Privacy Policy
Summary
Chalk ("the Service") is provided by Thayes Ventures LLC ("we", "us", "our"), which is responsible for the personal data described in this policy. We collect the minimum data needed to run the Service. Your whiteboard drawings stay on your device. Your messages, screenshots, and voice audio are processed by our AI service providers so the tutor can respond. We do not sell your data.
1. Data We Collect
Account data: email address, display name, and a hashed password (stored using industry-standard cryptographic hashing — we never see or store your password in plain text).
Usage data: number of AI responses, subscription tier, device type (user agent), timestamps of sessions, number of characters sent to text-to-speech, and learning-progress events (which math concepts you practiced and outcomes — for the in-app progress tracker).
Content data: text of messages you send and AI responses, screenshots of your whiteboard (sent to our AI provider for context), audio recordings of your voice (sent for speech-to-text transcription, then discarded). Full conversation history and your handwritten drawings are stored on YOUR device (IndexedDB). Text-only summaries may be cached briefly on our servers to support streaming responses and progress tracking.
2. What Stays On Your Device
The following is stored only on your device (browser IndexedDB) and never uploaded to our servers:
- Your whiteboard drawings (canvas images)
- Your conversation history
- Any materials you upload (homework, study guides)
- Folder organization
Clearing your browser data or using a different device will reset this content.
3. Service Providers
To provide the Service, we share limited data with vetted service providers acting as data processors on our behalf. These providers fall into the following categories:
- AI processing providers — receive your messages, whiteboard screenshots, and voice audio for the sole purpose of generating tutor responses, transcribing speech, and synthesizing voice replies. Audio is transcribed and discarded; messages and screenshots are processed in real time and not retained for training.
- Authentication and storage providers — store account data, subscription state, and learning-progress records.
- Hosting and serverless infrastructure — runs the Service's API endpoints.
- Payment processors — process subscription payments. We do not receive your payment-card details; only the transaction status and a non-sensitive identifier.
All processors are bound by data-processing agreements limiting use of your data to providing the Service. We do not sell or share your data for advertising or other commercial purposes.
4. Legal Basis for Processing
We process your data to fulfill our contract to provide the Service (GDPR Article 6(1)(b)). Analytics data is processed on the basis of legitimate interest (GDPR Article 6(1)(f)).
5. Data Retention
Account data is retained as long as your account exists. Usage logs are retained for 90 days for operational and billing purposes, then deleted. Server-side conversation caches expire after 30 minutes of inactivity.
6. Your Rights
You have the right to:
- Access your data — use the "Export Data" button in account settings.
- Delete your account — use the "Delete Account" button. All server-side data is removed within 30 days.
- Correct inaccurate data — contact us.
- Object to processing — contact us.
7. Children's Privacy
The Service is not intended for children under 13. If we learn we have collected data from a child under 13 without parental consent, we will delete it.
8. Security
We use HTTPS for all connections, encrypted password hashing, and database access controls. However, no system is fully secure. You are responsible for keeping your account password private.
9. Cookies and Tracking
We use browser localStorage to keep you signed in. We do not use tracking cookies or third-party analytics that identify you across the web.
10. Changes to This Policy
We may update this policy from time to time. Material changes will be communicated via the Service or by email.
11. Contact
For privacy questions or data requests, contact Thayes Ventures LLC at support@try-chalk.com.
← Back to Chalk