Privacy Policy

Xavior Study is built so your academic data stays yours. This policy explains what the app and our services do and don't collect. Plain language, no surprises.

What stays on your device

Your courses, syllabi, grades, study sessions, flashcards, and projections live in your browser or app on your device (local storage). With two exceptions, we do not upload them to a server and we cannot see them: when you are signed in, a copy of each syllabus you upload is stored on our servers to improve exam prediction, and the app reports the usage counts and course names described under App usage analytics below. Everything else stays on your device, and clearing the app's data or removing the app deletes it.

What the AI features send

The AI add-on is optional. When you use it (the tutor, quizzes, flashcard generation, study plans, or scanning a test or photo), the specific content needed for that request is sent to our AI proxy and on to our model provider, Anthropic, to generate a response. We pass requests through; we do not retain the content of your AI requests beyond what is needed to serve them and meter usage.

One AI request can happen without a click: when a class you added from a syllabus has topics but no flashcards yet, the app makes you a small starter deck. That request sends only the class name and code, its grading categories, and topic names already read from your syllabus — not the text of your uploaded files — and it is made at most twice per class, only when your account has AI access.

If you bring your own model key instead, those requests go directly from your device to the provider and do not pass through us at all.

Subscription and usage

When you subscribe to the managed-AI tier, we record aggregate AI usage (token counts) per account so we can meter and price it. This is a count, not the content of your requests. If you bring your own model key instead, there is nothing to meter and we record no usage for it.

Payments

Subscriptions are processed by Stripe. Stripe handles your payment and, where applicable, sales tax. We never see or store your card details. We store only the Stripe customer and subscription identifiers, your subscription status, and its renewal date, so the app knows whether your access is active. Stripe's own privacy policy governs the payment itself.

Accounts and identity

Using the app requires an account. You sign in with your email address and a one-time code we email you — there is no password. We store your email address, when the account was created, your subscription or trial status, and (if you redeemed one) an invite code or the referral code you signed up with. If you sign in with a .edu address, we record that it qualified for the automatic 30-day student trial.

Your signed-in session is held in a secure, HttpOnly cookie scoped to our sign-in endpoints, and on the desktop app in a stored token. These keep you signed in; they are not advertising or cross-site tracking cookies.

Ambassador program

If you participate as an ambassador, we store your display name, referral code, preferred payout service (Venmo, PayPal, or Zelle), and the username, email address, or phone number you give us for payouts. We also record when a referred account first becomes a subscriber and keep aggregate earned and paid totals so compensation does not disappear when a subscription later ends. This information is visible only to allow-listed administrators. We do not store bank or card credentials for ambassador payouts.

Website analytics

On our marketing website (whatsonthetest.com) we use privacy-friendly, cookieless analytics to understand how the site is used: pages viewed, which buttons are clicked, and whether someone joins the waitlist. Both tools are configured without cookies, so nothing is stored on your device and you are not tracked across other sites. We use this only in aggregate to improve the site, never to identify you.

App usage analytics

When you are signed in, the app reports a small amount of usage information to our servers so we can understand which features students actually use and support your account: which screens you opened (for example the tutor or practice tests); simple feature events such as starting a study session, opening or finishing flashcard generation, and starting or skipping a practice test (with at most a type and a count, for example "diagnostic, 3 answered"); and counts of your classes, concepts, flashcards, drill reps, practice tests and exams (including how many upcoming exams have a date), along with your course names or codes (for example "CHEM 101"). We also record AI token counts per account so we can meter and price the managed-AI tier.

This is deliberately counts and labels, not content: your notes, grades, answers, questions, and study materials are not included and stay on your device, apart from the syllabus copy described above. If you are not signed in, none of this is sent.

How long we keep things

• Syllabus copies — 24 months. Each stored syllabus is written with a 24-month expiry and is removed automatically when it lapses. This is enforced by the storage system itself, not by a process someone has to remember to run.
• Account details (email, subscription and trial status) — for as long as your account exists.
• Ambassador program details (payout destination, referral/conversion records, and aggregate compensation) — while the program relationship or its payment records need to be maintained; contact us to correct or remove your payout destination.
• Usage counts and feature events — kept in aggregate to understand product use; the per-account snapshot holds only your latest counts, not a history.
• Sign-in codes — short-lived, and expire on their own shortly after they're sent.

Your choices and rights

You can ask us for a copy of the account data we hold about you, ask us to correct it, or ask us to delete your account outright. Email [email protected] from the address on the account and we will delete your account, your stored syllabus copies, and your usage data within 30 days. Deleting the app or clearing its data removes everything held on your device immediately, at any time, without asking us.

Depending on where you live you may have additional rights over your personal data — including under the GDPR in the UK and EEA, and the CCPA in California. We honour these requests regardless of where you live; the same address above is the way to make one. We do not sell personal information, and we do not use your data for automated decisions that produce legal effects.

What we don't do

• We don't sell your data.
• We don't use your grades or coursework to train models.
• We don't show third-party ads or share your data with advertisers.

Service providers

• Anthropic — AI model inference for the add-on.
• Stripe — subscription payments and billing.
• SendGrid — delivering your sign-in codes and account emails.
• Cloudflare — hosting, content delivery, and the databases holding your account, syllabus copies, and usage counts.
• PostHog — cookieless website analytics.
• Google Analytics — cookieless website analytics (Consent Mode; no advertising signals).

Children

Xavior Study is intended for students of high-school age and older. It is not directed at children under 13, and we do not knowingly collect personal information from them.

Changes

We may update this policy as the product evolves. Material changes will be reflected by the "last updated" date above.

Contact

Questions about privacy? Email [email protected].