How we collect, use, share, and protect your information
This Privacy Policy explains how the operator of Nebulearn("Nebulearn," "we," "us," or "our") collects, uses, discloses, and protects personal information. It applies to nebulearn.app and www.nebulearn.app, the Nebulearn iOS and Android apps, the Nebulearn Chrome extension, our APIs, and related features (together, the "Service").
Nebulearn is operated from Canada. We handle personal information in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, where they apply, other laws such as GDPR, UK GDPR, and U.S. state privacy laws. This policy describes our practices. It is not legal advice and does not create rights beyond those the law already gives you.
Our Terms of Service govern use of the Service. If you do not agree with this policy, do not use the Service.
We collect information you provide, information created when you use the Service, and information from third parties that help us operate it.
Username, email address, password (stored in hashed form if you use email sign-up), Google or Apple account identifiers if you sign in that way, email-verification and password-reset tokens, signup method, optional profile fields such as bio, country, and avatar, role (for example student or teacher), referral codes, and preferences such as marketing-email unsubscribe status.
We do not collect a legal name as a required account field. If you type a name into a contact form, profile, or study content, we will store what you submit.
Folders, flashcards, quizzes, rich text, tags, notes, explanations, answer choices, photos attached to cards (stored in Amazon S3), import/export files, study-session results, spaced-repetition data, confidence ratings, streaks, ELO-style ratings, achievements, tutor chat threads, and similar learning records.
Text, images, PDFs, audio, and similar files you upload or paste so we can generate questions, transcribe audio, autofill cards, power the study tutor, or run related AI tools. Temporary copies on our servers are deleted after processing. Content sent to Google Gemini is handled under Google's terms (see Section 4).
Session cookies and tokens (including an httpOnly authentication cookie, a logged-in flag cookie, and a short-lived session cookie), JWTs stored in the browser, native app, or Chrome extension, OAuth tokens needed to keep you signed in, IP address, browser and device type, app version, and approximate security/usage signals used to run and protect the Service. We use Google reCAPTCHA on some sign-up and sign-in flows.
Subscription tier and status, billing provider, trial and renewal dates, Stripe customer and subscription IDs for web purchases, RevenueCat / App Store / Google Play identifiers for mobile purchases, and related transaction IDs. We do not receive or store full payment card numbers. Stripe, Apple, or Google process those.
Emails you send us, contact-form messages (processed by Formspree), support correspondence, and records of transactional emails we send (verification, password reset, security, and similar). If you receive optional product or marketing email, we store related preference and delivery information.
Feature use, pages viewed, referral or acquisition source, device and app surface (web, iOS, Android, or Chrome extension), in-app notification records (generally kept for a limited period), and aggregated product analytics. On the website we also use Google Analytics and, on some pages, Google AdSense (not in the native apps).
We do not require government ID, precise GPS location, or health records. Do not put sensitive personal information (health, financial account numbers, government IDs, or information about children under 13) into study content or AI uploads.
We use personal information to:
We do not sell your study materials as a product to other companies. We do not use your private decks to train our own machine-learning models.
Nebulearn uses Google's paid Gemini Developer API (server-side API key; we pay Google for usage) for features such as generating questions and flashcards, autofill, chat, audio transcription, distractors, and the study tutor. This is not the consumer Gemini app. Some image-occlusion processing (for example OCR) may run on our own servers instead of Gemini.
When you use an AI feature, we send Google the material needed to fulfill your request. That can include prompts, uploaded or pasted files, selected webpage text or snips from the Chrome extension, card text, explanations, choices, study statistics, tutor chat history, and photos attached to cards. Files may also be uploaded to Google's Gemini Files API so the model can read them.
We do not use your content to train Nebulearn's own models. Under Google's current Gemini API Additional Terms for Paid Services, Google states that it does not use paid-API prompts (including files and system instructions) or generated responses to improve Google products. Google may still log prompts and responses for a limited time for abuse, safety, and legal compliance, and may process that data in countries where Google or its processors operate. Google's terms can change. If usage were ever on unpaid API quota, Google's unpaid terms could allow Google to use content to improve its services. We intend to keep these features on paid API usage.
Temporary copies stored on our servers for generation are deleted after processing. We cannot control how long Google retains API logs or Files API uploads under its own policies. Treat anything you send to an AI feature as visible to Google.
AI output can be wrong. See the Terms of Servicefor your responsibility to verify it.
Private folders stay in your account unless you share or publish them. If youpublish a folder, other users may browse, copy, like, and export it, including photos. If you share a folder with another user, they can access it according to the permission you grant. Public profiles may show your username, avatar, bio, country, stats, and published decks.
Copies that others have already made are not automatically removed if you later unpublish or delete the original. Do not publish personal information you are not willing to make public.
We share personal information with service providers that process it for us, when you ask us to (for example publishing or sharing a deck), when required by law, or to protect rights and safety. We do not sell your personal information for money.
Current categories of recipients include:
Providers may change as we operate the Service. Each provider's own privacy policy also applies to what they process. We require providers we contract with to use personal information only to provide their services to us, except where they act as independent controllers (for example Google acting on its own Analytics or Ads terms, or Apple and Google acting as stores).
