Transparency
Where your notes go.
You upload the material you are being examined on. That is not casual data, and "we take security seriously" is not an answer. This page names every company that touches your work, what each one receives, how long anything is kept, and what happens the day you decide to leave. It is written to be checked, not admired.
Last reviewed 20 October 2026 Version 2026-10-19
Your work never trains a model.
Not ours, not our providers'. We reach every AI provider through its API, and under their API terms they may not use what we send to train their models. We have never had a business reason to want it otherwise.
You can take all of it, any day.
One button in Account produces a single JSON file containing every board, card, paper, lecture, transcript and recording reference on your account. No request form, no waiting on us.
Deletion actually deletes.
It is not a flag on a row that stays forever. Your documents and files are erased, and you have seven days to change your mind before that happens. The short list of what is kept is further down this page.
Every vendor is named.
Every company that touches your data is listed below, with what it receives and why. If that list ever changes, this page changes with it.
One request, end to end
What happens when you ask for a set of cards
Every AI feature on the platform — cards, papers, marking, lectures, the recorded oral exam — takes the same path, and no app or web page ever holds one of our provider keys.
Not collected in the first place
Three things we made sure we never receive
The strongest guarantee about a piece of data is that nobody ever held it. These are the places we designed ourselves out of the loop.
Your password
We never see it. Our sign-in provider stores a hash; we get an identifier. When you choose a password we check it against known breach lists without sending it: your browser hashes it, sends the first five characters of that hash, and compares the returned list locally. The password itself never crosses the wire.
Your card number
Card details go straight from your browser to Stripe and are never routed through us. We receive a customer identifier, a plan and a status. We could not produce your full card number if we were asked to.
The original recording
When you drop an audio or video file into the scratchpad, the file itself is never uploaded. Your browser decodes it, reduces it to plain 16 kHz mono speech chunks and sends only those. Whatever else the original contained — video, other tracks, embedded metadata — stays on your machine.
Sub-processors
Every company that touches your data
Each handles your data under its terms with us, to provide its part of the service. Under their API terms, none of the AI providers may use it to train a model. Which AI provider serves a given feature is an operational setting and can change between the four named here — it will not silently become a fifth.
| Company | What it does for you | What it receives | How long they keep it |
|---|---|---|---|
| Google CloudFirebase · United States | Sign-in, database, file storage, hosting, the servers themselves, bot protection | Everything. This is where your account lives. | As long as you keep it, plus nightly database backups that expire after 30 days. Google is storing it on our behalf, not using it. |
| Google AnalyticsGoogle LLC · United States | Usage statistics for this site, the web app and the affiliate portal. Not used for advertising. In the EEA, the UK and Brazil it runs with analytics storage denied by default: no analytics cookie is set, and Google receives cookieless pings instead. | The pages you view, an approximate location Google works out from your IP address, your device and browser type, and the actions you take as event names and counts. Never your notes, cards, answers or recordings, and never your name or email. | Per Google's published policies. |
| OpenAIUnited States | Generating cards, papers and lectures; marking written answers; the spoken examiner; the search index over your notes; the safety check | Only the parts of your content a single request needs: text, an image you asked it to read, or your spoken answers to the examiner. We attach no name, email or account id. | Up to 30 days. OpenAI may keep API inputs and outputs that long for abuse monitoring, and it stores a long generation that runs in the background so that we can collect the result. Not used for training. |
| AnthropicUnited States | The same study tasks, for the features currently pointed at Claude models | Only the parts of your content a single request needs. We attach no name, email or account id. | Anthropic may keep API inputs and outputs for a limited period under its API terms. Not used for training. |
| GroqUnited States | Turning recorded speech into text, and the fast text tools: explaining a highlight, the section toolbar's complete, lengthen, shorten and format, translating a selection, and suggesting additions to a subject's index | The audio being transcribed (sometimes fetched from our storage through a link that expires after 15 minutes) and, for a recording dropped onto a board, that board's title and headings to help spelling; the passage or section text a single request needs; or, for index suggestions, the subject's name, its index and board titles, what you said it is for and any guidance you typed. We attach no name, email or account id. | Groq may keep API inputs and outputs for a limited period under its API terms. Not used for training. |
| xAIUnited States | Turning text into speech: narrating lectures and reading out the feedback on a recorded oral answer | The text being read aloud — a lecture script, or the feedback on your answer — which our models wrote from your notes and answers. We attach no name, email or account id. | Up to 30 days. xAI may keep API inputs and outputs that long for abuse monitoring. Not used for training. |
| SerpApiUnited States | The picture search on a board: it runs your search on Google Images, with SafeSearch always on | The words you search for and the board's language, sent from our servers. We attach no name, email or account id. The previews in the results load straight from Google's image servers, so Google sees your IP address for them; a picture you choose is downloaded by our servers, not your browser. | Each search for 31 days, then deleted automatically. |
| StripeUnited States and local entities | Taking payment and running subscriptions | Your card details, directly from your browser. Your email and plan. | As their own terms and financial record-keeping law require. |
| Amazon Web ServicesUnited States | Sending you transactional email — verification, receipts, share invitations | Your email address and the message. | Delivery logs only, on their standard schedule. |
| Apple and GoogleApp Store · Play · United States | Distributing the mobile apps and reporting crashes and installs | Install and crash statistics under their own policies. Not your study content. | Per their published policies. |
Where this runs. MySummaries is an Australian company and the service is operated from Melbourne, but the servers and storage are in the United States. If you are in the EEA, the UK or Switzerland your data is therefore transferred outside your region, and we rely on the EU–US Data Privacy Framework where a provider is certified under it and Standard Contractual Clauses where it is not. You can ask us for a copy of those safeguards.
