Privacy Policy — GradePact

1. Who We Are

GradePact (“we,” “us,” or “our”) is an academic accountability platform that helps students track their grades and stay connected with accountability partners such as parents or guardians. This Privacy Policy describes how we collect, use, and protect your personal information when you use GradePact at gradepact.com or in our mobile application (collectively, the “Service”).

If you have questions, contact us at help@gradepact.com.

2. Information We Collect

Information you provide directly:

Account information: Your name, email address, password, and account type (student or parent/guardian).
Academic data: Courses you add, syllabi you upload, grades you log, reflections you write, and grading scale information extracted from your syllabi.
Check-in data: Proposed and confirmed check-in schedules, check-in notes, and calendar exports.
Partner connections: Email addresses of accountability partners you invite, and the nature of your relationship with them.
Parent feedback: Written feedback that parents or guardians provide on student reflections.
Payment information: If you subscribe to GradePact Premium, your payment is processed by Stripe. We do not store your full credit card number; we only retain a Stripe customer ID.

Information collected automatically:

Usage data: Basic analytics about how you use the Service, collected through Vercel Analytics. This includes page views and general usage patterns. We do not use third-party advertising trackers.
Device data: When you use our mobile application, we may collect your device type, operating system version, and push notification token (for sending you notifications you have opted into).

3. How We Use Your Information

To create and manage your account and authenticate you securely.
To provide the core features of the Service, including grade tracking, syllabus parsing, check-in scheduling, and partner connections.
To power AI features: when you use AI syllabus parsing or AI conversation starters, relevant academic data (such as grade information and reflection content) is sent to Anthropic (Claude)'s API to generate responses. See Section 5 for more detail.
To send you transactional emails such as check-in reminders, grade notifications, and invite confirmations. You can manage notification preferences in your account settings.
To send push notifications to your mobile device if you have opted in.
To process Premium subscription payments via Stripe.
To improve and maintain the Service, diagnose bugs, and understand usage patterns.

4. How We Share Your Information

We do not sell your personal information. We share information only in the following circumstances:

With your accountability partner:

If you invite a parent or guardian, or if one invites you, that person will be able to see the academic information you have chosen to share with them through the Service. You control which courses are visible to your partner.

With third-party service providers:

Supabase — our database and authentication provider. All user data is stored in Supabase infrastructure. Supabase is SOC 2 Type II certified.
Anthropic (Claude) — when you use AI-powered features (syllabus parsing or conversation starters), relevant content from your account is transmitted to Anthropic (Claude)'s API. Anthropic (Claude) processes this data to generate responses. Anthropic (Claude)'s API usage policies prohibit them from training on API-submitted data by default. We encourage you to review Anthropic (Claude)'s Privacy Policy.
Resend — our email delivery provider. Your email address and the content of transactional emails are processed through Resend.
Stripe — our payment processor. If you subscribe to Premium, your payment information is handled by Stripe under their own privacy policy. We receive only a customer token.
Vercel — our web hosting and deployment platform. Your requests to our web app pass through Vercel's infrastructure.
Expo (EAS) — our mobile build and push notification infrastructure provider.

For legal reasons:

We may disclose information if required by law, court order, or to protect the safety, rights, or property of GradePact or others.

5. AI Features & Your Data

GradePact uses Anthropic's API (Claude) to power two features:

AI syllabus parsing: When you upload a syllabus, its text content is sent to Anthropic's Claude API to extract grading weights, due dates, and course structure.
AI conversation starters (Premium): When a parent requests conversation starters, relevant grade information and the student's reflection text for that grade entry are sent to Anthropic's Claude API.

We do not send your full account history or unrelated data to Anthropic (Claude) — only the specific content needed to generate a response. You can choose not to use these features.

6. Data Retention

We retain your personal information for as long as your account is active. When you delete your account, we permanently delete all associated data — including your profile, courses, grades, reflections, check-in history, and partner connections — within a reasonable timeframe. Stripe may retain payment records separately as required by financial regulations.

7. Your Rights

Access: You can view all of your data within your account dashboard at any time.
Correction: You can update your name and account information in Settings.
Deletion: You can permanently delete your account and all associated data at any time from your account Settings page. This action is irreversible.
Data portability: To request a copy of your data, email us at help@gradepact.com.
Opt out of notifications: You can manage email and push notification preferences in your account Settings.

8. Children's Privacy

GradePact is intended for users who are at least 13 years old. We do not knowingly collect personal information from children under the age of 13. If you are under 13, please do not use the Service.

If you are between 13 and 17 years old, you represent that your parent or guardian has reviewed and agreed to these terms on your behalf. If we become aware that we have collected information from a child under 13 without parental consent, we will delete that information promptly. Contact us at help@gradepact.com if you believe this has occurred.

9. Security

We use industry-standard measures to protect your information, including encrypted connections (HTTPS), secure authentication via Supabase, and row-level security policies that ensure users can only access data they are authorized to see. No method of internet transmission is 100% secure, and we cannot guarantee absolute security.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this page and notify you by email if the changes are material. Continued use of the Service after changes are posted constitutes your acceptance of the updated Policy.

11. Governing Law

This Privacy Policy is governed by the laws of the State of Arizona, United States, without regard to its conflict of law principles.

12. Contact Us

For questions, data requests, or concerns about this Privacy Policy, contact us at:

GradePact
Email: help@gradepact.com