We may also disclose information if we believe it is reasonably necessary to comply with law or legal process, enforce our Terms, or protect Nebulearn, users, or the public. If we sell or reorganize the business, personal information may be transferred as part of that transaction, subject to this policy or a successor policy.
On the website we use Google Analytics 4 to understand how the Service is used (pages, devices, general location derived by Google, and similar). The Chrome extension may also send limited Analytics events with a stored client identifier.
On some website pages we use Google AdSense to show ads. Google and its partners may use cookies or similar identifiers for advertising, including to measure ads and, where permitted, to personalize them. Native iOS and Android apps do not load Google Analytics or AdSense in the app shell.
You can control Google Analytics and ads through your browser settings, Google's ad settings, and industry opt-out tools such as the Digital Advertising Alliance. Blocking cookies may limit some website features.
We and our providers use cookies, local storage, and similar technologies:
authToken), logged-in state (loggedIn), and short-lived session (nebulearn_session). The Service will not work properly without these.The native apps store authentication and preferences on-device (for example local storage or app preferences) rather than website cookies. The extension stores a login token and some preferences in Chrome storage.
Web billing is handled by Stripe. Mobile subscriptions and some add-ons are handled by Apple or Google through RevenueCat. Those companies collect payment details under their own policies. We keep subscription status and identifiers needed to provide paid features, cancel, or restore purchases.
The apps may store a login token and preferences on your device, schedule local study reminders you turn on (these are not sent through our servers as push notifications), and process in-app purchases via RevenueCat / the stores. Social login uses Google and/or Apple.
If you use the extension, it can access page content you choose to capture (selected text, generate-from-page actions, or a screen snip) on websites you visit, and send that content to Nebulearn, including to AI features. It may read and write the clipboard when you use capture features. It stores a login token locally and may sync AI-instruction profiles through Chrome sync storage. We do not use the extension to collect your full browsing history.
We keep account and study data while your account is active. If you delete your account, we delete or de-identify associated personal data within about 30 days, except:
In-app notifications are generally retained for a limited period (currently about 90 days). Transactional email logs and security logs are kept as reasonably needed to operate and protect the Service.
We use reasonable administrative, technical, and physical safeguards appropriate to the sensitivity of the information, including encryption in transit (HTTPS), hashed passwords, access controls, and hosting with reputable providers. No method of transmission or storage is completely secure. You are responsible for using a strong unique password and for activity on your account.
We do not currently offer two-factor authentication. Protect your email account, because it can be used to reset access.
We operate from Canada. Your information may be processed in Canada, the United States, the European Union, and other countries where we or our providers (including Google, Amazon, MongoDB, Stripe, Apple, and hosting partners) have facilities. Those countries may have privacy laws that differ from the laws where you live. Where required, we rely on appropriate safeguards such as contractual commitments with providers.
The Service is not directed to children under 13. You must be at least 13, and at least the minimum age required in your country if that age is higher (for example 16 in some EEA countries). We do not knowingly collect personal information from children under 13.
If you believe a child under 13 has created an account, contact us. We will delete the account and associated personal information. Parents or guardians of users under the age of majority should supervise use of the Service.
Depending on where you live, you may have some or all of the following rights:
To make a request, email nebulearn.app@gmail.com. We may need to verify your identity. We will respond within the time the applicable law requires (PIPEDA generally expects a response within 30 days).
If you are a consumer in California or another U.S. state with a comprehensive privacy law, you may have rights to know, access, correct, delete, and obtain a portable copy of personal information, and to opt out of certain "sales" or "sharing" of personal information for targeted advertising, and from certain profiling, subject to legal exceptions.
We do not sell personal information for money. On the website, Google Analytics and Google AdSense may use cookies and similar identifiers in ways that some state laws treat as "sale" or "sharing" for cross-context behavioral advertising. Native apps do not load those website ad/analytics tags. To opt out of that kind of advertising, use Google's ad settings, your browser's cookie controls, or industry opt-out pages. You may also email us to request that we record an opt-out preference for your account.
We do not knowingly sell or share the personal information of consumers under 16. We will not discriminate against you for exercising privacy rights.
Categories of personal information we collect, sources, and purposes are described in Sections 2–7. We disclose those categories to the service providers listed in Section 6. We do not use sensitive personal information to infer characteristics about you.
If European data-protection law applies, Nebulearn is the controller of personal data processed to provide the Service to you. Our legal bases typically include:
You may have rights of access, rectification, erasure, restriction, objection, and data portability, and the right to withdraw consent. AI features process content you choose to submit; they are not used to make legal or similarly significant decisions about you without human involvement.
If we become aware of a breach of security safeguards involving personal information that creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as PIPEDA requires, and we will notify others as other applicable laws require.
We may update this policy to reflect changes in the Service, providers, or the law. We will revise the "Last updated" date. For material changes we may also notify you by email or in the Service. Continued use after an update means you accept the revised policy. If you do not agree, stop using the Service and delete your account.
Privacy questions, access or deletion requests, and complaints: email the operator of Nebulearn. This address is our privacy contact for PIPEDA purposes.
Support: support@nebulearn.app · Contact form · Terms of Service