Privacy Policy

This Privacy Policy describes how Aroses("we," "us") collects, uses, and shares information when you use our website and services (the "Service").

1. Information we collect

• Account information: such as email address and authentication identifiers when you sign up or log in (we use Supabase for authentication).
• Content you upload: files (e.g., PDFs), course titles, descriptions, and generated study materials stored in connection with your account.
• Usage data: basic technical data such as device/browser type, IP address, and timestamps may be processed by our hosting and analytics providers as part of operating the Service.
• AI interactions: when you use AI features (e.g., study chat or course generation), prompts and context derived from your materials may be sent to our AI provider (e.g., Anthropic) to produce responses.

2. How we use information

• To provide, maintain, and secure the Service.
• To process uploads and generate lessons, quizzes, and related features.
• To communicate with you about the Service (e.g., auth emails).
• To comply with law and enforce our Terms.

3. How we store data

Data is stored using infrastructure we configure (for example, Supabase for database and authentication). We use industry-standard practices appropriate to our stage of operations; no method of transmission or storage is 100% secure.

4. Third parties

We use subprocessors that process data on our behalf, including hosting, database/auth (e.g., Supabase), and AI inference (e.g., Anthropic Claude). Their use of data is governed by their respective policies and our agreements with them. We do not sell your personal information.

5. Children's privacy

The Service is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe we have collected such information, contact us and we will take appropriate steps to delete it.

6. Your choices

• You may request deletion of your account or certain data by contacting us (see below). Some information may be retained where required by law or for legitimate business purposes (e.g., security logs).
• You can stop using the Service at any time; deletion rights may vary by region (e.g., GDPR, CCPA).

7. International users

If you access the Service from outside the United States, your information may be processed in the United States or other jurisdictions where our providers operate.

8. Changes

We may update this Privacy Policy from time to time. We will update the date at the top of this page when we do.

9. Contact

Add NEXT_PUBLIC_LEGAL_EMAIL to your environment for a contact link here.