Privacy Policy

The information H-AI-LEY collects depends on the features you use and the type of account you have.

Account and authentication information

We may collect and store information needed to create and secure your account, including:

• Email address
• Display name or profile name
• Account role, such as solo learner, parent, or child
• Age-band information used to apply age-appropriate privacy and safety behavior
• Email verification and account status information
• A securely hashed version of your password
• Subscription and free-trial status

We do not store your password in plain text.

Academic and learning information

When you use H-AI-LEY's academic features, we may store information you provide or create through the Service, including:

• Academic terms and semesters
• Courses and class information
• Assignments, categories, priorities, notes, and deadlines
• Study sessions and recent study activity
• Syllabus content you upload and information extracted from it
• Flashcard decks, cards, and review activity
• Quizzes and quiz attempts
• Quiz scores and learning-performance signals
• Study recommendations
• Learning progress and tutoring difficulty information
• Course and assignment context associated with tutoring sessions

This information allows H-AI-LEY to provide class-aware tutoring, organize academic work, and make study recommendations based on your current semester.

Conversation content

H-AI-LEY handles conversation history differently depending on the learner's age category.

Adult accounts (18+):
By default, H-AI-LEY may store a rolling window of recent conversation history for up to approximately 30 days so you can continue previous tutoring sessions and maintain learning continuity.

You may clear H-AI-LEY's stored conversation history from the Privacy & Data controls in your account.

Teen accounts (ages 13–17):
H-AI-LEY does not retain full tutoring transcripts as long-term server-side conversation history for accounts identified as belonging to users ages 13–17.

This protection applies to accounts identified as under 18 through H-AI-LEY's age-band or account controls, including solo learner accounts identified as ages 13–17 and child accounts.

H-AI-LEY may use short-lived conversation context while generating a response, and may retain limited learning information needed for educational progress, safety, and personalization. That limited information is separate from a full chat transcript.

Messages still must be processed by H-AI-LEY's AI provider when an AI-powered feature is used. Provider processing and retention are explained separately in Section 5.

Files, images, and media

Depending on the feature you use, H-AI-LEY may process content you choose to provide, including:

• Syllabus documents
• Images submitted for supported tutoring or vision features
• Audio submitted for speech-to-text
• Text used for text-to-speech or other accessibility features

Some of this content may be processed by an AI provider as described below.

Technical and security information

We may collect limited technical information needed to operate and protect the Service, such as:

• IP address
• Browser or device information
• Session identifiers
• Request and error logs
• Rate-limiting information
• Trial and abuse-prevention information
• Security or safety flags

This information may be used to prevent fraud, enforce trial limits, diagnose failures, secure accounts, and investigate misuse.

Information you send us directly

If you contact HRB Studios for support, feedback, privacy questions, or another reason, we receive the information you choose to include in that communication.

H-AI-LEY uses essential authentication and session cookies to keep you signed in and associate authenticated requests with your account.

In production, H-AI-LEY's authentication/session cookies are configured with:

• HttpOnly
• SameSite=Lax
• Secure

These protections reduce certain risks associated with browser-based attacks and unauthorized cookie access.

Blocking essential cookies may prevent you from signing in or remaining signed in.

H-AI-LEY may also use local browser storage for non-sensitive interface preferences, such as display/theme or workspace preferences. These preferences do not replace server-side authentication.

H-AI-LEY relies on a limited number of service providers to operate certain features.

OpenAI

H-AI-LEY currently uses OpenAI for AI-powered functionality, which may include:

• Tutor conversations
• Relevant conversation context
• Relevant course or assignment context
• Vision/image understanding
• Speech-to-text
• Image generation
• Certain parent-facing AI features

We send only the information reasonably needed to perform the requested feature.

For example, when you ask a class-aware tutoring question, H-AI-LEY may send your message together with limited academic context needed for the AI system to understand the course or assignment you are working on.

OpenAI operates its own systems and has its own privacy, security, and retention practices. H-AI-LEY's own conversation-retention rules described in this Policy are separate from OpenAI's retention of information processed through its API.

OpenAI states that data submitted through its business/API services is not used to train its models by default unless the customer chooses to share that data for such purposes. OpenAI may retain API inputs and outputs for a limited period depending on the API feature, configuration, safety requirements, and applicable law.

Deleting data from H-AI-LEY does not give HRB Studios direct control over records that may still be retained temporarily within OpenAI's systems under OpenAI's own policies.

Stripe

H-AI-LEY currently uses Stripe for payment processing.

When you purchase a paid subscription, payment information is processed by Stripe. H-AI-LEY does not store your complete credit or debit card number on its own servers.

We may receive and store limited billing information needed to determine subscription status, process account entitlements, handle refunds, and maintain business or transaction records.

Stripe maintains its own privacy and retention practices.

Text-to-speech

H-AI-LEY also supports a local Piper-based text-to-speech path. When that local path is used, text-to-speech generation does not require sending the text to a separate third-party TTS provider.

Other features, such as speech-to-text, may still use OpenAI as described above.

Hosting and infrastructure

Information may also be processed or stored by infrastructure used to host and operate H-AI-LEY. We limit access to operational data to what is reasonably necessary to run and protect the Service.

Different categories of information are retained for different periods because they serve different purposes.

Account information

Account and profile information is generally retained while your H-AI-LEY account remains active.

Adult conversation history

For adult accounts, H-AI-LEY normally retains a rolling window of recent tutoring conversation history for up to approximately 30 days.

You can clear this history sooner using the Privacy & Data controls.

Under-18 conversation history

For accounts identified as belonging to users under 18, H-AI-LEY does not maintain full tutoring transcripts as long-term server-side conversation history.

Academic information

Academic information such as semesters, courses, assignments, syllabus information, flashcard content, and quiz definitions may remain associated with your account until you remove it through available controls or delete your account.

Learning-progress information

Study-session history, quiz attempts, flashcard review status, recommendations, and other learning signals may be retained so H-AI-LEY can adapt future tutoring and study recommendations.

You can reset this learning state separately without deleting your semester or coursework.

Technical, security, and abuse-prevention records

Some security, technical, fraud-prevention, or serious-abuse records may be retained longer when reasonably necessary to protect the Service, enforce limits, resolve disputes, or satisfy legal obligations.

Billing records

Certain transaction or subscription records may be retained where reasonably necessary for accounting, fraud prevention, refunds, payment disputes, or legal obligations.

Provider retention

Information processed by OpenAI, Stripe, or another service provider is subject to that provider's own retention requirements and systems. Provider retention is separate from H-AI-LEY's own storage described above.

Where H-AI-LEY provides parent/child account functionality, we may store relationships between a parent account and linked child accounts so the relevant parent features and safety controls can operate.

Depending on the features enabled for the account, a parent may be able to access certain learning, safety, or account information associated with a linked child profile.

Deleting a linked account or deleting a parent account causes H-AI-LEY to remove or scrub applicable parent/child relationship records as part of the deletion process.

We use reasonable technical and organizational measures intended to protect information handled by H-AI-LEY.

These measures include authentication controls, restricted access to account information, secure production cookies, and other safeguards appropriate to the Service.

However, no online service, network, or method of electronic storage can guarantee absolute security.

If we become aware of a security incident involving personal information, we will investigate and take appropriate action. Where applicable law requires notification, we will provide the required notice.

We may update this Privacy Policy as H-AI-LEY changes, as our service providers change, or as legal and operational requirements evolve.

When we make material changes, we will update the Last updated date at the top of this page.

Where appropriate, we may also provide additional notice through the Service, by email, or through another reasonable method.

We encourage you to review this Policy periodically.