Privacy Policy

1. Introduction

This Privacy Policy explains how ZykoStudy (“ZykoStudy,” “we,” “us,” or “our”) collects, uses, shares, and protects information when you use the ZykoStudy website, games, and related features (the “Service”). It applies to students, teachers, parents/guardians, and other visitors.

By using the Service, you acknowledge the practices described here. This Policy is part of, and should be read together with, our Terms of Service. If you do not agree with this Policy, please do not use the Service.

2. Who We Are

ZykoStudy is a game-based learning platform for students and teachers. ZykoStudy is the controller responsible for the personal information described in this Policy. When the Service is used by a school or district, we generally act as a service provider / processor on behalf of that school with respect to student data, as described in the “Student Data & Schools” section below.

You can reach us at support@zykostudy.com or through our support page for any privacy question or request.

3. Information We Collect

Information you provide

• Account information: your email address, password (for email/password accounts), first and last name, display name, role (student or teacher), and school or institutional affiliation.
• Age information: when you create a student account, we ask for your date of birth to confirm you are old enough to register. We use it at sign-up to check eligibility and then discard it — we do not keep your date of birth in your account. (During sign-up, the birth year you enter is held briefly in your browser’s session storage; see “Cookies & Local Storage.”)
• Profile information: an optional profile photo and preferences.
• Content you create or upload: question sets, documents and images you upload to generate questions (such as PDFs, slides, or photos), free-response answers and other submissions, links to videos you import, class information, and messages you send in class chat or direct messages.
• Waitlist and mailing-list information: if you sign up for launch updates or our mailing list before creating an account, we collect your email address for that purpose.
• Communications: messages you send to us for support or other requests.

Information from sign-in providers

If you sign in with Google, we receive basic profile information from your Google account, such as your name and email address, to create and authenticate your account. We do not receive your Google password.

Information collected automatically

• Usage and learning data: games and assignments played, scores, XP and virtual rewards, questions seen and answered, correctness and response times, adaptive-difficulty progress, streaks, and session history.
• Device and log data: your IP address, browser type and user-agent, and timestamps. We log security-relevant events (such as sign-in attempts and suspicious requests) to protect accounts and the Service, and we keep short-lived rate-limiting records that can include your IP address.
• AI usage metering: counts of AI requests and tokens associated with your account (or, for signed-out use, a key derived from a one-way hash of your IP address) to enforce usage limits and manage costs.
• Cookies and local storage: small data files used to keep you signed in and remember preferences (see “Cookies & Local Storage”).

We do not use third-party advertising or analytics trackers, and we do not build advertising profiles.

4. How We Use Information

We use the information we collect to:

• Provide, operate, and maintain the Service and your account;
• Authenticate you and keep the Service secure — including rate-limiting sign-ins, locking accounts after repeated failed attempts, and logging security events to detect and prevent fraud, abuse, and unauthorized access;
• Confirm you are old enough to register;
• Personalize learning, adapt question difficulty, track progress, and power leaderboards;
• Generate reports and class insights for teachers about their students’ activity and performance;
• Power AI features you request, such as the tutor, question generation, grading assistance, study summaries, and diagrams (see “AI Features”);
• Send service-related communications, such as email verification, password resets, email-change confirmations, and teacher-verification emails;
• Send optional summary and promotional emails — such as a weekly progress digest that uses your recent activity (streaks, XP, badges, and recommended study sets) and launch or feature announcements. Every such email includes an unsubscribe link, and you can opt out at any time without affecting your account;
• Moderate content and enforce our Terms and community standards; and
• Maintain, improve, and develop the Service, and comply with legal obligations.

We do not sell your personal information, and we do not use student personal information to serve targeted advertising.

5. AI Features & Third-Party AI Processing

Certain features use artificial intelligence. To provide them, the content needed for the feature is sent to third-party providers that process it on our behalf and return a result. Examples include:

• AI tutor and explanations — the question, answer choices, and your selected answer are processed to generate an explanation. If you ask follow-up questions, the text you type and the prior tutor exchange are also processed;
• Question generation — text, documents, and images you or a teacher upload are processed to create practice questions (images may be processed to extract their text);
• Free-response grading assistance — the question, grading criteria, and the answer text a student submits are processed to generate feedback or a suggested grade for teacher review;
• Study summaries, practice packs, and diagrams — session performance data (such as topics you missed) and question text are processed to generate summaries, recommended practice, and educational diagrams;
• Video transcripts — when you import a video (for example, a YouTube link), the video’s address is sent to a transcript provider that retrieves its captions or, where captions are unavailable, generates a transcript from the audio; basic video details (title and channel) are also retrieved;
• Content moderation — question sets that other users report may be automatically reviewed by AI for unsafe content, which can result in the set being hidden or removed and in account-level enforcement.

