Privacy Policy

1. Information We Collect

2. How We Use Your Information

We use the information we collect to:

• •Provide and personalize the Service, including updating your knowledge graph and generating AI content tailored to your performance
• •Enable study room and social features, including anonymized class-wide insights
• •Process and respond to feedback and issue reports
• •Maintain the security and integrity of the Service

3. Google OAuth and Calendar

If you sign in with Google or connect your Google Calendar, we receive access tokens to authenticate you and, if you grant calendar access, to read and write assignment data. We do not access any Google data beyond what is necessary to provide the features you enable. You can revoke this access at any time through your Google account settings.

4. How We Share Your Information

We do not sell your personal data. We share information only in the following limited circumstances:

• •Service providers: We use Supabase (database), Google Gemini (AI processing), and similar infrastructure providers. These providers process data on our behalf under their own privacy policies.
• •Study rooms: Your display name, avatar, and knowledge graph data are visible to other members of study rooms you join. Class-wide data shared with other users is anonymized.
• •Legal requirements: We may disclose information if required by law or to protect the rights and safety of our users.

5. Data Retention

We retain your data for as long as your account is active. You may request deletion of your account and associated data by submitting a request through the app's feedback tool.

6. Security

We take reasonable technical and organizational measures to protect your data:

• •In transit: traffic between your browser and our servers is encrypted using HTTPS/TLS.
• •At rest (application layer): certain sensitive fields are encrypted by our backend using AES-256-GCM before they are written to the database. This currently covers your profile name, bio, and location; Google OAuth tokens; document summaries and AI-generated concept notes; tutoring chat messages; study room messages; tutoring session summaries; gradebook assignment scores and notes; and calendar assignment notes.
• •At rest (storage layer): our database provider (Supabase) enforces access controls and applies its own encryption at rest at the storage layer.

The encryption keys used for application-layer encryption are managed by Sapling, which means we — and the AI and infrastructure providers described in Section 4 — can technically decrypt your data when required to operate the Service. This is not end-to-end encryption. No system is completely secure, and we cannot guarantee absolute security.

7. Children's Privacy

Sapling is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal data, please email us at careers@saplinglearn.com and we will take steps to delete it.

8. Job Applicants

If you apply for a position at Sapling, we collect the information you submit through our application form, including your name, email address, phone number, LinkedIn profile URL, and resume. This data is used solely to evaluate your application and communicate with you about the hiring process. We do not share applicant data with third parties outside of our core infrastructure providers. If your application is unsuccessful, we may retain your information for up to 12 months in case a suitable role arises. You may request deletion of your applicant data at any time by emailing careers@saplinglearn.com.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes by updating the date at the top of this page.

10. Contact

If you have questions or concerns about this Privacy Policy, please email us at careers@saplinglearn.com.