Retention
How long anything stays
Two jobs run every night, Melbourne time: scheduled account deletions at 3:15am and the retention sweep at 4:15am. Between them they enforce every window below. These are not intentions — they are the numbers in the code that does the deleting.
Oral attempt audio. The audio kept with an oral attempt — your recorded answer and the spoken feedback on it — is destroyed 90 days after the attempt. The attempt itself stays, with its transcript, marks and written feedback.
Smaller things on the same sweep. Board restore points, notifications, queued emails and contact-form messages go after 30 days; a share invitation to an address that never signed up goes after 90; a sign-up that never verified its email address goes after 7.
Your study record. Each answer you give — a lesson question, a card, an exam question, a point in an oral — leaves a short record: which item, the marks, the points missed, how long it took. Never the answer itself. It stays as long as the account, even after the board it came from is deleted, because it is the history of what you learned, and it goes with the account.
Leaving
What deleting your account actually does
You do it yourself, from Account. There is no email to send and nobody to persuade. You will be asked to type the words in full, because this is not a button anyone should press by accident.
What stays, exactly. The billing ledger — what was charged, refunded or granted, against an account id — and, if you were an affiliate or were referred by one, the commission and payout records. They are financial records, kept for as long as tax and accounting law require, generally up to seven years. Stripe keeps your invoices for the same reason; your customer record and saved card there are deleted. A one-way, salted hash of the email address you signed up with, together with the count of free-plan items that address has used, so that deleting an account and signing up again does not hand out a second free allowance; it cannot be turned back into an address. And the nightly database backups, which hold a copy of what was deleted until they expire 30 days later.
Before you go, take your work. Deletion is irreversible after the seventh day, so export first — the file contains everything, in a format you can read without us.
Controls
What protects the account
-
In place
Encryption everywhere. TLS in transit, encrypted at rest by default across the database and file storage.
-
In place
Per-account access rules at the data layer. Enforced by the database and storage engines themselves, not by the app asking politely. An account cannot read another account's documents even with a modified client.
-
In place
A written permissions table, tested. Who may read and write what is documented, and two automated test suites fail the build if the rules stop matching the table.
-
In place
Rate and size limits on every AI action. Per account, per feature. A test fails the build if a new endpoint ships without one.
-
In place
Provider keys held server-side only. In a managed secret store, injected at runtime. No key is present in any app bundle or web page.
-
In place
Browser security headers, enforced. Strict transport security, a content security policy that is enforced rather than merely reported, framing denied, and a test that fails if a site loses them.
-
In place
Download links that expire. Data exports are served by short-lived signed URLs that die on their own, never by permanent tokens that keep working forever once shared.
-
In place
Breach-checked passwords and verified email. A minimum password policy, a check against known breach lists, and email verification before an account can spend anything.
-
In place
Content sanitised where it is stored. Anything that can be written into a shared board is cleaned against a strict allowlist, so a shared board cannot carry a script into a collaborator's browser.
-
In place
Tests as a release gate. Unit, rules, end-to-end and payment tests all run before anything reaches production.
-
Not yet on
App attestation. The machinery is built and registered on all three platforms, but enforcement is off until we can see that every installed app version is sending a valid token — turning it on early would lock out people running older builds.
Honest gaps
What we have not done
Any security page can list what a company does well. This is the other half, and it is the half worth reading. If one of these matters to you, ask — and if it matters enough to enough people, it moves up the list.
-
No SOC 2 report
We have not been through a SOC 2 audit. Nothing on this page has been checked by an independent auditor; it is our own description of our own system, which is exactly as much as it is worth.
-
No third-party penetration test
The platform has been through an internal security review and the fixes from it shipped, but no outside firm has tried to break in.
-
No data residency choice
Everything runs in the United States, including for Australian and European users. There is no option to keep your data in your own region, and adding one would mean moving the whole platform.
-
No two-factor authentication yet
You can sign in with Google and inherit whatever protection you have on that account, which is currently the strongest option available here. Native two-factor for email sign-in is not built.
-
Staff can reach production data
We are a small team and administrative access exists — it is how support requests and bug reports get investigated. It is limited to what the job needs and it is not anonymous, but we are not going to pretend nobody can look.
Reaching us
Found something, or want something checked
Reporting a vulnerability
Tell us privately first and give us a reasonable window to fix it. We will confirm we received it, keep you updated, and credit you if you want the credit. We will not threaten you for reporting in good faith.
[email protected]Privacy requests
Access, correction, deletion or a copy of the transfer safeguards. Export and deletion you can do yourself from Account, immediately; anything else comes through here.
[email protected]Something on this page looks wrong
If a claim here does not match what you observe, that is a bug and we want to know. Publishing this only means something if it can be contradicted.
[email protected]