Qumely Privacy Policy

This Privacy Policy explains how Qumely (“Qumely,” “we,” “us,” or “our”) collects, uses, stores, and shares personal information when you use Qumely.

We design our privacy practices around limiting collection to information reasonably necessary to operate Qumely and retaining personal information only for appropriate purposes. Canadian privacy guidance similarly emphasizes meaningful consent, limited collection and retention, safeguards, access, and accountability.

1. Information We Collect

Depending on how you use Qumely, we may collect:

Account information

• name;
• email address;
• authentication and account identifiers; and
• account settings.

Academic information

• institution and term;
• courses;
• schedules;
• deadlines;
• assignments and examinations;
• grading information;
• study plans;
• attendance information; and
• information you manually create or edit.

Uploaded content

• syllabi and other documents you choose to upload; and
• text and structured information extracted from those documents.

Attendance and streak information

• attendance/check-in submissions, where available;
• daily check-in dates and completion status; and
• related streak totals, goals, time-zone settings and recovery records.

AI attendance-photo verification is not currently enabled.

Social features

• friendships;
• invitations;
• partnership streaks; and
• course-sharing activity.

Technical and usage information

• device and application information;
• IP address;
• authentication and security information;
• feature usage;
• error and diagnostic information;
• notification preferences and browser push subscription information;
• notification delivery records; and
• operational logs.

Subscription information

• plan and entitlement status;
• purchase identifiers;
• billing status; and
• transaction information received from payment providers.

Support communications

• the category and message you submit through Contact Us;
• the email address you provide through public Contact Us, or your account email and account identifier associated with an authenticated support request; and
• related support correspondence reasonably necessary to respond to or troubleshoot the request.

Qumely generally does not need to receive or store your full payment-card details when payment is handled directly by a third-party payment provider.

2. How We Use Information

We use information to:

• create and secure your account;
• extract information from syllabi;
• create courses, deadlines, schedules, and study plans;
• provide available in-app and browser reminders and account communications;
• operate attendance, daily check-in and streak features;
• enable friendships, partnerships, and course sharing;
• provide subscriptions and enforce usage allowances;
• prevent fraud, abuse, malware, and unauthorized access;
• diagnose errors and maintain service reliability;
• provide customer support and respond to support requests;
• understand how Qumely features are used;
• improve Qumely; and
• comply with legal obligations.

We do not use your uploaded syllabus for advertising.

3. Syllabus Privacy

Your original syllabus remains private.

Qumely does not sell, publicly publish, or distribute your original uploaded syllabus to other students, advertisers, data brokers, or unrelated third parties.

We may transmit uploaded content to service providers where necessary to store, process, and extract information from it.

Before extraction, Qumely checks an upload’s expected file type, content signature, size, and PDF or DOCX structure. These checks help reject unsupported or malformed documents; they are not malware scanning and do not guarantee that an uploaded file is harmless.

Sharing or importing a Qumely course shares the applicable structured course information—not the original source syllabus.

4. Syllabus Retention and Deletion

Original syllabus files are retained while upload processing or permitted retries are in progress and while a Review is pending.

Qumely Web can also keep a separate viewing copy of a syllabus and locally recognized text in your browser. You can replace or remove that copy in the viewer or clear the site's browser storage. Opening a file only for local viewing does not upload it; submitting it for extraction does. Server-side original-file cleanup and signing out do not automatically remove these browser copies, and the copies do not automatically transfer to another device.

After you successfully confirm a Review, Qumely schedules the original PDF or DOCX for deletion. Deletion occurs asynchronously through the syllabus storage-cleanup process, waits until the signed upload link has expired, and is retried if storage is temporarily unavailable. Cleanup failures or worker unavailability can delay deletion.

Terminal processing failures, discarded Reviews, and expired Reviews also schedule original-file cleanup under the applicable workflow. These paths may likewise wait for upload-link expiry and retry storage failures.

Deleting the original file does not delete associated Review data, extracted or structured content, Course/Task data, or processing and accounting records. Those records remain subject to their separate purposes and applicable deletion requirements. Original-file cleanup does not establish a deletion deadline for them.

The confirmation-triggered process does not automatically backfill original files from confirmations completed before that process became operational.

