Privacy Policy
Summary
Chalk ("the Service") is provided by Thayes Ventures LLC ("we", "us", "our"), which is responsible for the personal data described in this policy. We collect the minimum data needed to run the Service. Your drawings, files, and folders stay on your device. To run your sessions and let you review them, we keep a record of each session on our servers: your messages, the tutor's replies, pictures of the whiteboard, the tutor's notes and session recaps, and recordings of the tutor's spoken replies. Your messages, whiteboard pictures, the photos and files you share in a session, and your voice are processed by our AI service providers so the tutor can respond. These providers may not use this data to train AI models. We do not sell your data.
1. Data We Collect
Account data: email address, display name, and a hashed password (stored using industry-standard cryptographic hashing — we never see or store your password in plain text).
Usage data: number of AI responses, subscription tier, device type (user agent), timestamps of sessions, number of characters sent to text-to-speech, and learning-progress events (which math concepts you practiced and outcomes — for the in-app progress tracker).
Content data: the messages you send and the tutor's replies; pictures of your whiteboard; photos and files you share in a session (sent to our AI service providers so the tutor can read them); and recordings of your voice (sent for speech-to-text transcription, then discarded). Your drawings, uploaded files, and folders are stored on your device, not on our servers. We keep a record of each session on our servers so you can continue it, review it, and replay it, and so we can keep the Service working. That record includes your messages and the tutor's replies, pictures of the whiteboard, the tutor's notes and session recaps, and recordings of the tutor's spoken replies.
2. What Stays On Your Device
The following is stored only on your device (browser IndexedDB), not on our servers:
- Your whiteboard drawings themselves (a session's record keeps pictures of the board, as described in section 1)
- Any materials you upload (homework, study guides). During a session, their content is sent to our AI service providers so the tutor can read them, but we don't store the uploaded materials on our servers.
- Folder organization
Clearing your browser data or using a different device will reset this content.
3. Service Providers
To provide the Service, we share limited data with vetted service providers acting as data processors on our behalf. These providers fall into the following categories:
- AI processing providers — receive your messages, whiteboard pictures, the photos and files you share in a session, and your voice, only to generate the tutor's replies, read your work, transcribe speech, and speak the tutor's replies. Recordings of your voice are transcribed and then discarded. Messages, pictures, and file content are processed in real time. Providers may not use any of this data to train AI models.
- Authentication and storage providers — store account data, subscription state, and learning-progress records.
- Hosting and serverless infrastructure — runs the Service's API endpoints.
- Payment processors — process subscription payments. We do not receive your payment-card details; only the transaction status and a non-sensitive identifier.
All processors are bound by data-processing agreements limiting use of your data to providing the Service. We do not sell or share your data for advertising or other commercial purposes.
4. Legal Basis for Processing
We process your data to fulfill our contract to provide the Service (GDPR Article 6(1)(b)). Analytics data is processed on the basis of legitimate interest (GDPR Article 6(1)(f)).
5. Data Retention
Account data is retained as long as your account exists. Usage logs are retained for 90 days for operational and billing purposes, then deleted. Server-side conversation caches expire after 30 minutes of inactivity.
6. Your Rights
You have the right to:
- Access your data — use the "Export Data" button in account settings.
- Delete your account — use the "Delete Account" button. All server-side data is removed within 30 days.
- Correct inaccurate data — contact us.
- Object to processing — contact us.
7. Children's Privacy
The Service is not intended for children under 13. If we learn we have collected data from a child under 13 without parental consent, we will delete it.
8. Security
We use HTTPS for all connections, encrypted password hashing, and database access controls. However, no system is fully secure. You are responsible for keeping your account password private.
9. Cookies and Tracking
We use browser localStorage to keep you signed in. We do not use tracking cookies or third-party analytics that identify you across the web.
10. Changes to This Policy
We may update this policy from time to time. Material changes will be communicated via the Service or by email.
11. Contact
For privacy questions or data requests, contact Thayes Ventures LLC at support@try-chalk.com.
← Back to Chalk