Privacy &
your data
We treat privacy as a foundational part of the product, not a compliance checkbox. This policy explains, in plain terms, what we collect, who processes it, how we protect it, and the control you have over it.
1. Core Principles
Purpose-limited processing
We use your study materials to generate your flashcards, quizzes, summaries, and tutor responses — nothing else. We do not sell your data, and we do not use your uploads to train AI models.
Transparency
This policy names every third-party service that touches your data. If that list changes, we update this page and the effective date above.
2. What We Collect
We handle three categories of data:
Identity data
Your name, email address, and authentication credentials — used to run your account and keep it secure.
Study data
The PDFs, notes, photos, and topics you upload, and the flashcards, quizzes, and summaries generated from them. This is stored in your account so you can return to it.
Usage data
Session activity, feature usage, and performance metrics we use to understand what's working and improve the product.
3. Who Processes Your Data (Sub-processors)
To run the service we rely on a small set of third-party providers. Each processes only the data needed for its function, under its own data-processing terms:
- NVIDIA — hosts the AI models that generate your study materials. Your prompt and source text are sent for inference.
- OpenRouter — routes some AI requests to third-party model providers on our behalf.
- Supabase — our database and file-storage provider, where your account and uploads are stored (encrypted at rest).
- PostHog — privacy-focused product analytics, used to measure usage and improve the app.
- Paystack — handles payments. Card details go directly to Paystack; we never receive or store your card number.
Your study materials are sent to NVIDIA and/or OpenRouter only to generate the output you asked for. We do not control those providers' model-training policies, so review their terms if that matters to you.
4. Security
We protect your data with a layered approach:
- In transit: all traffic between your device and our servers is encrypted over HTTPS/TLS.
- At rest: your data is stored on Supabase infrastructure, which encrypts data at rest (AES-256).
- Access control: access to stored data is limited to the systems and authorised personnel needed to operate and support the service. We use role-based controls and keep credentials scoped — but we want to be honest: our operations and support staff can, where necessary for support, security, or legal reasons, access account data. We do not browse it casually.
5. Your Rights
You stay in control of your data.
- Access & export: request a copy of your account data in an open format (JSON) from Settings.
- Deletion: permanently delete your account and its associated data from Settings.
- Correction: update your profile and account details at any time.
6. Children
Novari's standard accounts are intended for users aged 13 and older (or the minimum age in your jurisdiction). Kids Mode is designed to be used under the guidance of a parent, guardian, or teacher. We do not knowingly collect personal information from children under 13 without appropriate consent; if we learn we have, we will delete it.
8. Changes
As the product evolves, this policy will too. We'll note material changes here with a new effective date, and where appropriate, notify you by email or in the app.
Contact
Questions about this policy or your data can be sent to our team. privacy@novaristudy.site.