Privacy Policy

Who we are & scope

This Policy explains how Alpheri, LLC ("Alpheri," "we") handles personal information for users of alpheri.com (the "Service"). The Service is for US residents 18 or older. We do not knowingly collect data from anyone under 18.

This Policy does not cover third-party sites and services. The Service links to and embeds third-party content (for example, curriculum videos embedded from YouTube and lesson decks embedded from Google Slides) and lets you sign in with a third-party identity provider (Google). When you navigate to a third-party site, play embedded media, or authenticate through such a provider, that third party's own privacy policy governs its handling of your information — not this Policy. We do not control those third parties.

Information we collect

You provide:

• Account identifiers — email; display name; password (hashed by our auth provider) or Google sign-in identifier.
• Submitted practice content — your free-text FRQ answers (up to ~8,000 characters each) and multiple-choice selections. Free-text answers may contain whatever you type, including personal information; we ask you not to include sensitive personal information in answers.
• Preferences / onboarding inputs.

Generated by your use:

• Grades & feedback — numeric grades, per-criterion scores, and written reasoning/improvement feedback for your submissions.
• Learning analytics — derived skill mastery, weak/strong areas, streaks, progress rollups (inferences about your performance).
• Usage & billing records — subscription plan/status, Stripe customer identifier (we do not store full card numbers — Stripe does), monthly quota counters, internal cost/usage telemetry (latency, token counts).
• Technical/integrity signals — request-authenticity and bot-detection signals from Firebase App Check and Cloudflare Turnstile, and standard server log data.

We do not use advertising/tracking pixels and do not build advertising profiles.

Categories of personal information (California & comparable state-law disclosure). For purposes of the CCPA/CPRA and similar state privacy laws, the following maps the personal information we collect to the statutory categories, with its source, the purpose of collection, the categories of recipients, and retention.

Categories we do not collect: protected-classification characteristics (C); biometric information (E); audio, visual, or other sensory information (H) — we operate no voice or video features; professional or employment information (I); and education records subject to FERPA (J).

Disclosure, sale, and sharing. We disclose the categories above to service providers for the business purposes listed (see §6 for the provider list). We do not sell, and do not "share" for cross-context behavioral advertising, any category of personal information.

Sensitive personal information (SPI). The only SPI we collect is your account log-in credentials — your password, which our authentication provider stores in hashed form (we never see it in plaintext) — used solely to authenticate and secure your account. We do not use or disclose SPI to infer characteristics about you, and we do not sell or share it. Because a free-text answer can contain anything you type, we ask you not to submit other sensitive information (for example, government-ID, financial-account, or health information) in your answers; if you do, we process it only to grade and store your submission as described in §4 and §7. Because we use this sensitive personal information only for purposes that are exempt under CPRA §1798.121 (authenticating and securing your account) and never to infer characteristics about you, the "Limit the Use of My Sensitive Personal Information" right does not apply, and we therefore do not provide a "Limit" link.

Cookies & similar technologies. We use only strictly-necessary and performance/functionality cookies and equivalent browser storage — no advertising cookies. We do not use advertising/marketing cookies, pixels, or audience profiling, and we do not participate in third-party advertising networks. The categories we use:

Because we use only strictly-necessary, functionality, and privacy-protective performance cookies — and no advertising, cross-site tracking, or profiling cookies — we do not display a cookie-consent banner; you can control the functionality and performance cookies through your browser settings. If we later add any non-essential advertising or cross-site tracking technology, we will update this section and provide any consent mechanism the law then requires.

Do Not Track. Some browsers transmit a "Do Not Track" (DNT) or Global Privacy Control signal. Because we do not track you across third-party sites or serve targeted advertising, our practices do not change based on a DNT signal — we already do not engage in the cross-site tracking those signals are designed to limit. In particular, because we do not sell or "share" personal information (§6), there is no sale or sharing for a Global Privacy Control (GPC) signal to opt you out of, so honoring such a signal requires no change to our practices.

How we use information

To provide and secure the Service: authenticate you; grade your submissions (see §4); compute progress/analytics; process subscriptions and enforce quotas; detect and prevent abuse, fraud, and denial-of-wallet; comply with law; and communicate service messages. Marketing email (if any) is separate and includes unsubscribe. We process automated decisions as described in §5.

De-identified & aggregated data. We may de-identify or aggregate information so that it no longer reasonably identifies you, and may use and retain such data for any lawful purpose — for example, to measure aggregate grading quality and improve the curriculum. Where we hold information in de-identified form, we maintain technical safeguards and business processes that prohibit re-identification, we do not attempt to re-identify it, and we commit to keeping it in de-identified form. This does not change our position that we do not use your submitted answers to train or develop machine-learning models (see §4).

Third-party processing of your submitted answers ⚠ key disclosure

To grade a free-text answer, we transmit the answer text and the question to our third-party AI grading provider, DeepSeek (operated by Hangzhou DeepSeek Artificial Intelligence Co., Ltd.). This processing is core to the grading feature and is not optional for free-text grading.

What we send — and what we don't. We send only the answer text and the question being answered. We do not send your name, email address, account identifier, or any other field that identifies you, and the submission is transmitted in a form we do not link to your identity. Because a free-text answer can contain whatever you type, we ask you not to include personal or sensitive information in your answers. You are responsible for the content of your submissions (see Terms §4).

Where it is processed, and how DeepSeek may use it. DeepSeek processes the submission outside the United States. Under DeepSeek's published terms, inputs submitted to its services may be used to operate, maintain, and improve its services, including to train or improve its machine-learning models; DeepSeek does not publish a contractual zero-retention or "no-training" tier for this use, and its terms are governed by the law of a foreign jurisdiction outside the United States. We do not control DeepSeek's processing or retention of the text we transmit.

Automated decision-making

The grades, per-criterion scores, and written feedback you receive are generated by automated AI processing of the answer you submit, without human review, and they materially shape the study experience you pay for. They are algorithmic educational feedback — not human evaluation, and not career, financial, or investment advice (see the Terms). This automated processing scores your practice answers against a fixed grading rubric (covering, for example, accuracy, relevance, completeness, and precision) to produce educational feedback; it does not determine your access to any product, price, employment, credit, housing, or other significant benefit or service. If you believe a grade is erroneous, you may request human review via support@alpheri.com. Where your state's law provides, you may also obtain meaningful information about the logic involved in this automated processing and appeal an outcome by contacting us at the address in §9.

Disclosure of information; no "sale"/"share"

We disclose personal information only in the following circumstances:

• To service providers / processors that help operate the Service (see the sub-processor table below), under contract and only to perform that function.
• To our corporate affiliates (if any), to operate and support the Service.
• For legal and safety reasons — to comply with applicable law or legal process; to respond to lawful requests from government or law-enforcement authorities; to protect and defend our rights and property; to protect the personal safety of users or the public in urgent circumstances; and to enforce our Terms or prevent legal liability.
• In a business transfer — in connection with a merger, acquisition, financing, reorganization, sale of assets, or bankruptcy (we will provide notice).
• With your consent or at your direction.

We do not sell personal information and do not "share" it for cross-context behavioral advertising as those terms are defined under California law. Every recipient of personal information is a service provider that receives it under contract to operate the Service. A few of these providers also process limited information for their own purposes where permitted by law and our contracts with them: Stripe uses payment and transaction data for fraud prevention, security, and legal compliance, and Cloudflare processes Turnstile integrity signals to operate and improve its bot-detection service (see Cloudflare's Turnstile Privacy Addendum, linked in the table below); neither use involves selling personal information or sharing it for cross-context behavioral advertising. The answer text we transmit for AI grading carries no identifier (§4); and we run no advertising or analytics trackers and build no advertising profiles. Because we do not sell or "share" personal information, we do not provide a "Do Not Sell or Share My Personal Information" link; you may still contact us at support@alpheri.com with any question about these practices.

Sub-processors:

Retention

We keep information only as long as needed for the purposes above or as law requires. Your account and its associated data are retained for the life of your account; if your account is inactive for 24 months we delete it and the associated data; and you may delete your account at any time (see §9). Billing records are kept for the tax/accounting minimum even after deletion. "Inactivity" is measured from your last authenticated sign-in or activity.

Security

We apply administrative and technical safeguards: TLS encryption in transit; encryption at rest via our database provider (Firebase); authenticated, server-only data paths with least-privilege access rules; and anti-abuse controls (bot detection and request-authenticity checks via Cloudflare Turnstile and Firebase App Check, plus quota and rate controls). You are responsible for keeping your account credentials confidential, signing out on shared devices, and notifying us promptly at support@alpheri.com if you believe your account has been accessed without authorization. No method of storage or transmission is perfectly secure. If a breach affecting your personal information occurs, we will notify affected users and any applicable regulators as, and within the time, required by applicable breach-notification law.

Your privacy rights (US — multi-state)

Depending on your state of residence (e.g., California CCPA/CPRA; Virginia, Colorado, Connecticut, Utah, Texas, and other states with comprehensive privacy laws), you may have rights to: access/know, delete, correct, portability, opt out of sale/sharing or targeted advertising (note: we do none — §6), and to appeal a denied request. We will not discriminate for exercising rights.

How to exercise: Signed-in users can download a machine-readable copy of their data (access/know + portability) and delete their account at any time, self-service, from Account settings in the portal. Deleting your account cancels any active subscription immediately (with no partial refund) and erases the personal data we hold, except billing and tax records and consent records that we retain as described in §7 and as applicable law requires. For other requests, or if you do not have an account, contact support@alpheri.com. We verify your identity before acting on a request. We will respond within 45 days of receiving a verifiable request; where the request is complex or we receive a high volume, we may extend this once by an additional 45 days and will tell you of the extension and the reason. If we decline a request in whole or in part, we will explain why, and — in states that provide an appeal right (for example, Virginia, Colorado, Connecticut, and Texas) — you may appeal by contacting us at the same address; we will respond to your appeal within the period your state requires. You may use an authorized agent to submit a request on your behalf; we may require proof of the agent's authority and separate verification of your identity.

Managing your information. Signed-in users can access, export, and delete the personal information associated with their account self-service, from Account settings in the portal. For corrections, requests made without an account, or other privacy requests, email support@alpheri.com. For your protection, we verify your identity before acting on a request. Deleting all of your personal information will deactivate your account; after deletion, residual copies may persist briefly in routine backups (see §7), and we may retain records we are legally required to keep. A deletion request reaches the personal information we hold and control; it does not reach answer text we previously transmitted to our AI grading provider for grading, which is processed outside our control and subject to that provider's own retention (see §4). For ordinary submissions that text carries no identifier linking it to you (§4); we ask you not to include personal or sensitive information in your answers for this reason. You can opt out of marketing email at any time using the "unsubscribe" link in those messages — this does not affect transactional service messages (billing, security, account notices).

California "Shine the Light" (Civil Code §1798.83). California residents may request information about personal information we disclosed to third parties for their own direct-marketing purposes in the prior calendar year. We do not share personal information with third parties for their direct-marketing purposes, so no such disclosure occurs. To make a request, contact support@alpheri.com. (This is separate from the CCPA/CPRA rights above.)

Nevada (NRS Chapter 603A). Nevada residents have the right to opt out of the sale of certain covered personal information to third parties who would license or sell it. We do not sell personal information as "sale" is defined under NRS 603A, so there is nothing to opt out of; you may still submit a request to support@alpheri.com with the subject line "Nevada Do Not Sell Request" and the email associated with your account.

Children

The Service is for users 18+. We do not knowingly collect data from anyone under 18 and will delete it if we discover it.

International use

The Service is intended for use in the United States only, and this Policy addresses US federal and state privacy law. It does not provide the disclosures or rights required by the laws of other jurisdictions (for example, the EU/UK GDPR). If you are located outside the United States, do not use the Service.

Changes & contact

We may update this Policy from time to time. We post the current version here with a new effective date. Material changes — those that affect how we use or share your personal information — take effect at least 14 days after we notify you by email and/or an in-product notice; other changes are effective when posted. Please keep a current, deliverable email address on file and review this Policy periodically. If a material change affects how we use or share your personal information in a way that requires your consent, we will seek your affirmative acceptance (for example, a prompt when you next sign in) before that change applies to you, consistent with the Terms (§15).

Contact: Alpheri, LLC — support@alpheri.com — alpheri.com.