Privacy Policy

1. Introduction

This Privacy Policy explains how ZykoStudy (“ZykoStudy,” “we,” “us,” or “our”) collects, uses, shares, and protects information when you use the ZykoStudy website, games, and related features (the “Service”). It applies to students, teachers, parents/guardians, and other visitors.

By using the Service, you acknowledge the practices described here. This Policy is part of, and should be read together with, our Terms of Service. If you do not agree with this Policy, please do not use the Service.

2. Who We Are

ZykoStudy is a game-based learning platform for students and teachers. ZykoStudy is the controller responsible for the personal information described in this Policy. When the Service is used by a school or district, we generally act as a service provider / processor on behalf of that school with respect to student data, as described in the “Student Data & Schools (FERPA)” section below.

You can reach us at support@zykostudy.com or through our support page for any privacy question or request.

3. Information We Collect

Information you provide

• Account information: your email address, password (for email/password accounts), first and last name, display name, role (student or teacher), and school or institutional affiliation.
• Age information: when you create a student account, we ask for your date of birth to confirm you are old enough to register. We use it at sign-up to check eligibility and then discard it: we do not keep your date of birth in your account; we record only that screening happened and whether it was a date-of-birth check or an 18+ confirmation. (During sign-up, the date of birth you enter is held briefly in your browser’s session storage; see “Cookies & Local Storage.”)
• Profile information: an optional profile photo and preferences.
• Content you create or upload: question sets, documents and images you upload to generate questions (such as PDFs, slides, or photos), free-response answers and other submissions, links to videos you import, class information, and messages you send in class chat or direct messages.
• Billing information: if you buy a paid plan, our payment processor Stripe collects your card or other payment details directly. We never receive or store your full card number. We keep a subscription record consisting of the email address on your account, Stripe’s customer and subscription identifiers, the plan you bought, your subscription status, whether it is set to cancel, and the date the current billing period ends.
• Waitlist and mailing-list information: if you sign up for launch updates or our mailing list before creating an account, we collect your email address for that purpose.
• Feedback and reviews: if you use an in-product feedback prompt (such as rating a game or answering a short survey), we collect the rating, your answers, and any comment you write, associated with your account.
• Communications: messages you send to us for support or other requests.

Information from sign-in providers

If you sign in with Google, we receive basic profile information from your Google account, such as your name and email address, to create and authenticate your account. We do not receive your Google password.

Information collected automatically

• Usage and learning data: games and assignments played, scores, XP and virtual rewards, questions seen and answered, correctness and response times, adaptive-difficulty progress, streaks, and session history.
• Device and log data: your IP address, browser type and user-agent, and timestamps. We log security-relevant events (such as sign-in attempts and suspicious requests) to protect accounts and the Service, and we keep short-lived rate-limiting records that can include your IP address.
• AI usage metering: counts of AI requests, tokens, and document source pages processed, associated with your account (or, for signed-out use, a key derived from a one-way hash of your IP address) to enforce usage limits and manage costs.
• Cookies and local storage: small data files used to keep you signed in and remember preferences (see “Cookies & Local Storage”).

We do not use third-party advertising or analytics trackers, and we do not build advertising profiles.

4. How We Use Information

We use the information we collect to:

• Provide, operate, and maintain the Service and your account;
• Authenticate you and keep the Service secure, including rate-limiting sign-ins, locking accounts after repeated failed attempts, and logging security events to detect and prevent fraud, abuse, and unauthorized access;
• Confirm you are old enough to register;
• Personalize learning, adapt question difficulty, track progress, and power leaderboards;
• Generate reports and class insights for teachers about their students’ activity and performance;
• Power AI features you request, such as the tutor, question generation, grading assistance, study summaries, and diagrams (see “AI Features & Third-Party AI Processing”);
• Take payment for a paid plan, keep your subscription and plan entitlements in sync, and apply the usage allowances that come with your plan;
• Send service-related communications, such as email verification, password resets, email-change confirmations, and teacher-verification emails;
• Send optional summary and promotional emails to teacher accounts and mailing-list subscribers only, such as a weekly class-progress digest and launch or feature announcements. Student accounts do not receive promotional or digest emails; students receive only the account and security emails needed to operate the Service (such as verification and password-reset emails). Every promotional email includes an unsubscribe link, and you can opt out at any time without affecting your account;
• Moderate content and enforce our Terms and community standards; and
• Maintain, improve, and develop the Service, and comply with legal obligations.

