Privacy Policy

1. Introduction

QtpiAI ("we," "us," or "our") operates an online math contest preparation platform designed to help students prepare for Waterloo CEMC math competitions including Gauss, Pascal, Cayley, and Fermat contests.

This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our website, mobile applications, and related services (collectively, the "Service").

By using our Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with this policy, please do not use our Service.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Email address
• Password (stored in hashed format; we never store plain-text passwords)
• Display name
• Grade level
• Target contest(s) you are preparing for

2.2 Usage and Performance Data

As you use our Service, we collect:

• Practice question attempts and answers selected
• Time spent on questions and study sessions
• Accuracy rates and performance metrics
• Topic-level accuracy and progress over time
• Contest practice history and scores

2.3 AI Conversation Data

When you interact with our AI tutor, we collect and store:

• Chat messages you send to the AI tutor
• AI tutor responses
• The specific question context associated with each conversation

2.4 Payment Information

Payment processing is handled by Stripe, a PCI-compliant payment processor. We do not store your credit card numbers, bank account details, or other sensitive payment information on our servers. We receive from Stripe:

• Subscription status and plan type
• Billing cycle dates
• Transaction history (amounts and dates)
• Last four digits of payment card (for display purposes only)

2.5 Family Plan Information

A Family plan lets one person pay for more than one account. Each person keeps a separate account. If you pay for a Family plan, or join one, we store the link between the accounts. For each plan we record:

• Which account pays for the plan, and which accounts are members of it
• The date each account joined the plan
• The email address the payer entered to send an invitation, and the account it matched
• Which account sent each invitation, when it was sent, and when it expires
• The status of each invitation (pending, accepted, declined, cancelled, or expired) and the date that status last changed

We keep an invitation record after it is declined, cancelled, or expired, so that we can answer a later question about who invited whom. Joining a Family plan does not copy, move, or merge the practice history, progress, or AI tutor conversations of any account. Section 5.5 states what each person on a plan can see.

2.6 Automatically Collected Information

When you access our Service, we automatically collect:

• Device information (browser type, operating system, device type)
• IP address and approximate geographic location
• Pages visited and features used
• Referring website or source
• Date and time of access
• Cookies and similar tracking technologies

We also collect product analytics: which page or feature was opened, recorded as a page PATTERN such as /practice/[id] rather than the address you visited. Every visitor sends these events, including a visitor who is not signed in. We do not record screen sessions, we do not capture what is typed into forms, and we do not send the full web address, the query string, the page you arrived from, your browser's user agent, your screen size, or advertising click identifiers to our analytics provider.

These events are anonymous until the account holder signs in. Our analytics provider stores a first-party cookie that holds a random device identifier, so repeat visits from the same browser can be counted; that cookie expires 90 days after your last visit, and the identifier is held nowhere else. Only when the account holder has accepted this policy at signup do we attach later events to the account identifier. An account created before this policy took effect is never attached, and its events stay anonymous.

3. How We Use Your Information

We use the information we collect to:

3.1 Provide and Improve Our Service

• Create and manage your account
• Deliver practice questions and contest preparation materials
• Power our AI tutor to provide personalized explanations
• Track your progress and generate performance analytics
• Improve our question database and learning algorithms
• Measure which features are used and where accounts encounter difficulty, so we can fix and improve the Service

3.2 Personalize Your Experience

• Recommend practice questions based on your performance
• Identify topics that need more practice
• Adapt difficulty levels to your skill level
• Provide targeted feedback and study suggestions

3.3 Process Payments

• Process subscription payments through Stripe
• Manage subscription status and billing cycles
• Send payment receipts and invoices
• Manage Family plan invitations and links, and apply the paid features of a Family plan to each account on it

3.4 Communicate With You

• Send essential account notifications (password resets, security alerts)
• Provide subscription and billing information
• Respond to your support requests
• Send important service updates

3.5 What We Do NOT Do

• We do NOT sell your personal information to third parties
• We do NOT share your data with advertisers
• We do NOT use your data for targeted advertising
• We do NOT disclose student performance data to schools or universities without explicit consent
• We do NOT show one account's performance data to another account, including to the person who pays for it under a Family plan

4. AI Tutor

Our AI tutor is powered by Anthropic's Claude API. Here is important information about how it works:

4.1 Conversation Storage

Your conversations with the AI tutor are stored in our database and are tied to specific practice questions. This allows you to revisit explanations and continue conversations where you left off.

