Privacy Policy

1. Introduction

Welcome to Scholar's Alley ("we," "our," or "us"). We are committed to protecting your privacy and ensuring your data is handled securely and responsibly. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website and use our educational tools.

By using Scholar's Alley, you agree to the collection and use of information in accordance with this policy. If you disagree with any part of this policy, please discontinue use of our services.

2. Information We Collect

2.1 Personal Information

We collect information you provide directly when you create an account or use our services:

• Account Information: Name, email address, password, and profile details
• Demographics: Year of birth (for age-appropriate content and COPPA compliance)
• Avatar: Profile picture or selected avatar choice
• Family/Guild Information: Parent-child relationships and family group memberships

2.2 Content Data

We collect content you create or upload through our services:

• Chat Sessions: Text conversations with AI tutor (Tutor's Quill)
• Uploaded Images: Homework photos and images for analysis
• Generated Content: Quizzes, courses, presentations, and study materials
• Knowledge Vault Items: Tests, homework, and notes you store
• Quiz Attempts: Answers and scores from completed quizzes
• Game Progress: Scores, achievements, and gaming statistics

2.3 Usage Data

We automatically collect information about your interactions with our services:

• Device Information: Browser type, operating system, device type
• Log Data: IP address, browser type, referring/exit pages, timestamps
• Usage Patterns: Features used, time spent, session duration
• Performance Data: Page load times, error reports, crash data

2.4 Payment Information

We collect payment information through our payment processor (Stripe). We do not store your credit card details on our servers. All payment processing is handled securely by Stripe in accordance with PCI DSS standards.

3. How We Use Your Information

We use the collected information for the following purposes:

• Service Provision: To provide and maintain our educational services, including AI tutoring, quiz generation, and content creation
• Personalization: To personalize your learning experience, recommend relevant content, and adapt difficulty levels
• Account Management: To manage your account, authenticate your identity, and provide customer support
• Progress Tracking: To track your learning progress, quiz scores, and achievements
• Communication: To send you updates, security alerts, support messages, and promotional content (with your consent)
• Payment Processing: To process credit purchases and manage subscriptions
• Family Features: To enable parent-child relationships and family sharing features
• Improvement: To analyze usage patterns and improve our services

3.1 AI Processing

Your content (chat messages, uploaded images, documents) may be processed by third-party AI services (OpenRouter and its partners) to generate educational responses, quizzes, and study materials. This processing is necessary to provide our core services.

4. Information Sharing and Disclosure

We may share your information in the following circumstances:

4.1 Third-Party Services

We share information with the following third-party service providers:

• Firebase (Google): Cloud infrastructure, authentication, and database services. Your data is stored securely on Firebase servers.
• OpenRouter: AI model provider for tutoring and content generation. Your queries and content are sent to OpenRouter's API for processing.
• Stripe: Payment processing service. Payment information is shared with Stripe to process transactions.
• Google Analytics: Website analytics to understand usage patterns and improve our services.

These third parties have their own privacy policies and we encourage you to review them. We only share information necessary for these providers to perform their services.

4.2 Family/Guild Sharing

If you are part of a family or guild, your progress and generated content may be visible to other family members (parents/guardians and siblings). You can control sharing settings in your account.

4.3 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., court orders, subpoenas).

4.4 Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of the transaction. You will be notified of any such change.

4.5 What We Do NOT Share

We do not sell, rent, or trade your personal information with third parties for their marketing purposes. We do not share your information with advertisers or data brokers.

5. Data Security

We implement industry-standard security measures to protect your information:

• Encryption: Data is encrypted in transit using HTTPS/TLS and at rest using industry-standard encryption
• Access Controls: Strict access controls limit who can access your data
• Secure Authentication: Firebase Authentication with secure password hashing
• Regular Audits: We regularly review our security practices
• PII Protection: Personal information (names, faces) is automatically blurred in uploaded images before storage

However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security. While we strive to protect your personal information, we cannot ensure or warrant the security of any information you transmit to us.

6. Data Retention

We retain your information for as long as necessary to provide our services and fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

• Account Information: Retained while your account is active
• Chat Sessions: Retained for your reference and learning history
• Quiz Attempts: Retained for progress tracking and analytics
• Generated Content: Retained in your personal library
• Usage Logs: Retained for security and service improvement (typically 12-24 months)

You can request deletion of your data at any time through your account settings or by contacting us. Upon account deletion, all your personal data will be permanently removed from our systems within 30 days, except as required by law.

7. Children's Privacy (COPPA Compliance)

Scholar's Alley is designed for K-12 students. We take special care to protect the privacy of children under 13 in compliance with the Children's Online Privacy Protection Act (COPPA).

7.1 Parental Consent

We do not knowingly collect personal information from children under 13 without verifiable parental consent. Accounts for users under 13 must be created and managed by a parent or legal guardian.