We do not sell your personal information, and we do not use student personal information to serve targeted advertising.

5. AI Features & Third-Party AI Processing

Certain features use artificial intelligence. To provide them, the content needed for the feature is sent to third-party providers that process it on our behalf and return a result. Examples include:

• AI tutor and explanations: the question, answer choices, and your selected answer are processed to generate an explanation. If you ask follow-up questions, the text you type and the prior tutor exchange are also processed;
• Question generation: text, documents, and images you or a teacher upload are processed to create practice questions (images may be processed to extract their text);
• Free-response grading: the question, grading criteria, and the answer text a student submits are processed to generate feedback and a grade. The AI grade is applied and shown to the student automatically when they submit; teachers can review and change AI-graded results for their class afterward;
• Study summaries, practice packs, and diagrams: session performance data (such as topics you missed) and question text are processed to generate summaries, recommended practice, and educational diagrams;
• Video transcripts: when you import a video (for example, a YouTube link), the video’s address is sent to a transcript provider that retrieves its captions or, where captions are unavailable, generates a transcript from the audio; basic video details (title and channel) are also retrieved;
• Content moderation: question sets that other users report may be automatically reviewed by AI for unsafe content, which can result in the set being hidden or removed and in account-level enforcement.

Our AI processing providers are currently Anthropic (Claude models), which powers tutoring, question generation, grading, summaries, diagrams, image text-extraction, extraction of standards from documents teachers upload (for aligning questions to curriculum standards), and moderation review, and Supadata, which retrieves or generates video transcripts. These providers act as our service providers and process content only to deliver the requested feature. As of the Effective Date of this Policy, Anthropic’s commercial API terms provide that content submitted through the API is not used to train its models. We recommend avoiding unnecessary personal information in the text, files, and images you submit to AI features; note that content required by a feature (such as a free-response answer you submit for grading) is processed as described above. AI outputs may be inaccurate and should be reviewed before you rely on them.

For supervised accounts (children under 13), AI features that would send the child’s typed content to an AI provider are off by default and require a separate parental consent — see “Children’s Privacy (COPPA).” Game question generation for a supervised account sends only the selected subject and unit to the provider, never content the child typed.

6. How We Share Information

We do not sell or rent your personal information. We share information only as described here:

• With teachers and classes: if you are a student, your teacher can see your activity, progress, and submissions within their class and can correct your name (this updates the name on your account, which is also what other classes and your profile show). Classmates in the same class can see your display name and your XP standing within the class. Class chat messages are visible to your teacher and other class members. Direct messages are visible only to the participants in the conversation. If a teacher transfers a class to another verified teacher at the same school, the new teacher gains access to that class’s roster, messages, progress, and submissions.
• With other users: your display name and XP may appear on leaderboards, including a site-wide leaderboard visible to other users. If you publish a question set to the public library, its content, your author credit (display name), and its rating statistics are visible to everyone.
• In live races: if you host or join a live race, your display name, car, live position, answer counts, and finishing placement are visible to everyone else in that race for its duration — including participants who are not your classmates, since anyone signed in with the race code can join. Your email address is not shown to other participants. A record of the race (the deck, participants' display names, and results) is retained as game history and is deleted when your account is deleted.
• With service providers: vendors who help us run the Service, including hosting, serverless infrastructure, and file storage (Vercel), our database provider (Neon), email delivery (Resend and, as a fallback, an SMTP email server), AI processing and video transcripts (Anthropic and Supadata, as described above), and sign-in (Google). They may access information only to perform services for us and are bound by confidentiality and data-protection obligations.
• With our payment processor: if you buy a paid plan, we share your email address with Stripe so it can create your customer record, take payment, and run the billing portal where you update your payment method or cancel. Stripe handles your card details directly and processes them under its own privacy policy, including for payment and fraud-prevention purposes of its own. We do not receive your full card number.
• For legal and safety reasons: to comply with law or valid legal process, to enforce our Terms, or to protect the rights, safety, and security of users, the public, or ZykoStudy.
• In a business transfer: in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.
• With your direction or consent: when you ask us to share information or otherwise consent.

