Privacy Policy

Version 2026-11-11 · Applies in Canada and the United States · The English text governs.

YSR Studies (“we”, “us”) is a study app with an AI tutor, practice cards, courses and progress tracking. This policy explains what we collect, why, who helps us process it, where it is kept, how long, and the choices and rights you have. It applies to ysrstudies.com and the YSR Studies app.

In short

To use YSR Studies you agree to the core uses in “Your data”: we store your account and study work and use them to tutor you, run the service and improve the courses.
Everything else — marketing emails, location, recordings, sharing your work with other students, research — is optional and off until you turn it on. You can change each choice any time in Account.
Sharing with advertising platforms is different: for adults (18+) it is on by default, and you can turn it off any time in Account or through Do Not Sell or Share My Personal Information. It is never on for anyone under 18, and in Québec it stays off unless you turn it on. See Sharing with advertising platforms.
We do not sell your personal information for money. Information about anyone under 18 is never shared with advertising platforms.
Your information is stored in Canada and the United States.
You can export your work or delete your account from Account.

What we collect

You give us

Account details: email address and password (the password is handled by our authentication provider and stored only in hashed form); optionally a phone number.
About you: birth month and year (to know your age and school year), country, province or state, postal code, your school system and grade or year, courses, and your language level if you tell us.
Your study work: messages to the tutor, notes, answers, cards and ratings, challenges, the help you ask for, files you upload (homework, study notes), and anything you write in the app.
Voice, if you use a voice feature: your recording is turned into text on our own servers or, when you speak in Languages, by our voice provider (ElevenLabs), which receives the clip and the language it is in, with no name, email or account id. We do not keep that clip.
Payments: when you buy, our payment processor collects your card details; we receive only a record of the purchase (plan, amount, date, status), never your full card number.
The landing quiz, if you take it: we keep the study type it computes (not your individual answers) and link it to your account when you sign up.
Messages to us, such as support requests.

We create or collect automatically

Learning records: mastery estimates per concept, review schedules, checkpoint results, gaps, what the tutor learned helps you (a short profile of preferences and skills), and a timeline of what you studied.
Usage and device data: pages and features used, events such as sign-up or purchase, time studied, model usage and cost per turn, and device and browser information. IP addresses and browser user-agent strings are stored only as one-way hashes.
Referral data: how you arrived (for example a campaign tag or ad click identifier) and the page you landed on, recorded in our own systems. Click identifiers of students under 18 are deleted. For an adult with ad sharing on, the landing visit is shared with the ad platforms after sign-up (see below).
Browser storage: we keep your sign-in session and preferences in your browser’s local storage, and may set a first-party cookie that recognises a returning visitor. See Cookies and local storage.

Your data: how we use it (required to use YSR Studies)

When you create an account you agree to these uses. They are what the service is.

Tutoring: the tutor reads your messages, your course, your notes and relevant passages from open textbooks to reply; it uses your learning records to pitch explanations at your level and to focus on your gaps.
Grading and scheduling: we mark answers with automatic checkers and schedule reviews so you remember what you study.
Remembering what helps you: we keep a short profile (for example “prefers worked examples”) and a dated timeline of what you studied, so later sessions pick up where you left off.
Your files: we read files you upload so the tutor can cite them to you. Your files are never shown to another account and are not used to train AI models. Deleted files stay in trash for 30 days, then are purged.
Running your account: sign-in, study time and hours, billing, support, security, fraud and abuse prevention, and keeping the service working.
Measuring and improving the app: we analyse how the app is used (with a pseudonymous id, never your email) to fix problems and decide what to build.
Improving the courses: the system may read what students answer and write — including yours — to find common mistakes, improve explanations, practice items and study material that other students then use. Anything shown to another student in this way is written so it does not identify you; quoting your own words to others requires the optional sharing choice.
Counts across students: we combine records into counts (for example how many students in a course struggle with a concept) to propose classes and improve courses. Counts never include names or ids.
Legal: to meet legal, tax and accounting obligations and to enforce our Terms.

AI tutoring and model providers

To write replies, your message and the context the tutor needs (for example your course, recent turns in that chat, and relevant notes) are sent to AI model providers through OpenRouter, which routes each request to a provider of the model we use (currently open-weight models served by providers such as Groq). They process it to produce the reply under their own terms. Short summaries of what you studied may also be processed by a model to maintain your profile and timeline. AI replies can be wrong; check important answers.

Who helps us (service providers)

These providers process information for us, under contract, to run the service:

Provider	What for	Where
Fly.io	Runs the app; holds the working copy of your study vault	Canada (Toronto)
Supabase	Accounts and sign-in, database tables, the durable copy of your study vault, email delivery of sign-in links	United States
Upstash	Review schedule index (ids and dates, no words); search over open textbooks (your question is turned into a search query and not stored); your short tutor profile	United States
OpenRouter and the model providers it routes to	Writing tutor replies; maintaining your profile and timeline	Mainly the United States; the provider’s regions
FalkorDB and Voyage AI	Your study timeline (memory graph) and its embeddings, when enabled	The provider’s regions
Stripe	Payments, subscriptions, receipts	United States / Canada
Resend	Sending account emails (confirmation, password reset, and marketing emails if you opt in)	United States
PostHog	Product analytics with a pseudonymous id (never your email or hashed contact details)	United States
ElevenLabs	Speaking the tutor’s replies aloud (it receives the reply’s text); turning what you say in Languages into text (it receives the clip)	The provider’s regions
Supadata	Reading the captions of a video you ask to take notes on	The provider’s regions
SerpApi, Exa	Finding open sources for a concept; they receive course and concept keywords only, never your words	United States
Google (YouTube)	Embedded lecture videos. When you play one, YouTube may collect data under Google’s privacy policy	United States

We also share information when the law requires it, to protect people’s safety or our rights, or as part of a merger, acquisition or sale of assets, in which case this policy continues to apply to your information.

