Privacy policy

Your material, quizzes, flashcard decks, answers, subjects, review history and settings are saved in your browser’s own storage on your device. We don’t keep a copy on our servers, and we can’t see them. Clearing your browser’s site data deletes them, and a different browser or device starts empty. You can export a backup from Settings. Premium accounts are the exception, described next.

So that the same work appears on every device you sign in on, a premium account’s material, quizzes, flashcard decks, answers, subjects, review history and exam date are also stored on our servers, against your account. The files you upload are kept too — the original document or picture, not just the text read from it — so they can be opened again from any device. Theme and display settings stay on each device.

Deleting something in the app deletes it from your account as well. An uploaded file is kept for a week after the last material read from it is deleted, so an accidental deletion can still be put back, and is removed the next time your account syncs after that. “Delete everything” in Settings removes all of it from this browser and from your account, with uploaded files following on the same week’s delay. If your account moves back to the free plan, what is already stored stays yours and can still be opened, but nothing new is synced.

• Account details: your username, email address and password. The password is stored only as a salted hash, never as the password itself. If you add them, your display name and profile picture are stored too.
• Usage records: each time you make a quiz or deck, we record what kind of request it was, when, which AI model handled it, how many tokens it used and what it cost. We use these to enforce daily limits and keep costs in check. They don’t contain your material.
• Things you send us: feedback messages and any screenshots attached to them, premium requests and the note you add, and reports on a question or card. A report includes the question or card, your reason if you give one, and a short excerpt of the material it came from.
• Plan details: whether your account is free or premium, and which admin changed it and when.

We don’t use advertising, analytics or tracking scripts, and we don’t collect your location.

To write a quiz, your material has to be read by an AI model. When you make one, what you gave it is sent through our server to the provider that does that part of the work. Those providers are:

• OpenAI, which writes questions and flashcards and marks written answers.
• Google (Gemini), which transcribes uploaded video and audio (premium only).
• Anthropic, only if this deployment is configured to use Claude for questions.
• Brave Search, which receives the name of a topic you ask Prufa to research, not your material.
• YouTube, from which our server fetches the captions of a video you link. YouTube sees our server’s request, not yours.

Each provider processes what it receives to return a result, under its own terms and privacy policy. We don’t save your material to our database. The only exception is the short excerpt attached to a report you choose to send. Don’t put anything in your material that you wouldn’t want these providers to process, such as passwords, health information or other people’s personal details.

The site is hosted on Vercel, and account data is stored in a Postgres database run by Neon. Files a premium account uploads are stored with Cloudflare (R2), in private storage that only your account can open. All three process data only to run the service. Like any web host, they may keep short-lived technical logs, such as IP addresses and request times, for security and reliability.

We set one cookie. It keeps you signed in, can’t be read by scripts on the page, and expires after 30 days or when you sign out. There are no advertising or third-party cookies. Everything else the app remembers, such as your quizzes and settings, is kept in your browser’s local storage, as described above — and, for a premium account, on our servers too.

Some browsers can send a “Do Not Track” or Global Privacy Control signal. We don’t track you across other sites or sell your information whether or not your browser sends one, so there is nothing for the signal to switch off.

We use what we collect to run your account, write your quizzes, enforce plan limits, answer feedback, fix wrong questions and keep the service secure. We don’t sell your personal information, share it for targeted advertising, or use it to build a profile of you. We disclose it only to the service providers named above, or when the law requires it.

Account details, usage records, feedback, premium requests, reports, and a premium account’s synced work and uploaded files are kept while your account exists, unless you delete them sooner. When an account is deleted, all of them are deleted with it. Backups held by our database provider may take a short time to expire.

You can change your display name and picture on your profile. You can also ask us to:

• tell you what personal information we hold about you and give you a copy,
• correct anything that is wrong, including your email address,
• delete your account and everything stored with it.

Email prufaapi@gmail.com from the address on your account. We’ll answer within 45 days. If we can’t verify that the request is yours, we may ask you to confirm it from that address. If we turn down a request, you can reply to appeal, and we’ll explain our final decision.

These rights apply to everyone, wherever you live. Residents of California, Colorado, Connecticut, Virginia and other states with privacy laws have them by law. Asking will never change the service you get.

Prufa is not meant for children under 13, and you must be 13 or older to create an account. If you are under 18, you need a parent’s or guardian’s permission. We don’t knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, email prufaapi@gmail.com and we’ll delete it.

Passwords are hashed, the session cookie is signed and can’t be read by scripts, and everything is sent over HTTPS. No system is perfectly secure. If we learn of a breach affecting your information, we’ll tell you as the law requires.

If this policy changes, we’ll update the date at the top. If a change is significant, we’ll also tell signed-in users in the app before it takes effect.

Questions or requests about your privacy: prufaapi@gmail.com. See also the terms of service.