7. Cookies & Local Storage

We use a small number of cookies and browser storage technologies that are necessary to operate the Service:

• Authentication cookies keep you signed in (for example, a secure, HTTP-only session cookie) and protect against cross-site request forgery.
• A site-access cookie may be used while the Service is in limited/early-access release, and we may use other strictly necessary operational cookies (for example, for site maintenance).
• Browser local storage keeps you signed in smoothly by caching your email address and basic profile (name and avatar), and holds preferences (such as your selected subject, sound settings, and tutorial progress), XP totals, recent quiz-session history, and similar first-party data needed to save your game and study progress on this device (such as game-career saves, in-progress run checkpoints, guest difficulty and unlock records, and a record of your terms acceptance). Your password itself is never stored in local storage.
• Browser session storage (cleared when the tab closes) briefly holds the date of birth you enter during sign-up age screening and your in-progress answers during an assignment. A short-lived, signed age-screening cookie records that you passed the age check while you finish signing up.

We do not use third-party advertising cookies or cross-site tracking pixels, and because we do not track you across other websites, we do not respond to browser “Do Not Track” signals; Global Privacy Control signals do not require action from us because we do not sell or share personal information. You can clear cookies and local storage through your browser settings, but doing so will sign you out and may affect how the Service works.

8. Children’s Privacy (COPPA)

Protecting children’s privacy is important to us. Students must be 13 or older to create their own account: we ask for date of birth at student registration and do not allow anyone under 13 to self-register. We use the date of birth only to check eligibility and do not retain it.

Supervised accounts for children under 13

A parent or legal guardian (18 or older) can create a supervised account for their child under 13 from their own account (Profile → Family) after providing verifiable parental consent consistent with the Children’s Online Privacy Protection Act (COPPA). For a supervised account we collect only what the learning service needs: a display name (it does not have to be the child’s real name), sign-in credentials, class membership, and learning progress. During setup we also ask for the child’s date of birth to confirm which experience applies to the child’s age; as with registration, we use it only for that check and do not retain it. We use this information only to provide the learning service to the child. It is not disclosed to third parties (other than the service providers that host and operate the Service under contract with us), it is never used for targeted advertising, and it is never sold. Supervised accounts cannot use direct messages or class chat, cannot host or join live races, cannot submit in-product feedback, and do not appear on leaderboards.

The sign-in email address for a supervised account can be any address the parent controls or chooses (it does not have to be the child’s own inbox). When the account is created we send a one-time welcome note to that address; the consent confirmation and all account-management communications go to the parent’s email address, which remains the contact of record.

AI features for supervised accounts (parent-controlled)

AI features (such as the AI study tutor) are OFF by default for supervised accounts, because providing them sends the text the child types to our AI processing provider (see “AI Features & Third-Party AI Processing”). A parent or guardian can turn AI features on for their child from the Family dashboard by giving a separate, additional consent, and can turn them off again at any time, which immediately stops any further sharing. While AI features are off, free-response answers a supervised child submits for a class assignment are held for the teacher to grade instead of being AI-graded, and the child cannot use the AI tutor or other AI tools. Content sent to our AI provider is processed only to deliver the feature and, under the provider’s commercial terms as of the Effective Date, is not used to train its models.

How consent starts

If a child under 13 tries to sign up, no account is created. The child may enter a parent’s or guardian’s email address, which we use once to send that parent a notice explaining how to set up a supervised account (COPPA permits this collection solely for seeking consent). We do not keep the address: if the parent does nothing, no account exists and nothing about the child is retained. To prevent misuse of this form, our security logs keep the sender’s IP address and a one-way keyed code derived from the entered email address (the code cannot be turned back into the address) for up to 90 days.

Parents’ rights

Parents and guardians of supervised accounts can review and correct their child’s information, reset the child’s password, and withdraw consent at any time from the Family dashboard. Withdrawing consent deletes the child’s account and personal information as described in “Data Retention & Deletion” (we keep the record that consent was given and withdrawn, as the law requires). We do not condition a child’s participation in any activity on disclosing more information than is reasonably necessary to participate in that activity.

