|---|
| Raw uploaded file bytes | About 30 days after processing, then deleted |
| Extracted text | Life of your account (deletable anytime) — it is the source your notes and tasks are generated from |
| Forwarded email | Treated like any other upload: its text is kept as extracted text (see above) and is deletable anytime. Once we’ve processed a message, we delete it from the mail provider that receives it for us. |
| AI request payloads sent to providers | Not retained by us; provider zero-retention where supported |
| Notes / tasks / study material | Life of your account; deletable anytime |
| Rejected uploads | Refused at upload and never stored |
| Logs & audit records | About 180 days |
| Feedback you send (text and screenshots) | Until you delete your account; ask us to delete it sooner anytime |
| Account data | Until deletion (plus a short backup window) |
7. Your rights
You may access, correct, or delete your information; withdraw consent; and ask questions or make a complaint. Use Settings (gear icon in the bottom navigation) → Delete account, or contact us at privacy@schooledup.app. We respond within 30 days. You may also complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).
8. Safeguards
We protect your information with encryption in transit (HTTPS/HSTS), a private access-controlled file store, per-user database row-level security, encrypted storage of sensitive credentials, bot protection, and least-privilege internal access. No system is perfectly secure.
9. The SchooledUp browser extension
The extension is optional. It reads your Quercus courses (University of Toronto), or your courses on your school's Brightspace or Moodle (for example York's eClass), so SchooledUp can build your tasks and notes without you uploading files by hand. Brightspace and Moodle support is in Beta: you choose your school when you link the extension (we suggest one from your email address or courses, and you can change it), and only then does Chrome ask you to let it read that school's site.
What it reads. It uses your own Quercus, Brightspace or Moodle login, in your own browser, to read:
- your list of courses;
- each course's modules or content, pages and list of files;
- assignments and their due dates (on Brightspace, assignment folders and quizzes' dates; on Moodle, the due and closing dates its calendar shows for your courses);
- announcements; and
- the syllabus or course overview.
It only reads. It sends read-only (GET) requests to Quercus or Brightspace and never changes anything there. On Moodle it uses Moodle's own read-only data service (Moodle takes these as POST requests, with a session code from your logged-in page that stays in your browser) and opens each course's announcements forum page, and it never creates or stores a Moodle password or access token. It does not read your grades, your submissions or your messages.
Where it goes.The extension sends what it read to SchooledUp's servers. For Quercus, our servers then download the course files themselves, only from Quercus links. Brightspace file links only work with your login, so for Brightspace the extension downloads the course files SchooledUp picks and sends them to your account; our servers never fetch a Brightspace link. Moodle's files work the same way: the extension downloads the ones SchooledUp picks and sends them, and our servers never fetch a Moodle link. Moodle records each of those downloads, and each visit the extension makes to a course's announcements forum, as you viewing that item, as it would if you clicked it (in its activity log, and as “viewed” where a teacher tracks that). We use all of this to build your tasks and notes. It goes through the same screening for restricted information, and the same service providers (section 4), as anything you upload yourself.
What we keep.We do not store the raw Quercus, Brightspace or Moodle responses the extension sends. We keep the tasks, notes and files built from them, for as long as we keep your other content (section 6). The extension keeps a connection key, a random ID for this browser and your last sync result in your browser. On our side we store only a one-way hash of the key, never the key itself, with that browser ID and the browser's name (for example “Chrome on Mac”) so you can see which browsers are linked.
Linking.After you install the extension, it opens a SchooledUp page that asks, once, whether to link this browser to the account you are signed in to. Nothing is linked until you confirm. Each browser gets its own key, so linking one browser does not unlink another. To move a browser to a different SchooledUp account, you confirm again; the earlier account's key for that browser is no longer used and stops working after 90 days.
How we use it.Only to give you SchooledUp. We do not sell it, use it for advertising, or use it to train AI models. SchooledUp's use of information received from the extension follows the Chrome Web Store User Data Policy, including its Limited Use requirements.
Notifications. After a sync, the extension can show one desktop notification saying what was added or what went wrong. You can turn this off in your SchooledUp settings.
Removing it.To stop syncing, remove the extension in Chrome. Chrome then opens a SchooledUp page that, if you are signed in, cancels that browser's key right away; otherwise the unused key stops working after 90 days. We keep a record of a cancelled key, with no course content in it, until you delete your account. Anything already imported stays until you delete it or delete your account (section 6).
10. Privacy contact
Ryan Fong, CEO, is accountable for privacy at SchooledUp.
Contact: privacy@schooledup.app.
We may update this policy from time to time. If we make a material change we will post the revised version here with a new effective date and ask you to review it.