Where your information is kept

Your information is stored in Canada and the United States. Some service providers above may process it in their own regions to perform their service. Information stored in the United States may be accessible to authorities there under U.S. law.

How long we keep it

Your study work is kept while your account exists. You can delete a chat at any time; deleting it also removes what was derived only from it. Uploaded files stay in trash for 30 days after you delete them.
If you delete your account (Account → Delete), we erase your study vault and its backup, your profile and timeline, and your review index; your personal details are removed from your account record and the sign-in is disabled.
Kept after deletion: purchase and payment records, the record of the consents you gave, and event records with contact details removed, for as long as tax, accounting and legal obligations require. A log of what was erased is kept for up to 365 days as one-way hashes.

Optional choices

Each of these is off until you turn it on — except sharing with advertising platforms, which is on by default for adults outside Québec — and you can turn each off any time in Account. Turning one off stops future use; it does not undo use already made.

Marketing emails

Emails about new courses, features and offers. Every email has an unsubscribe link.

Sharing with advertising platforms (adults only, on by default)

If you are 18 or older, this is on by default and you can turn it off any time in Account (the “Sharing with advertising platforms” switch, or the Do Not Sell or Share My Personal Information link). While it is on, we send these events to Meta and Google so we can measure whether our ads work:

Sign-up, starting your free trial and purchases (with the amount and currency);
your landing visit: if you arrived from one of our ads, the page you landed on, when, and the ad’s click identifier — sent once, after you create your account;
with each event, a hashed (one-way encoded) email address or phone number, your province or state and country (hashed for Meta), and the ad’s click identifier (for example Meta’s fbclid/fbc or Google’s gclid). Never your name, your study work or anything you write.

It is never on for anyone under 18: their events never reach an advertising platform and their click identifiers are deleted. In Québec it stays off unless you turn it on yourself. If your browser sends a Global Privacy Control signal when you sign up, it stays off too. If you had an account before this change (2026-09-30), nothing changes until you accept the updated notice in the app, which lets you turn it off right there. We use no advertising pixels in your browser; everything is sent from our servers. In some U.S. states this is called “sharing” for cross-context behavioural advertising; you can opt out at any time as described above.

Do Not Sell or Share My Personal Information

We do not sell personal information for money. To opt out of “sharing” for advertising, use the Do Not Sell or Share My Personal Information page or the link of the same name in Account: signed in, one click turns ad sharing off.

Location

Your postal code and a coarse area, to find tutors, classes and events near you.

Recordings

Recording voice or tutoring sessions so you can review them. You can delete a recording any time.

Work you choose to share may be shown to other students and quoted in study material, without your name. See Your content in the Terms.

Research

Your de-identified progress data may be used in studies of whether and how the tutoring works, including with research partners. Never your name or contact details.

Students under 18

Students under 18 may use YSR Studies with the agreement of a parent or guardian. When a student tells us they are under 18, we ask them to confirm that a parent or guardian agrees to their use under these terms, and we record that confirmation. Information about students under 18 is never shared with advertising platforms, and their ad click identifiers are deleted. A parent or guardian may contact us to review, correct or delete their child’s information. If you believe a child under 13 is using YSR Studies without a parent’s agreement, contact us and we will act on it.

Cookies and local storage

Necessary: your sign-in session, tester access and preferences, kept in your browser’s local storage; the app’s offline files.
First-party measurement: a first-party cookie that recognises a returning visitor and records how they arrived, used only by us.
Third parties: embedded YouTube videos may set their own cookies when played. We run no advertising pixels in your browser; the ad-platform events described in Sharing with advertising platforms are sent from our servers, for adults with ad sharing on only.

Your rights

Depending on where you live, you may have the right to access your information, correct it, delete it, get a copy (you can export your study work from Account), withdraw consent, and opt out of targeted advertising or “sharing” (Do Not Sell or Share My Personal Information). Residents of Québec and some U.S. states have additional rights. To use any of these rights, use the controls in Account or contact us; we will answer within the time the law requires and will not treat you differently for exercising them. If you are not satisfied, you may complain to your privacy regulator (in Canada, the Office of the Privacy Commissioner of Canada or your provincial commissioner).

Security

We use encryption in transit, access controls that limit each account to its own records, hashing of contact details and network identifiers where we can, and least-privilege keys for our services. No system is perfectly secure; if a breach affects you, we will notify you as the law requires.

Changes to this policy

We will post changes here with a new version date. If a change affects how we use information you already gave us in a significant way, we will ask again or tell you in the app before it applies.

Contact

Privacy questions and requests: ysrstudiesofficial@gmail.com.