4.2 Quality Improvement

We may review AI tutor conversations to improve the quality of explanations and identify areas where the AI can be enhanced. Any such review is conducted to improve the Service and is not used for advertising or sold to third parties.

4.3 AI-Generated Content

Responses from the AI tutor are generated by artificial intelligence and are not reviewed by humans in real-time. While we strive for accuracy, AI responses may occasionally contain errors. The AI tutor is designed to assist with learning, not to replace professional tutoring or guarantee specific contest results.

4.4 Data Sent to Anthropic

When you use the AI tutor, your messages and the relevant question context are sent to Anthropic's servers in the United States for processing. Anthropic's privacy practices are governed by their own privacy policy. We have agreements in place to protect your data.

5. Data Sharing and Disclosure

5.1 Third-Party Service Providers

We share your information with the following third-party service providers who help us operate our Service:

• Supabase - Database hosting and user authentication (servers in US/Canada)
• Anthropic - AI tutor functionality via Claude API (US-based)
• Stripe - Payment processing (PCI-DSS compliant)
• Vercel - Website hosting and delivery (global edge network)
• PostHog - Product analytics: page patterns and feature usage, anonymous until the account holder signs in and has accepted this policy (US-based)

These providers are contractually obligated to protect your data and may only use it to provide services to us.

5.2 Legal Requirements

We may disclose your information if required to do so by law or in response to valid legal requests, such as:

• Court orders or subpoenas
• Government or law enforcement requests
• To protect our rights, privacy, safety, or property
• To investigate potential violations of our Terms of Service

5.3 Business Transfers

If QtpiAI is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our Service before your information becomes subject to a different privacy policy.

5.4 No Sale of Personal Data

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

5.5 Information Shared Within a Family Plan

A Family plan links separate accounts for payment. It shares very little information, and it shares nothing about how anyone studies. On a Family plan:

• The payer sees, for each member: the member's display name, the email address the payer used to invite them, whether the invitation is pending or accepted, and the date the member joined.
• A member sees, of the payer: the payer's display name only.
• A member sees, of another member: nothing. Members are not shown to each other, and a member is not told how many other people are on the plan.

Nobody on a Family plan can see another account's practice history, answers, scores, progress, streaks, badges, weekly assignments, grade level, target contests, or AI tutor conversations. Paying for an account does not give the payer access to that account or to the data in it. A parent or guardian who wants to review a child's work must hold the account the child uses, or use the rights in Section 6.2.

When an account leaves a Family plan, or is removed from it, the payer stops seeing that account's display name and email address, and that account stops seeing the payer's display name. The record that the link existed remains, as described in Section 2.5.

6. Children's Privacy

Our Service is designed for students, including those under 18 years of age. We take the privacy of minors seriously.

6.1 Parental Consent

For users under 18 years of age, we require parental or guardian consent before creating an account. A parent or guardian may hold the account their child uses and manage it directly. A parent or guardian may instead pay for a child's own account under a Family plan; the child then holds that account, and the parent or guardian consents to these privacy practices on the child's behalf.

Paying for an account under a Family plan does not give the payer access to that account or to the data in it (Section 5.5). A parent or guardian who needs to review, correct, or delete a child's data may exercise the rights in Section 6.2 by contacting us, whichever way the account is paid for.

6.2 Parental Rights

Parents and guardians have the right to:

• Review their child's personal information
• Request correction of inaccurate information
• Request deletion of their child's account and data
• Refuse further collection or use of their child's information
• Receive a copy of their child's data

To exercise these rights, please contact us at the email address provided below.