Our AI processing providers are currently Anthropic (Claude models), which powers tutoring, question generation, grading assistance, summaries, diagrams, image text-extraction, and moderation review, and Supadata, which retrieves or generates video transcripts. These providers act as our service providers and process content only to deliver the requested feature. Anthropic’s commercial API terms provide that content submitted through the API is not used to train its models. Please do not include personal information about yourself or others in text, files, or images you submit to AI features. AI outputs may be inaccurate and should be reviewed before you rely on them.

6. How We Share Information

We do not sell or rent your personal information. We share information only as described here:

• With teachers and classes: if you are a student, your teacher can see your activity, progress, and submissions within their class and can correct your name on the class roster. Class chat messages are visible to your teacher and other class members. Direct messages are visible only to the participants in the conversation. If a teacher transfers a class to another verified teacher, the new teacher gains access to that class’s roster, messages, progress, and submissions.
• With other users: your display name and XP may appear on leaderboards, including a site-wide leaderboard visible to other users. If you publish a question set to the public library, its content, your author credit (display name), and its rating statistics are visible to everyone.
• With service providers: vendors who help us run the Service — hosting, serverless infrastructure, and file storage (Vercel), our database provider (Neon), email delivery (Resend and, as a fallback, an SMTP email server), AI processing and video transcripts (Anthropic and Supadata, as described above), and sign-in (Google). They may access information only to perform services for us and are bound by confidentiality and data-protection obligations.
• For legal and safety reasons: to comply with law or valid legal process, to enforce our Terms, or to protect the rights, safety, and security of users, the public, or ZykoStudy.
• In a business transfer: in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.
• With your direction or consent: when you ask us to share information or otherwise consent.

7. Cookies & Local Storage

We use a small number of cookies and browser storage technologies that are necessary to operate the Service:

• Authentication cookies keep you signed in (for example, a secure, HTTP-only session cookie) and protect against cross-site request forgery.
• A site-access cookie may be used while the Service is in limited/early-access release, and we may use other strictly necessary operational cookies (for example, for site maintenance).
• Browser local storage keeps you signed in smoothly by caching your email address and basic profile (name and avatar), and holds preferences (such as your selected subject, sound settings, and tutorial progress), XP totals, and recent quiz-session history. Your password itself is never stored in local storage.
• Browser session storage (cleared when the tab closes) briefly holds the birth year you enter during sign-up age screening and your in-progress answers during an assignment.

We do not use third-party advertising cookies or cross-site tracking pixels, and because we do not track you across other websites, we do not respond to browser “Do Not Track” signals; Global Privacy Control signals do not require action from us because we do not sell or share personal information. You can clear cookies and local storage through your browser settings, but doing so will sign you out and may affect how the Service works.

8. Children’s Privacy (COPPA)

Protecting children’s privacy is important to us. The Service is intended for users aged 13 and older, and we do not knowingly collect personal information from children under 13. We ask for date of birth at student registration and do not allow anyone under 13 to create an account. We use the date of birth only to check eligibility and do not retain it.

If we later offer accounts for children under 13, we will do so only with verifiable parental consent or school authorization consistent with the Children’s Online Privacy Protection Act (COPPA), and we will update this Policy first. We do not condition participation on disclosing more information than is necessary, we do not use students’ personal information for targeted advertising, and we do not sell it.

Parents and guardians: if you believe a child under 13 has created an account or that we have collected personal information from a child under 13, contact us at support@zykostudy.com and we will delete the account and its personal information promptly. Parents and guardians of minor users may also review, correct, or request deletion of their child’s information as described in “Your Rights & Choices.”

9. Student Data & Schools (FERPA)

When the Service is used by a school, district, or teacher, we treat student personal information as education records handled on the school’s behalf and consistent with the Family Educational Rights and Privacy Act (FERPA). Where applicable, and where we and the school have entered into a data protection or privacy agreement, we act under the “school official” exception, performing a service the school would otherwise perform and using student data only under the school’s direction and for authorized educational purposes.

• We use student data only to provide and improve the educational Service — not for advertising and not to build advertising profiles.
• The school or teacher controls the student data within their classes and may request access to, correction of, or deletion of that data.
• We maintain reasonable safeguards for student data and limit access to those who need it to provide the Service.
• We will notify affected schools without unreasonable delay if we learn of a breach of security affecting their students’ data, as required by applicable law.

Schools and parents may contact us at support@zykostudy.com with questions or requests regarding student data.

10. Messaging & Class Chat

Where a teacher enables class chat, messages are visible to the teacher and all members of the class. Direct messages are available between members of the same class — including between students — and are visible only to the participants in the conversation; teachers cannot read direct messages between students. Teachers can turn class chat on or off and choose whether students may message them directly.