Parents and guardians: if you believe a child under 13 is using ZykoStudy outside a supervised account, or that we have collected personal information from a child under 13 without consent, contact us at support@zykostudy.com and we will delete the account and its personal information promptly.

9. Student Data & Schools (FERPA)

When the Service is used by a school, district, or teacher, we treat student personal information as education records handled on the school’s behalf and consistent with the Family Educational Rights and Privacy Act (FERPA). Where applicable, and where we and the school have entered into a data protection or privacy agreement, we act under the “school official” exception, performing a service the school would otherwise perform and using student data only under the school’s direction and for authorized educational purposes.

• We use student data only to provide and improve the educational Service, not for advertising and not to build advertising profiles.
• The school or teacher controls the student data within their classes and may request access to, correction of, or deletion of that data.
• We maintain reasonable safeguards for student data and limit access to those who need it to provide the Service.
• We will notify affected schools without unreasonable delay (and no later than any deadline applicable law imposes) if we learn of a breach of security affecting their students’ data. Unless a school designates a different contact in writing, we treat the verified teacher who manages a class as the school’s contact for these notices.

Schools and parents may contact us at support@zykostudy.com with questions or requests regarding student data.

10. Messaging & Class Chat

Where a teacher enables class chat, messages are visible to the teacher and all members of the class. Direct messages are available between members of the same class (including between students) and are visible only to the participants in the conversation; teachers cannot read direct messages between students. Teachers can turn class chat on or off and choose whether students may message them directly. Supervised accounts for children under 13 cannot use class chat or direct messages (see “Children’s Privacy”).

Messages pass through an automated profanity filter, and violations can lead to automatic warnings and escalating temporary suspensions of messaging privileges (contact support to contest a suspension). Automated filtering is limited and will not detect all inappropriate content, and direct messages are not proactively monitored, so do not share sensitive personal information through messaging. You can report a direct-message conversation from inside the conversation or by emailing support@zykostudy.com; when a conversation is reported, we preserve a copy of its recent messages for moderation review (even if messages are later deleted or expire) and act on what we find.

Message history is limited: only a recent window of messages is retained per class chat and per direct-message conversation, and older messages are automatically deleted. You can delete a direct message you sent within a short period after sending it, and you can ask us to remove a class chat message you sent by emailing support@zykostudy.com. Messages you sent are also removed when your account is deleted.

11. Data Security

We use reasonable administrative, technical, and organizational measures designed to protect personal information, including encrypted connections (HTTPS/TLS), hashing of account passwords, secure HTTP-only session cookies, rate limiting and account-lockout protections, access controls, and security logging. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. If we learn of a breach of security affecting your personal information, we will notify you and any affected schools as required by applicable law. Please use a strong, unique password and contact us immediately if you suspect unauthorized access to your account.

12. Data Retention & Deletion

We retain personal information for as long as your account is active or as needed to provide the Service. You can delete your account at any time from your profile settings, or by contacting us. When you delete your account, we delete or de-identify your associated personal information, including your profile, learning progress and game history, question sets (including published ones), submissions, and messages you sent, except that:

• We retain limited security and audit records (such as logs of sign-in attempts, which include IP addresses) for a reasonable period to protect against fraud and abuse and to meet legal obligations;
• Residual copies of uploaded source files may persist in our file-storage systems and backups for a limited period until they are purged (you can ask us to remove specific files sooner);
• Short-lived operational records (such as rate-limiting entries that can include IP addresses) expire and are overwritten in the ordinary course; and
• We may retain information where required by law or for legitimate, limited business purposes.

We may also keep aggregated or de-identified data that can no longer reasonably identify you, and we commit not to attempt to re-identify de-identified data.

