DRAFT: not final. To be completed with the school before real students use the site.
Still to decide:
- Who runs Coursebook and who to contact (name, email, address)
- For each tutoring program: who runs it, and whether its school needs a data agreement (FERPA) and parental consent for students under 18
- Confirmation that every student is 13 or older (COPPA)
- How long data is kept after a student leaves
- Tutoring-program data: scores, answers, attendance, messages, guardian contacts, and what's sent to Claude (Anthropic)
See PRIVACY_REVIEW.md in the project for the checklist.
Privacy Policy
Last updated: November 9, 2026
This explains what the operator of this Coursebook site (“we”) collects when you use Coursebook, why, who else handles it, and how to delete it. Short version: we keep what’s needed to run your courses, your books stay private, there are no ads or third-party trackers, and deleting your account deletes your data.
1. What we collect
- Account: your name, email address and a scrambled (hashed) version of your password. If you sign in with Google, we receive your name, email and profile picture from Google.
- Your books: the PDF files you upload, the text and images we read from them, and the courses made from them (outline, lessons, questions, flashcards, tests).
- Your studying: progress, answers and grades, flashcard reviews, highlights, notes, tutor conversations, study plans, minutes studied and your study preferences (daily goal, time zone, reminders).
- Usage records: for each AI request, which feature it was for, how many tokens it used and what it cost (to enforce plan limits). We also count a few actions, such as downloads and searches, to see which features are used.
- Technical data: your IP address and browser, used to keep you logged in, limit abuse (for example too many login attempts) and in short-lived server logs.
2. How we use it
Only to provide the service you asked for: reading your books, writing and showing your courses, grading answers, reminders you turned on, account emails (verification, password reset), enforcing limits, keeping the service secure, and fixing problems.
We don’t sell your data, show ads, or use your books or study data to train AI models.
3. If you join a tutoring program
A tutoring program (for example, a school's SAT program) runs its classes on Coursebook. Inside it, your tutors see your work for their classes (some only for their subject or group), and your program admin sees the whole program.
Messages between students and tutors can be read by your program admin, to keep everyone safe. Other students never see your scores or messages.
Each program's data is its own: it isn't shared with other programs.
4. Who else handles your data
We use a few providers to run the service. They process data only on our instructions:
- Anthropic (Claude API) receives the parts of your book needed for each task (a lesson’s pages, a question’s cited pages, the passages relevant to a tutor question), plus your written answers and tutor questions. Under Anthropic’s commercial terms, API data isn’t used to train their models and is kept only for a limited time for safety monitoring.
- Hosting, database and file storage providers store your account, courses and uploaded PDFs.
- An email provider sends account emails and the reminders you turn on.
- Google, only if you choose “Continue with Google”.
The “Ask the book” search index (embeddings) is computed on our own server; your book isn’t sent anywhere else for it. Your data may be processed in countries other than your own; we use providers that offer appropriate safeguards for this.
6. How long we keep it
- Your account, books, courses and study data: until you delete them or your account.
- Uploads that never finished: removed automatically after a day.
- When you delete your account, your books, files, courses and study data are deleted at once. Cost records and feature counts are kept without anything that identifies you, for our accounting.
- Server logs and backups roll over and are deleted within about 30 days.
7. Your choices and rights
- See and take your data: each course can be downloaded (Export: Markdown, PDF, CSV, Anki), and your notes and highlights can be exported too.
- Correct it: change your name, email and password in Settings, and edit lessons and notes yourself.
- Delete it: delete a course from your library, or your whole account in Settings.
- Reminders: off by default; every reminder email has a one-click link to turn them off.
Depending on where you live (for example under the GDPR or CCPA), you may have further rights, such as asking for a copy of all your data or objecting to how it’s used, and you can complain to your data protection authority. To use any of these rights, email [set CONTACT_EMAIL on the server].
8. Security
Passwords are hashed, connections are encrypted (HTTPS), every request is checked so you can only reach your own data, and uploaded files are only available through short-lived links. No system is perfectly secure; if we learn of a breach affecting you, we’ll tell you as the law requires.
9. Children
Coursebook isn’t meant for children under 13 (or the minimum age in your country). If you think a child has given us data, contact us and we’ll delete it.
10. Changes and contact
We’ll tell you about important changes by email or in the app. Questions, or to use your rights: [set CONTACT_EMAIL on the server].