• Parents must provide email address and consent during account creation
• Parents can review, modify, or delete their child's account at any time
• Parents can access all of their child's data and activity

7.2 Data Minimization for Children

We collect only the minimum amount of personal information necessary to provide our educational services to children. We do not collect information for marketing purposes from children under 13.

7.3 Age Verification

During account creation, we collect year of birth to determine if the user is under 13. If a user indicates they are under 13, we require parental email and consent before proceeding.

7.4 Parental Controls

Parents and guardians have access to Guardian's Gate, which provides:

• Real-time monitoring of child's activity
• Progress tracking and learning analytics
• Control over family sharing settings
• Ability to set spending limits on credits

7.5 Parental Rights

Parents of children under 13 have the following rights:

• Review the personal information we have collected about their child
• Request deletion of their child's personal information
• Refuse to permit further collection or use of their child's information
• Opt out of certain data collection activities

To exercise these rights, parents should contact us at scholarsalley@outlook.com with subject line "COPPA Request."

8. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information
• Portability: Request transfer of your data to another service
• Objection: Object to processing of your personal information
• Restriction: Request restriction of processing of your personal information

8.1 How to Exercise Your Rights

To access, correct, delete, or export your personal information — or your child's — contact us at scholarsalley@outlook.com or via our Contact page. We will verify your identity and respond within 30 days. Guardians can also request deletion or export of a child's account and data using the same contact method.

9. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect information about your browsing behavior and preferences:

• Essential Cookies: Required for basic site functionality (authentication, security)
• Analytics Cookies: Help us understand how visitors use our site (Google Analytics)
• Preference Cookies: Remember your settings and preferences

9.1 Managing Cookies

You can manage or disable cookies at any time through your browser settings. Essential cookies are required for core functionality such as authentication and security; disabling them may prevent you from signing in or using parts of the Service. You can opt out of analytics cookies using the browser add-on linked below.

9.2 Do Not Track

Please note that we do not respond to "Do Not Track" signals in web browser headers. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.

10. International Data Transfers

Scholar's Alley is based in Melbourne, Australia, and stores your primary data on Australian servers (Firebase). Your data may be processed by international service providers (OpenRouter, Stripe) located in the United States and other countries to provide our AI and payment services.

By using our services, you consent to the transfer of your information to these countries for processing purposes. We ensure that your data is protected in accordance with this Privacy Policy, and we take appropriate safeguards to protect your information in accordance with Australian and international data protection laws.

We comply with the Australian Privacy Principles contained in the Privacy Act 1988 (Cth) and the Privacy Amendment (Enhancing Privacy Protection) Act 2012.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by:

• Posting the new Privacy Policy on this page
• Updating the "Last Updated" date
• Sending you an email notification for material changes

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information. Your continued use of our services after any changes constitutes acceptance of the updated policy.

12. California Privacy Rights (CCPA)

If you are a resident of California, you have specific rights regarding your personal information under the California Consumer Privacy Act (CCPA):

• Right to Know: Request disclosure of categories and specific pieces of personal information we have collected about you
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: Opt-out of the sale of your personal information (note: we do not sell personal information)
• Right to Non-Discrimination: Not receive discriminatory treatment for exercising your privacy rights

To exercise these rights, California residents should contact us at scholarsalley@outlook.com with subject line "CCPA Request."

13. GDPR Compliance (EU Residents)

If you are a resident of the European Economic Area (EEA), you have additional rights under the General Data Protection Regulation (GDPR):

• Lawful Basis: We process your data based on consent, contract performance, and legitimate interests
• Data Protection Officer: You can contact our Data Protection Officer at scholarsalley@outlook.com
• Data Subject Access Request (DSAR): Request detailed information about data processing
• Right to Withdraw Consent: Withdraw consent at any time (this may affect service availability)
• Right to Lodge a Complaint: Lodge a complaint with a supervisory authority in your country

We will respond to GDPR requests within one month of receipt, extendable by two months for complex requests.

13.1 Australian Privacy Act Compliance

If you are a resident of Australia, you have rights under the Privacy Act 1988 (Cth) and the Privacy Amendment (Enhancing Privacy Protection) Act 2012:

• Access: Request access to personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Complaint: Lodge a complaint with the Office of the Australian Information Commissioner (OAIC)
• Opt-out: Opt-out of direct marketing communications

We comply with the Australian Privacy Principles, which require that personal information be:

• Collected for a lawful purpose
• Necessary and relevant to that purpose
• Accurate, up-to-date, and complete
• Protected from unauthorised access, use, or disclosure

To make a privacy complaint under Australian law, you can contact the Office of the Australian Information Commissioner at www.oaic.gov.au.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: scholarsalley@outlook.com
• Support: scholarsalley@outlook.com
• Contact Form: Contact Page

For COPPA-related inquiries, please include "COPPA Request" in the subject line. For CCPA requests, please include "CCPA Request." For GDPR requests, please include "GDPR Request." For Australian Privacy Act inquiries, please include "Australia Privacy Request."