Privacy & your data

Information you provide to us:

Information collected automatically:

Information from other sources:

We may receive information about you from service providers that help us operate the Service (for example, payment confirmation from Paystack), from a parent, guardian, or teacher who manages your account, and from other users who invite you to a group or classroom.

We ask that you not upload sensitive personal information (such as government ID numbers, health records, or information about race, religion, or political opinions) into the Service. We do not need it to provide the Service.

We use your information for further purposes only where compatible with the original purpose, or where we have asked for your consent. We do not engage in automated decision-making or profiling that produces legal or similarly significant effects on you, and we do not use your information for advertising.

We do not sell your personal information. To run the Service we rely on a small set of third-party providers. Each processes only the data needed for its function, under its own data-processing terms:

• NVIDIA: hosts the AI models that generate your study materials. Your prompt and source text are sent for inference.
• OpenRouter: routes some AI requests to third-party model providers on our behalf.
• Oracle Cloud Infrastructure: runs additional backend capacity we operate — forwarding some AI-generation requests (flashcards, quizzes, chat, planning) and running scheduled background jobs (retention reminders, daily practice sets). Data passing through it is the same prompt/source text sent to NVIDIA/OpenRouter for generation, or the account data needed to run a scheduled job.
• Supabase: our database and file-storage provider, where your account and uploads are stored (encrypted at rest).
• PostHog: optional product analytics and, for consenting testers, masked session recordings used to understand navigation, clicks and errors. Records can be linked to a pseudonymous account identifier. We mask inputs and study content and do not capture console logs. Recordings are retained for 30 days; you can withdraw permission in Settings → Privacy.
• Sentry: application error monitoring and sampled performance diagnostics. Request bodies, headers, cookies, and user profiles are removed from diagnostic events before sending; session replay is not enabled.
• Paystack: handles payments. Card details go directly to Paystack, which uses them under its own privacy policy; we never receive or store your card number.
• Resend and Amazon SES: deliver our transactional emails (sign-up confirmation, password reset, notifications). Your name and email address pass through whichever of the two sends a given message.
• Cloudflare: operates the network our site runs behind (DNS, content delivery, and basic traffic security). It can see connection metadata for requests passing through it. We don't use it for advertising or visitor profiling.

We may also share personal information with:

• People you choose. Parents, guardians, and teachers who manage a child's account or classroom, and members of groups you join, can see the activity and content relevant to that group or account. Other users can see your username, avatar, and what you choose to share in groups or classrooms, and we are not responsible for how they use it.
• Professional advisors. Lawyers, auditors, and insurers, in the course of the services they provide to us.
• Authorities and others. Law enforcement, regulators, and private parties where we believe in good faith that disclosure is necessary to comply with law or for the compliance and protection purposes in Section 3.
• Business transferees. A prospective or actual acquirer, investor, or successor, in connection with a merger, financing, sale of assets, or similar transaction, or in an insolvency. We would limit what is shared and tell you if your information became subject to a different privacy policy.

Your study materials are sent to NVIDIA and/or OpenRouter only to generate the output you asked for. We do not control those providers' model-training policies, so review their terms if that matters to you.

We use a small amount of browser storage, split into two categories. For the full list, see our Cookie Policy.

We don't use advertising or cross-site tracking cookies, so there is no interest-based advertising to opt out of. Some browsers send a "Do Not Track" signal; because there is no common standard for it, we do not respond to it separately, but we also do not track you across other sites.

Our emails may contain a standard delivery indicator that lets our email providers tell us whether a message was delivered. You can prevent images from loading in your email client's settings.

We keep personal information for as long as needed for the purposes in this policy, including to provide the Service while your account is active and to meet legal, accounting, or reporting requirements, resolve disputes, enforce our terms, and prevent fraud. To decide how long that is, we consider the amount, nature, and sensitivity of the information, the risk of harm from unauthorised use or disclosure, why we process it, whether we can achieve the same purpose another way, and applicable law.

When you delete your account from Settings, we delete or anonymise your personal information. Where that is not immediately possible (for example, because it sits in a backup), we securely store it and isolate it from further use until it can be deleted. Information we keep because the law requires it, such as payment records, is held only for as long as that requirement applies.

We use technical, organisational, and physical safeguards designed to protect the personal information we collect, with a layered approach:

• In transit: all traffic between your device and our servers is encrypted over HTTPS/TLS.
• At rest: your data is stored on Supabase infrastructure, which encrypts data at rest (AES-256).
• Access control: access to stored data is limited to the systems and authorised personnel needed to operate and support the service. We use role-based controls and keep credentials scoped, but we want to be honest: our operations and support staff can, where necessary for support, security, or legal reasons, access account data. We do not browse it casually.

No system is perfectly secure, and security risk is inherent in all internet technologies, so we cannot guarantee the security of your information. If a breach affects you, we will notify you and the relevant authorities as the law requires.

Novari is operated from Ghana, and the providers in Section 4 process data in other countries, including the United States and the European Union. Your personal information may therefore be transferred to, and processed in, countries whose privacy laws differ from, and may be less protective than, those where you live.

Where the law requires, we rely on a recognised transfer mechanism, such as an adequacy decision, standard contractual clauses approved by the relevant authority, or, in limited cases, your explicit consent. You can contact us for more information about the mechanism used for a particular transfer.

You stay in control of your data.

• Access & export: request a copy of your account data in an open format (JSON) from Settings.
• Deletion: permanently delete your account and its associated data from Settings.
• Correction: update your profile and account details at any time.
• Analytics choice: allow or decline optional analytics via the cookie banner and Settings → Privacy & Data, and change it whenever you like.
• Withdraw consent: where we rely on your consent, you can withdraw it at any time without affecting processing already done.
• Declining to provide information: we need some information (such as an email address) to provide the Service. If you don't provide what we mark as required, we may not be able to offer parts of it.

Depending on where you live, you may have additional rights, including to be informed about our processing, to restrict or object to it, to receive your data in a portable format, to not be subject to solely automated decisions with significant effects, and to complain to a regulator. You can exercise any of these rights by emailing us at the address below. We may ask for information to verify your identity, and an authorised agent may submit a request for you if we can confirm their authority. If we refuse a request, we will explain why, subject to legal restrictions, and you may appeal our decision by replying to us.

Novari's standard accounts are intended for users aged 13 and older who also meet any higher minimum age in their jurisdiction. We ask for birth month and year during signup, including when registering with a third-party sign-in provider. Children under 13 cannot complete independent registration; they must ask a parent or guardian to handle setup and the applicable consent requirements. Kids Mode is designed to be used under the guidance of a parent, guardian, or teacher, who confirms their consent before it activates. We do not knowingly collect personal information from children under 13 without appropriate consent; if we learn we have, we will delete it.

Parents and guardians can ask us to review, correct, export, or delete their child's information at any time, and may withdraw consent, by emailing us at the address below. If you believe a child has given us personal information without the required consent, please contact us.

The Service may link to websites and apps run by others, and some content may be embedded in pages we don't control. These links are not an endorsement, we are not responsible for third parties' practices, and we encourage you to read their privacy policies.

As the product evolves, this policy will too. We'll note material changes here with a new effective date, and where appropriate, notify you by email or in the app. Changes take effect when posted unless we say otherwise, and where the law requires your consent to a change, we will ask for it.

Questions about this policy, or requests to exercise any privacy right described above, can be sent to our team by email. Please include enough detail for us to understand and verify your request. privacy@novaristudy.site.