Messages pass through an automated profanity filter, and violations can lead to automatic warnings and escalating temporary suspensions of messaging privileges (contact support to contest a suspension). Automated filtering is limited and will not detect all inappropriate content, and direct messages are not proactively monitored — do not share sensitive personal information through messaging, and report concerns to support@zykostudy.com.

Message history is limited: only a recent window of messages is retained per class chat and per direct-message conversation, and older messages are automatically deleted. You can delete a direct message you sent within a short period after sending it. Messages you sent are also removed when your account is deleted.

11. Data Security

We use reasonable administrative, technical, and organizational measures designed to protect personal information, including encrypted connections (HTTPS/TLS), hashing of account passwords, secure HTTP-only session cookies, rate limiting and account-lockout protections, access controls, and security logging. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. If we learn of a breach of security affecting your personal information, we will notify you and any affected schools as required by applicable law. Please use a strong, unique password and contact us immediately if you suspect unauthorized access to your account.

12. Data Retention & Deletion

We retain personal information for as long as your account is active or as needed to provide the Service. You can delete your account at any time from your profile settings, or by contacting us. When you delete your account, we delete or de-identify your associated personal information — including your profile, learning progress and game history, question sets (including published ones), submissions, and messages you sent — except that:

• We retain limited security and audit records (such as logs of sign-in attempts, which include IP addresses) for a reasonable period to protect against fraud and abuse and to meet legal obligations;
• Residual copies of uploaded source files may persist in our file-storage systems and backups for a limited period until they are purged — you can ask us to remove specific files sooner;
• Short-lived operational records (such as rate-limiting entries that can include IP addresses) expire and are overwritten in the ordinary course; and
• We may retain information where required by law or for legitimate, limited business purposes.

We may also keep aggregated or de-identified data that can no longer reasonably identify you, and we commit not to attempt to re-identify de-identified data.

13. Your Rights & Choices

Depending on where you live, you may have rights to access, correct, update, delete, or obtain a copy of your personal information, and to object to or restrict certain processing.

• Access and update: you can view and edit much of your information in your profile settings.
• Delete: you can delete your account and associated data from your profile settings, or by contacting us.
• Copy/portability: you can request a copy of your personal information by emailing support@zykostudy.com.
• Email choices: promotional and digest emails include an unsubscribe link; account and security emails (such as password resets) are sent as needed to operate the Service.
• Parents, guardians, and schools may exercise these rights on behalf of students as described above.

To make a request, contact support@zykostudy.com. We will verify your request as appropriate and respond as required by law. We will not discriminate against you for exercising your privacy rights.

14. U.S. State Privacy Rights

Residents of California and certain other U.S. states have additional rights regarding their personal information, including the rights to know/access, delete, and correct personal information, and to opt out of the “sale” or “sharing” of personal information and of certain targeted advertising.

We do not sell personal information, we do not “share” it for cross-context behavioral advertising (and have not done either in the preceding 12 months), and we do not use sensitive personal information (such as account credentials) for any purpose other than providing and securing the Service. The categories of personal information we collect and disclose for business purposes are described in “Information We Collect” and “How We Share Information.” To exercise your state privacy rights, contact us at support@zykostudy.com; you may use an authorized agent where permitted by law. If we decline a request, you may appeal by replying to our response, and we will explain the outcome of the appeal; California residents may also contact the California Privacy Protection Agency.

15. International Users

The Service is operated from, and information is processed and stored in, the United States, which may have data-protection laws different from those in your country. If you access the Service from outside the United States, you understand that your information will be transferred to and processed in the United States and other locations where our service providers operate. Where required, we rely on appropriate safeguards and lawful bases (such as performance of our contract with you, your consent, our legitimate interests, and legal obligations) for processing. If you are in the European Economic Area, the United Kingdom, or a similar jurisdiction, you may also have the right to lodge a complaint with your local data-protection supervisory authority, and you must meet your country’s minimum age of digital consent to use the Service on your own.

16. Third-Party Links & Embeds

The Service may contain links to or embed content from third-party sites and services (for example, embedded YouTube videos, which we load in YouTube’s privacy-enhanced mode; YouTube may still receive technical information such as your IP address when a video loads). We are not responsible for the privacy practices or content of those third parties. We encourage you to review their privacy policies.

17. Changes to This Policy

We may update this Privacy Policy as the Service evolves or as required by law. If we make material changes, we will take reasonable steps to notify you, such as posting a notice on the Service, updating the “Effective Date” above, or sending an email. Where required for previously collected children’s information, we will obtain any newly required parental or school consent. Your continued use of the Service after changes take effect means you accept the updated Policy.

18. Contact Us

For privacy questions, data requests, or concerns — including requests by parents, guardians, or schools — contact us through our support page or by email at support@zykostudy.com. We aim to respond to privacy inquiries within a reasonable time, generally within 5 business days.