Automatic general retention cleanup is currently inactive. Account-deletion requests are handled through Qumely support as described in Section 14; original syllabus cleanup is a separate active workflow.

Limited processing metadata, security information, and operational records may be retained where reasonably necessary for security, troubleshooting, fraud prevention, legal compliance, or dispute resolution. We do not promise a fixed deletion or retention deadline.

Database backups may retain earlier copies of database records. Supabase database backups include Storage metadata, but do not include the original file objects stored in Storage. Removing a live file does not by itself erase database records, provider-held data, or backups. Backup copies follow the provider’s backup lifecycle; no guaranteed backup-erasure deadline is promised.

5. Artificial Intelligence

Qumely uses paid Google Gemini API services for production syllabus extraction. Uploaded syllabus content may be sent to Gemini to identify course information, schedules, assignments, deadlines, grading rules, and related information.

Separately, Qumely may send institution and academic-term labels to Google Gemini to suggest term dates, using Google Search grounding where enabled to find supporting sources. This lookup is separate from extracting the syllabus. Google's Search grounding terms provide for storing the lookup's prompts, supplied context and output for 30 days to support grounded results, debugging and testing.

Google states that paid-service prompts, associated content, and responses are not used to improve its products. Google nevertheless retains certain data for abuse monitoring and required legal or regulatory disclosures under its applicable terms. Provider-held data may remain after Qumely deletes an original file, and paid processing is not a promise of zero retention.

Qumely does not intentionally send raw syllabus text or attendance photographs to general-purpose product analytics systems.

6. Attendance Photos

AI attendance-photo verification is not currently enabled. Ordinary attendance/check-in and streak features remain separate from that deferred workflow. This policy does not represent AI attendance-photo processing or automatic photo-cleanup workflows as operational.

7. Analytics and Diagnostics

Qumely uses base Vercel Web Analytics to measure permitted public and application pageviews. Analytics Plus is not enabled.

Before sending pageview URLs, Qumely removes query strings and fragments, replaces private Course/Task identifiers with route placeholders, and excludes authentication callback, recovery, invitation-token, and unsupported routes. Public Blog slugs identify public articles, not private academic records.

Qumely does not attach custom Analytics events, user IDs, email addresses, raw syllabus content, or private academic identifiers to these pageviews. Vercel also processes request-derived information for aggregate traffic statistics, such as browser, device, approximate location, and referrer information.

Web Analytics is separate from authentication cookies and operational diagnostics. Operational records may include request outcomes, errors, performance, AI usage counts, and identifiers needed to investigate processing or security issues. The Analytics filtering described above is not a claim that all operational logs contain no identifiers.

We design these systems so that raw syllabus contents and attendance photographs are not intentionally included in ordinary analytics events or application logs.

Aggregated or appropriately de-identified information may be retained longer when it can no longer reasonably identify you.

8. Service Providers

Qumely relies on third-party providers to operate the Service, including:

• Supabase for authentication, PostgreSQL databases, and private object/file storage;
• Google, Microsoft, and Apple for sign-in when you choose those options through Supabase;
• paid Google Gemini API services for syllabus processing;
• Vercel for Web hosting and base Web Analytics;
• Microsoft Azure for API hosting and related infrastructure;
• Resend for email delivery;
• browser and operating-system push providers, such as Google, Mozilla and Apple, for browser notification delivery;
• Stripe for Web payments and subscription management; and
• customer support and operational tooling.

Native-app remote push, RevenueCat/native in-app purchasing, Premium purchasing, and AI attendance-photo verification are not currently enabled. Apple sign-in is separate from Apple in-app purchasing.

These providers receive information only as reasonably necessary for the services they provide to Qumely.

We do not sell your personal information to advertisers or data brokers.

9. Processing Outside Canada

Some Qumely service providers may process or store information outside Canada.

When personal information is processed in another jurisdiction, it may become subject to that jurisdiction’s laws, including lawful requests from courts, regulators, law-enforcement or national-security authorities.

Canadian privacy guidance recognizes cross-border processing but requires organizations to remain accountable for information transferred to service providers and to be transparent about foreign processing.

10. Notifications and Communications

Qumely uses Supabase authentication for email/password accounts and supported Google, Microsoft, and Apple sign-in.

Configured authentication and account emails, including signup confirmation and password-reset messages, are delivered through Supabase using Resend SMTP. Qumely’s API separately uses Resend for support/contact email.

When you use public Contact Us, we collect the email address, category, and message you provide. An authenticated support request also associates your account email and account identifier with the request so we can respond or investigate.

Where available, browser notifications require you to enable them and grant permission on that browser or device. Qumely stores a browser installation identifier, its association with your account, the push subscription address and encryption information needed for delivery, your notification preferences, and delivery records. Browser or operating-system push providers process the information needed to deliver these notifications.

You can change reminder categories or disable browser notifications in Qumely, and revoke permission in your browser settings. Browser and native-app notification preferences are separate. Qumely attempts to disconnect the browser from your account when you sign out; switching accounts does not automatically enroll the new account. Cleanup may be delayed or incomplete if connectivity or browser storage is unavailable. Previously delivered notifications may remain on your device.

Academic dates and reminders may follow the applicable institution, course or account time zone. Daily check-in days use the Streak time zone shown in Qumely.

You are responsible for confirming that your institution and time zone are correct. Reminders are assistive and are not guaranteed to arrive before an academic deadline.

Marketing communications, where used, will provide applicable consent and unsubscribe controls. Canadian anti-spam rules generally require consent, sender identification and an unsubscribe mechanism for commercial electronic messages.

11. Course Sharing and Social Features

When you intentionally share a course, Qumely may disclose the structured course information necessary to provide that feature.

The original uploaded syllabus is not included.

If another user imports shared course information, that imported copy may continue to exist independently of your account.

Friendship and partnership features may disclose limited information necessary to provide those features. Partnership streak information may be visible to both members of the partnership. If you enable personal Streak sharing, your friends can also see your current and best personal streak counts and your goal, if one is set. This is separate from partnership information. Your choice does not enable sharing of a friend's personal streak with you; each person controls their own setting. Personal Streak sharing does not disclose task activity, daily check-in history or attendance photos. You can turn off personal Streak sharing in Streak settings.

12. Security

We use reasonable administrative, technical, and organizational safeguards appropriate to the nature of the information we process, including access controls, authentication, secure communications, and measures intended to prevent unauthorized access.

No online service can guarantee absolute security.

If a security breach involving personal information creates notification or reporting obligations under applicable law, we will comply with those obligations.

13. Your Choices and Rights

Subject to applicable law, you may request to:

• access personal information Qumely holds about you;
• correct inaccurate information;
• delete information;
• delete your account;
• withdraw certain consent; or
• ask how your personal information has been used or disclosed.

Withdrawal of consent may prevent Qumely from providing features that require the affected information.

Canadian privacy law provides individuals with rights relating to access, consent, accuracy and challenging an organization’s privacy practices.

14. Account Deletion

At launch, account-deletion requests are handled through Qumely support. Contact team@qumely.com or use Contact Us.

An accepted in-app deletion request can place your account into a pending-deletion state after billing-safety checks and restrict ordinary account access. It does not itself complete erasure. Automatic final account deletion and general retention cleanup are currently inactive.

Qumely support handles requests to delete or de-identify personal information that is no longer reasonably required. We do not promise completion within seven days or any other fixed period.

Some information may remain in backups or be retained where reasonably necessary for security, fraud prevention, financial or tax records, dispute resolution, legal claims, or other legal obligations.

Independent copies of course information previously imported by another user are associated with that user’s account and may not be deleted when you delete yours.

15. Age Eligibility

Qumely is available only to people aged 18 or older. People under 18 must not create an account or use Qumely.

16. Changes to This Policy

We may update this Privacy Policy as Qumely, our technology, or legal requirements change.

If a change materially affects how we collect, use, or disclose personal information, we may provide additional notice and, where appropriate, request renewed acknowledgement or consent.

Qumely may retain the version of the Privacy Policy acknowledged by your account and the date of acknowledgement.

17. Privacy Contact

For questions, privacy requests, access or correction requests, deletion requests, or concerns about how Qumely handles personal information, contact:

Privacy Contact — Qumely
team@qumely.com
https://qumely.com/contact
Nova Scotia, Canada