Privacy Policy

1. Introduction

IVY, Me! ("we," "our," or "us") operates ivyme.ai, an AI-powered SAT tutoring platform (the "Service"). This Privacy Policy explains how we collect, use, store, and share your personal information when you use our Service. We are committed to protecting your privacy and being transparent about our data practices.

2. Information We Collect

Account Information

When you create an account via Google OAuth, we collect:

• Name
• Email address
• Profile picture

We use the following Google API scopes: openid, email, and profile. We do not receive or store your Google password.

Profile & Preferences

When you set up your profile, we collect:

• Target SAT score
• Test date
• Weekly study hours preference
• Learning style (visual, verbal, kinesthetic, etc.)
• Preferred learning pace
• Onboarding status

Learning Data

As you use the Service, we collect comprehensive learning data to provide personalized, adaptive tutoring:

• Question responses: Every question you answer, including your answer choices, time spent, hints requested, and error types
• Diagnostic & assessment results: Baseline assessment scores, diagnostic session results, mock test performance
• Topic mastery: Per-topic mastery levels across all SAT subjects (algebra, geometry, data analysis, reading comprehension, grammar, etc.)
• Error patterns: Recurring mistake patterns stored as vector embeddings in our learning system
• Study plans & progress: Study phases, milestones, assignments, completion status
• Essay submissions: Full essay content, AI scores, feedback, and rubric evaluations
• Chat interactions: Conversations with our AI tutors, including your questions and the tutor's responses
• Session summaries: AI-generated summaries of each tutoring session, mood indicators
• Learning preferences: Effective teaching strategies, content preferences, engagement patterns

Study Group Data

If you participate in study groups, we collect:

• Study group membership and roles
• Shared progress information (user-controlled)
• Study group invitations sent and received
• Group activity and participation metrics

Usage & Analytics Data

We collect information about how you interact with the Service, stored internally for service improvement:

• Pages visited and navigation paths
• Features used and session duration
• Device type, browser type, and operating system
• IP address and approximate geographic location
• Referrer information
• User agent strings
• Session IDs for activity tracking

We do not use third-party analytics services like Google Analytics. All analytics data is stored in our own databases and never shared with external analytics providers.

Payment Information

If you subscribe to a paid plan, payment processing is handled by Stripe. We store your email address and subscription plan information (plan name, billing period, Stripe customer ID, Stripe subscription ID) in our database. We do not store your credit card number or full payment details on our servers.

Cookies

We use a session cookie (better-auth.session_token) to maintain your authentication. This cookie expires after 7 days and is refreshed every 24 hours while you remain active. We do not use third-party advertising or tracking cookies.

3. How We Use Your Information

• Personalized Tutoring: Your learning data powers our adaptive AI tutoring system, which adjusts question difficulty, teaching strategies, and content recommendations based on your individual performance, error patterns, and learning style.
• Adaptive Algorithms: We analyze your mastery levels, error streaks, and success rates to select optimal teaching strategies (Socratic questioning, direct instruction, scaffolded learning, review, challenge mode, or encouragement).
• Progress Tracking: We use your data to generate progress reports, score predictions, mastery insights, and session summaries so you can track your SAT preparation journey.
• Communications: We send you service-related emails including welcome messages, study reminders, progress updates, study group invitations, and important account notifications. You can opt out of non-essential communications at any time.
• Service Improvement: Aggregated, anonymized usage data helps us improve our tutoring algorithms, question quality, content recommendations, and overall user experience.
• Payment Processing: We use your email and subscription information to manage your account billing through Stripe.
• Security: We monitor usage patterns to detect and prevent fraudulent activity, unauthorized access, and abuse of the Service.

4. AI Processing & Automated Decisions

Our Service uses artificial intelligence to provide personalized SAT tutoring. Here's how AI processes your data:

• AI Tutoring (Anthropic Claude): Your chat messages are sent to Anthropic's Claude AI API along with your user ID. We do not send your name or email address to the AI model. The AI generates personalized responses, explanations, and teaching strategies based on your questions and learning context.
• Content Processing (Google Gemini): We use Google Gemini for creating vector embeddings of SAT curriculum content and parsing PDF study materials. No personal user data is sent to Google Gemini—only public SAT content.
• Automated Educational Recommendations: Our system makes automated decisions about question difficulty, teaching strategies, study plan adjustments, and topic recommendations based on your performance data. These are educational recommendations designed to optimize your learning experience.
• No Training on Your Data: Your personal data is not used to train third-party AI models. Your chat interactions with Claude are processed through the API but not used by Anthropic to train their models (per our API agreement).
• Human Review: While our AI-generated assessments and recommendations are designed to be accurate, they do not affect your legal rights or similarly significant matters. If you have concerns about an AI-generated assessment or recommendation, you can contact us at support@ivyme.ai to request human review.

