Privacy policy
Last updated 6 November 2026. Draft for launch: the company name, contact address and the named email sender and web host are filled in at go-live.
The short version
- Your uploads are private. Only you can see them.
- Your files are never used to train AI, ours or anyone's.
- AI reads your material only when you add it, to make your topic map, cards and questions. Studying itself never sends anything to an AI.
- Delete everything in Settings removes your account and all your data within 1 hour. Database backups roll off within 7 days.
- No third-party analytics. We count returns and sessions from our own tables.
- Unpack is for people 18 and over.
What we keep
- Account: your email (or the Google or Apple sign-in id), birth year and your "18 or older" confirmation, your settings (daily goal, theme, your tutor's voice on or off), and the advert campaign you came from if you came from one.
- Your material: the files, photos, pasted text and article links you add, the text read from them, and the topic map, cards and questions made from them.
- Your studying: reviews, answers, practice exams, daily minutes and streaks.
- Limits: how many uploads you made today and any extra upload you unlocked with an ad.
- Cost records: for each AI request, the task, model, token counts and cost. When you delete your account these keep only the anonymous numbers.
Where it is kept and how
On Supabase in one region, US East. Uploads sit in a private storage bucket; every table is protected so an account can only reach its own rows; download links expire in 10 minutes. Data is encrypted in transit and at rest.
Who processes your data
| Processor | What for |
|---|---|
| Supabase | Database, private file storage, sign-in, server functions (US East). |
| Google Gemini API | Reading your material and making topics, cards and questions, on a paid tier that does not train on your data. |
| OpenAI API | Backup model for the same tasks if Gemini is unavailable, on a paid tier that does not train on your data. |
| Google (AdMob, Ad Manager and the consent tools) | Showing ads outside studying and asking for your consent. Nothing from your uploads, links or topics is ever sent with an ad request. |
| Google and Apple sign-in | Signing in, if you choose them. |
| Our email sender (named at launch) | Sending your 6-digit sign-in code. |
| Our web host (named at launch) | Serving this website and the web app. |
| Your browser's or phone's speech service | Only if you tap the microphone during onboarding: your browser or phone turns speech into text. Chrome sends the audio to Google and Safari sends it to Apple to do this; on phones the platform's own recogniser is used. We never store audio, only the text you confirm. |
Ads and your choices
Ads never appear during a card, a question, an exam or onboarding. In the EU, UK and Switzerland we ask before any ad or ad-measurement cookie is set; if you say no, you see non-personalised ads only. You can change your choice any time in Settings, Privacy choices. Ad requests are never marked as aimed at children, because every account is 18 or over.
Deleting
Delete one file from its course and its pages, cards and questions go with it. Delete everything in Settings signs you out at once and removes your account, files and progress from our servers within 1 hour; backups roll off within 7 days.
Your rights
You can see, export, correct or delete your data. Write to the privacy contact below; we answer within 30 days.
Contact
Privacy contact: privacy@unpackstudy.com. Content that should not be here: report it.