Transparency
Where your notes go.
You upload the material you are being examined on. That is not casual data, and "we take security seriously" is not an answer. This page names every company that touches your work, what each one receives, how long anything is kept, and what happens the day you decide to leave. It is written to be checked, not admired.
Last reviewed 31 August 2026 Version 2026-08-31
Your work never trains a model.
Not ours, not our providers'. Every AI account we hold is a commercial one whose terms forbid training on customer data, and we have never had a business reason to want it otherwise.
You can take all of it, any day.
One button in Account produces a single JSON file containing every board, card, paper, lecture, transcript and recording reference on your account. No request form, no waiting on us.
Deletion actually deletes.
It is not a flag on a row that stays forever. Your documents and files are erased, and you have seven days to change your mind before that happens.
Every vendor is named.
Every company that touches your data is listed below, with what it receives and why. If that list ever changes, this page changes with it.
One request, end to end
What happens when you ask for a set of cards
Every AI feature on the platform — cards, papers, marking, lectures, the oral examiner — takes the same path. Your browser never talks to an AI company directly, and it never holds a key that could.
Not collected in the first place
Three things we made sure we never receive
The strongest guarantee about a piece of data is that nobody ever held it. These are the places we designed ourselves out of the loop.
Your password
We never see it. Our sign-in provider stores a hash; we get an identifier. When you choose a password we check it against known breach lists without sending it: your browser hashes it, sends the first five characters of that hash, and compares the returned list locally. The password itself never crosses the wire.
Your card number
Card details go straight from your browser to Stripe and are never routed through us. We receive a customer identifier, a plan and a status. We could not produce your full card number if we were asked to.
The original recording
When you drop an audio or video file into the scratchpad, the file itself is never uploaded. Your browser decodes it, reduces it to plain 16 kHz mono speech chunks and sends only those. Whatever else the original contained — video, other tracks, embedded metadata — stays on your machine.
Sub-processors
Every company that touches your data
Each is under a written agreement that permits them to use your data only to provide the service to us. None of them may train on it. Which AI provider serves a given feature is an operational setting and can change between the three named here — it will not silently become a fourth.
| Company | What it does for you | What it receives | How long they keep it |
|---|---|---|---|
| Google CloudFirebase · United States | Sign-in, database, file storage, hosting, the servers themselves, bot protection | Everything. This is where your account lives. | As long as you keep it. Google is storing it on our behalf, not using it. |
| OpenAIUnited States | Generating cards, papers and lectures; marking written answers; the spoken examiner; text-to-speech; the safety check | Only the text a single request needs, plus your spoken answer for the live examiner. No account identity beyond an opaque reference. | Nothing retained. Our account runs with zero data retention, so requests are not stored after the response returns. |
| AnthropicUnited States | The same study tasks, for the features currently pointed at Claude models | Only the text a single request needs. | Up to 30 days for abuse monitoring, then deleted. Never used for training. |
| GroqUnited States | Turning your recorded speech into text | Short chunks of 16 kHz audio and nothing else — no name, no account, no context. | Not retained after the transcript is returned. |
| StripeUnited States and local entities | Taking payment and running subscriptions | Your card details, directly from your browser. Your email and plan. | As their own terms and financial record-keeping law require. |
| Amazon Web ServicesUnited States | Sending you transactional email — verification, receipts, share invitations | Your email address and the message. | Delivery logs only, on their standard schedule. |
| Apple and GoogleApp Store · Play · United States | Distributing the mobile apps and reporting crashes and installs | Install and crash statistics under their own policies. Not your study content. | Per their published policies. |
Where this runs. MySummaries is an Australian company and the service is operated from Melbourne, but the servers and storage are in the United States. If you are in the EEA, the UK or Switzerland your data is therefore transferred outside your region, and we rely on the EU–US Data Privacy Framework where a provider is certified under it and Standard Contractual Clauses where it is not. You can ask us for a copy of those safeguards.
Retention
How long anything stays
A cleanup job runs every night at 4:15am Melbourne time and enforces every window below. These are not intentions — they are the numbers in the code that does the deleting.
Recordings of spoken answers follow whatever window your program sets, if you are studying under one that sets a shorter one. When it expires the audio file is destroyed and the attempt keeps only its transcript and marks.
Leaving
What deleting your account actually does
You do it yourself, from Account. There is no email to send and nobody to persuade. You will be asked to type the words in full, because this is not a button anyone should press by accident.
Before you go, take your work. Deletion is irreversible after the seventh day, so export first — the file contains everything, in a format you can read without us.
Controls
What protects the account
-
In place
Encryption everywhere. TLS in transit, encrypted at rest by default across the database and file storage.
-
In place
Per-account access rules at the data layer. Enforced by the database and storage engines themselves, not by the app asking politely. An account cannot read another account's documents even with a modified client.
-
In place
A written permissions table, tested. Who may read and write what is documented, and two automated test suites fail the build if the rules stop matching the table.
-
In place
Rate and size limits on every AI action. Per account, per feature. A test fails the build if a new endpoint ships without one.
-
In place
Provider keys held server-side only. In a managed secret store, injected at runtime. No key is present in any app bundle or web page.
-
In place
Browser security headers, enforced. Strict transport security, a content security policy that is enforced rather than merely reported, framing denied, and a test that fails if a site loses them.
-
In place
Download links that expire. Data exports are served by short-lived signed URLs that die on their own, never by permanent tokens that keep working forever once shared.
-
In place
Breach-checked passwords and verified email. A minimum password policy, a check against known breach lists, and email verification before an account can spend anything.
-
In place
Content sanitised where it is stored. Anything that can be written into a shared board is cleaned against a strict allowlist, so a shared board cannot carry a script into a collaborator's browser.
-
In place
Tests as a release gate. Unit, rules, end-to-end and payment tests all run before anything reaches production.
-
Not yet on
App attestation. The machinery is built and registered on all three platforms, but enforcement is off until we can see that every installed app version is sending a valid token — turning it on early would lock out people running older builds.
Honest gaps
What we have not done
Any security page can list what a company does well. This is the other half, and it is the half worth reading. If one of these matters to you, ask — and if it matters enough to enough people, it moves up the list.
-
No SOC 2 report
We have not been through a SOC 2 audit. Nothing on this page has been checked by an independent auditor; it is our own description of our own system, which is exactly as much as it is worth.
-
No third-party penetration test
The platform has been through an internal security review and the fixes from it shipped, but no outside firm has tried to break in.
-
No data residency choice
Everything runs in the United States, including for Australian and European users. There is no option to keep your data in your own region, and adding one would mean moving the whole platform.
-
No two-factor authentication yet
You can sign in with Google and inherit whatever protection you have on that account, which is currently the strongest option available here. Native two-factor for email sign-in is not built.
-
Staff can reach production data
We are a small team and administrative access exists — it is how support requests and bug reports get investigated. It is limited to what the job needs and it is not anonymous, but we are not going to pretend nobody can look.
Reaching us
Found something, or want something checked
Reporting a vulnerability
Tell us privately first and give us a reasonable window to fix it. We will confirm we received it, keep you updated, and credit you if you want the credit. We will not threaten you for reporting in good faith.
[email protected]Privacy requests
Access, correction, deletion or a copy of the transfer safeguards. Export and deletion you can do yourself from Account, immediately; anything else comes through here.
[email protected]Something on this page looks wrong
If a claim here does not match what you observe, that is a bug and we want to know. Publishing this only means something if it can be contradicted.
[email protected]