Children’s personal information (supervised accounts): our retention policy

This section is our written data retention policy for personal information collected from children under 13 through supervised accounts. We never retain children’s personal information indefinitely; we retain each category only as long as reasonably necessary for the purpose it was collected for:

• Account, profile, and learning data (display name, sign-in credentials, class membership, learning progress): collected to provide the learning service; retained while the supervised account is active because the child’s learning history is needed to operate the account; deleted promptly (normally immediately, and in any event within 30 days) after the parent withdraws consent or deletes the account.
• Parental-consent and consent-withdrawal records: kept because federal law (COPPA) requires us to be able to demonstrate that consent was given; retained for the life of the supervised account and for 5 years after it closes, then deleted.
• The parent email address a child enters to request account setup: used once to send the consent notice and never stored; an irreversible keyed code derived from it, and the sender’s IP address, are kept in security logs for up to 90 days to prevent misuse of the request form.
• Security and audit logs relating to a supervised account (such as sign-in attempts, which include IP addresses): kept for 90 days to protect against fraud and abuse, then automatically deleted.

When a retention period ends, we delete the information using reasonable measures designed to protect it against unauthorized access or use in connection with its deletion.

13. Your Rights & Choices

Depending on where you live, you may have rights to access, correct, update, delete, or obtain a copy of your personal information, and to object to or restrict certain processing.

• Access and update: you can view and edit much of your information in your profile settings.
• Delete: you can delete your account and associated data from your profile settings, or by contacting us.
• Copy/portability: you can request a copy of your personal information by emailing support@zykostudy.com.
• Content removal (including for minors): any registered user (including users under 18, such as California minors exercising rights under Business & Professions Code §22581) can remove content they posted: unpublish or delete question sets from My Creations, delete a direct message you sent within a short period after sending, and email support@zykostudy.com to have anything else you posted (such as a class chat message) removed or anonymized. Removal may not be complete or comprehensive: limited backup copies may persist for a period, and content someone else copied or re-posted may remain.
• Email choices: promotional and digest emails include an unsubscribe link; account and security emails (such as password resets) are sent as needed to operate the Service.
• Parents, guardians, and schools may exercise these rights on behalf of students as described above.

To make a request, contact support@zykostudy.com. We will verify your request as appropriate and respond as required by law. We will not discriminate against you for exercising your privacy rights.

14. U.S. State Privacy Rights

Residents of California and certain other U.S. states have additional rights regarding their personal information, including the rights to know/access, delete, and correct personal information, and to opt out of the “sale” or “sharing” of personal information and of certain targeted advertising.

We do not sell personal information, we do not “share” it for cross-context behavioral advertising (and have not done either in the preceding 12 months), and we do not use sensitive personal information (such as account credentials) for any purpose other than providing and securing the Service. The categories of personal information we collect and disclose for business purposes are described in “Information We Collect” and “How We Share Information.” To exercise your state privacy rights, contact us at support@zykostudy.com; you may use an authorized agent where permitted by law. If we decline a request, you may appeal by replying to our response, and we will explain the outcome of the appeal; California residents may also contact the California Privacy Protection Agency.

15. International Users

The Service is operated from, and information is processed and stored in, the United States, which may have data-protection laws different from those in your country. If you access the Service from outside the United States, you understand that your information will be transferred to and processed in the United States and other locations where our service providers operate. Where required, we rely on appropriate safeguards and lawful bases (such as performance of our contract with you, your consent, our legitimate interests, and legal obligations) for processing. If you are in the European Economic Area, the United Kingdom, or a similar jurisdiction, you may also have the right to lodge a complaint with your local data-protection supervisory authority, and you must meet your country’s minimum age of digital consent to use the Service on your own.

16. Third-Party Links & Embeds

The Service may contain links to or embed content from third-party sites and services (for example, embedded YouTube videos, which we load in YouTube’s privacy-enhanced mode; YouTube may still receive technical information such as your IP address when a video loads). We are not responsible for the privacy practices or content of those third parties. We encourage you to review their privacy policies.

17. Changes to This Policy

We may update this Privacy Policy as the Service evolves or as required by law. If we make material changes, we will take reasonable steps to notify you, such as posting a notice on the Service, updating the “Effective Date” above, or sending an email. Where required for previously collected children’s information, we will obtain any newly required parental or school consent. Your continued use of the Service after changes take effect means you accept the updated Policy.

18. Contact Us

For privacy questions, data requests, or concerns, including requests by parents, guardians, or schools, contact us through our support page, by email at support@zykostudy.com, or by mail to ZykoStudy, 16255 Ventura Blvd., Suite 400, Encino, CA 91436. We aim to respond to privacy inquiries within a reasonable time, generally within 5 business days.