5. How We Share Your Information

We share your information with the following third-party services to operate the Service:

We do not sell your personal information to third parties. Ever.

6. Data Storage & Security

Your data is stored across three systems:

• PostgreSQL (Persistent Storage): Your account information, profile, learning data, question history, topic mastery, study plans, essay submissions, diagnostic results, subscription information, and analytics events are stored in our PostgreSQL database with encryption at rest and in transit.
• Redis (Temporary Session Storage): Your recent conversation messages (last 20 messages), active session tracking, pending questions, and session metrics are temporarily stored in Redis and automatically expire after 24 hours.
• Weaviate (Vector Store): Your error patterns, learning preferences, and conversation facts are stored as vector embeddings in Weaviate for semantic search and personalized recommendations. This data is retained permanently until you delete your account.

All data transmission between your browser and our servers is encrypted via TLS/HTTPS. We implement Row-Level Security on all database tables to ensure users can only access their own data. We use industry-standard security practices including secure authentication, encrypted data storage, and regular security audits.

However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security. We encourage you to use a strong, unique password and to keep your login credentials confidential.

7. Children's Privacy

IVY, Me! is designed for students preparing for the SAT, who are typically between 15 and 18 years old. In compliance with the Children's Online Privacy Protection Act (COPPA), our Service has a minimum age requirement of 13 years. Users between 13 and 17 years of age should have parental or guardian consent before creating an account and using the Service.

We do not knowingly collect personal information from children under 13 years of age. If we learn that we have collected personal information from a child under 13 without verified parental consent, we will promptly delete that information from our systems.

Parents and guardians have the right to review, correct, or delete their child's personal information, and to refuse further collection or use of their child's information. To exercise these rights or if you believe we have inadvertently collected information from a child under 13, please contact us at support@ivyme.ai.

8. Data Retention

We retain your personal information and learning data according to the following policies:

• Active Account: We retain your data for as long as your account is active or as needed to provide you with the Service.
• Session Data (Redis): Conversation messages and session metrics are automatically deleted after 24 hours.
• Learning Patterns (Weaviate): Error patterns, learning preferences, and conversation memories are retained permanently until you delete your account.
• Account Deletion: If you delete your account, we will delete your personal data within 30 days. This includes your account information, profile, learning data, question history, essay submissions, and vector embeddings.
• Anonymized Data: Anonymized or aggregated data that cannot be used to identify you may be retained indefinitely for service improvement and research purposes.
• Legal Retention: We may retain certain data longer if required by law or to comply with legal, regulatory, or accounting requirements.

9. Your Privacy Rights

You have the following rights regarding your personal data:

• Access: Request a copy of the personal information we hold about you, including your account information, learning data, question history, and study plans.
• Correction: Request that we correct any inaccurate or incomplete personal information in your profile or account.
• Deletion: Request that we delete your personal data and close your account. We will delete your data within 30 days of your request.
• Data Export (Portability): Request a portable copy of your learning data, progress history, question responses, essay submissions, and account information in a machine-readable format (JSON).
• Opt-Out: Opt out of non-essential communications (study reminders, progress updates) and certain data processing activities. Note that some communications (security alerts, policy updates) cannot be opted out of as they are essential to the Service.
• California Residents (CCPA): If you are a California resident, you have the right to know what personal information we collect, use, disclose, and sell; the right to delete personal information; and the right to opt-out of the sale of personal information. We do not sell personal information.
• Minors (Under 18): Parents or guardians can exercise these rights on behalf of minor users (ages 13-17).

To exercise any of these rights, contact us at support@ivyme.ai. We will respond to your request within 30 days. We may ask you to verify your identity before processing your request to protect your privacy and security.

10. Google API Services Disclosure

Our Service uses Google OAuth for authentication. When you sign in with Google, we request access to the following scopes: openid, email, and profile.

The data we receive from Google (your name, email address, and profile picture) is used solely to create and maintain your account on IVY, Me! We do not use Google user data for advertising purposes or to train AI models.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by posting the updated policy on this page and updating the "Last updated" date at the top.

We encourage you to review this Privacy Policy periodically. Your continued use of the Service after changes are posted constitutes your acceptance of the revised Privacy Policy.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

support@ivyme.ai