6.3 PIPEDA Compliance (Canada)

We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's federal privacy law. This includes:

• Obtaining meaningful consent for data collection
• Limiting collection to what is necessary for identified purposes
• Using data only for the purposes for which it was collected
• Keeping data accurate, complete, and up-to-date
• Protecting data with appropriate security safeguards
• Being open about our privacy practices
• Providing access to personal information upon request

6.4 COPPA Compliance (United States)

For users in the United States, we comply with the Children's Online Privacy Protection Act (COPPA). For children under 13:

• We require verifiable parental consent before collecting personal information
• Parents can review, modify, or delete their child's information at any time
• We collect only the information necessary to provide the Service
• We do not condition participation on disclosure of more information than necessary

6.5 Data Minimization for Minors

We limit the personal information collected from minors to what is necessary to provide our educational services. We do not require real names—users may use a display name of their choosing.

7. Data Retention

7.1 Active Accounts

We retain your personal information for as long as your account remains active and as necessary to provide you with our Service.

7.2 Account Deletion

When you delete your account:

• Your personal information (email, display name, profile data) is deleted within 30 days
• Your practice history and AI conversation data are deleted within 30 days
• Any Family plan membership and any invitation record that names your account are deleted with it; if you paid for a Family plan, the accounts on it are unlinked and revert to the Free plan, and those accounts are not deleted
• Anonymized, aggregated data may be retained for analytics and service improvement
• We may retain certain information as required by law or for legitimate business purposes (e.g., fraud prevention, resolving disputes)

7.3 Payment Records

Transaction records may be retained for up to 7 years to comply with tax and accounting requirements.

7.4 Backup Systems

Deleted data may persist in backup systems for up to 90 days before being permanently removed.

8. Your Rights

Depending on your location, you may have the following rights regarding your personal information:

8.1 Right to Access

You can request a copy of the personal information we hold about you.

8.2 Right to Correction

You can request that we correct inaccurate or incomplete personal information. You can also update most of your information directly in your account settings.

8.3 Right to Deletion

You can request deletion of your account and personal information. You can also delete your account directly from your account settings.

8.4 Right to Data Portability

You can request an export of your data in a commonly used, machine-readable format.

8.5 Right to Withdraw Consent

Where we rely on consent to process your data, you can withdraw that consent at any time.

8.6 How to Exercise Your Rights

To exercise any of these rights, please contact us at the email address below. We will respond to your request within 30 days. We may need to verify your identity before processing certain requests.

8.7 Complaints

If you have concerns about how we handle your data, you may file a complaint with us. Canadian users may also file a complaint with the Office of the Privacy Commissioner of Canada. Users in other jurisdictions may contact their local data protection authority.

9. Security

We take the security of your personal information seriously and implement industry-standard measures to protect it:

• Encryption - All data transmitted between your browser and our servers is encrypted using TLS/SSL
• Password Security - Passwords are hashed using secure algorithms; we never store plain-text passwords
• Secure Authentication - We use secure session management and offer email verification
• Access Controls - Access to personal data is limited to authorized personnel who need it to perform their job functions
• Infrastructure Security - We use reputable cloud providers with strong security practices and compliance certifications
• Regular Monitoring - We monitor our systems for security threats and vulnerabilities

While we implement these safeguards, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

10. International Users

QtpiAI is operated from Canada. If you access our Service from outside Canada, please be aware that your information may be transferred to, stored, and processed in Canada and the United States, where our servers and third-party service providers are located.

By using our Service, you consent to the transfer of your information to these countries, which may have different data protection laws than your country of residence.

We take steps to ensure that your data receives an adequate level of protection in the jurisdictions in which we process it, including through contractual arrangements with our service providers.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons.

When we make changes:

• We will update the "Last updated" date at the top of this page
• For significant changes, we will notify you via email or a prominent notice on our Service
• We encourage you to review this policy periodically

Your continued use of the Service after changes are posted constitutes your acceptance of the updated policy.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

For Canadian users with unresolved privacy concerns, you may also contact the Office of the Privacy Commissioner of Canada: