Paradigm logo
Sign inTry for Free

PRIVACY POLICY

PARADIGM US OPERATION INC.

Last Updated: Monday, July 27, 2026

1. Introduction

This Privacy Policy explains how we collect, use, and protect your personal information when you use our Service.

Google user data. Data that we access from Google APIs (Google Drive, Google Calendar, Gmail, and Google Classroom) is treated differently from all other data described in this Policy. Any general statement in this Policy about how we collect, use, retain, share, or process data — including for improving our AI, analytics, research, or marketing — does not apply to data obtained through Google APIs. Our handling of Google user data is governed exclusively by Section 6 and by the Google API Services User Data Policy, including the Limited Use requirements. Where any provision of this Policy conflicts with Section 6, Section 6 controls.

2. Information We Collect

  • Account Information

    • Name, email, phone number (if provided), and authentication data from enabled third-party providers (such as Google or Apple).

  • User Interactions

    • We log interactions such as chats and files you upload directly to the Service, for the purpose of improving our AI and enhancing the user experience. Content you upload directly may also be used to generate and reproduce responses and materials provided to you and to other users of the Service, as described in the User Policy.
    • This does not include data obtained through Google APIs. Files or content brought in from a connected Google account are handled only as described in Section 6 and are never used to train or improve our AI, nor reproduced for other users.

  • Non-Personal Data

    • Device information, browser type, and usage logs may be collected for analytics and optimization.

  • Cookies

    • Our platform uses cookies and similar technologies to enhance your experience, personalize content, analyze usage, and improve our services.
    • By using our services, you consent to the use of cookies.
    • You can manage or disable cookies through your browser settings, but some features may not function properly if cookies are disabled.
    • The cookies we use include strictly necessary cookies required for the Service to function and optional cookies used for analytics and personalization.

3. Use of Your Data

We use collected information for:

  • Account management
  • Improving and refining our AI models
  • Analytics and research (using aggregated, non-personally identifiable data)
  • Marketing and communications (e.g., newsletters, updates), if you opt in

None of the uses above apply to data obtained through Google APIs. Google user data is used only to provide the features you request, as described in Section 6 — never for training or improving our AI, analytics, research, or marketing.

4. Data Sharing and Disclosure

  • Service Providers

    • Vercel for hosting, Polar for payment processing, enabled providers such as Google and Apple for authentication, and Turso and Amazon Web Services for data storage.

  • Research and Analytics Partners

    • Aggregated, anonymized data may be shared with research groups and analytics tools. This never includes data obtained through Google APIs.

  • We do not sell or rent your personal data to third parties. We do not transfer, sell, or share data obtained through Google APIs with third parties, except as necessary to provide the feature you requested (see Section 6).

5. Data Retention and Security

  • Storage

    • Data is stored on secure AWS, Vercel, and Turso/Fly.io servers with standard SaaS protections.

  • Retention

    • We retain personal information as long as you maintain your account.
    • Interaction logs and non-personal data may be retained for as long as needed for the purposes described in this Policy, including improving our AI, and may be kept in de-identified or aggregated form. You may request deletion of your personal data as described in Section 8. This does not apply to data received from Google APIs, which is used only to provide the service and is not retained for AI training (see Section 6).

  • Security Measures

    • We use industry-standard encryption and secure hosting.
    • No system is completely secure, but we take reasonable measures to protect your data. In the event of a data breach affecting your personal information, we will notify affected users and the appropriate authorities as required by applicable law, without undue delay.

6. Google User Data

Paradigm Study's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. This Section governs all data we obtain through Google APIs and takes precedence over any other provision of this Policy.

Signing in vs. connecting a service. Signing in with Google requests only your basic profile information (openid, email, profile) to create and secure your account. Access to Google Drive, Calendar, Gmail, or Classroom is requested separately and only when you explicitly connect that service, using the narrowest scope needed:

  • Google Drive — per-file access (drive.file). We can only see the specific files you choose through Google's file picker, never your entire Drive.
  • Google Calendar — access limited to events you own (calendar.events.owned), so the tutor can find study windows and create study sessions you ask for.
  • Gmail — read-only (gmail.readonly). We read only the metadata and snippets needed to surface relevant messages; we do not send, delete, or modify email.
  • Google Classroom — read-only access to your courses, coursework, and your own submissions, to help organize your studies.

Limited Use commitment. Our use of information received from Google APIs adheres to the Limited Use requirements. Specifically, we:

  1. use Google user data only to provide and improve the user-facing features you request within Paradigm Study;
  2. do not transfer Google user data to third parties except (a) as necessary to provide or improve those features, (b) to comply with applicable law, or (c) in connection with a merger or acquisition after notice to you;
  3. do not use Google user data for serving advertising of any kind;
  4. do not use Google user data — or any data derived from it — to develop, improve, or train generalized or non-personalized AI or machine-learning models; and
  5. do not allow humans to read Google user data, except (a) with your affirmative consent, (b) as necessary for security or to comply with applicable law, or (c) where the data has been aggregated and anonymized for internal operations.

How Google data is processed. When you ask the AI tutor to work with a Google file, its content is read at the moment of your request and passed to the AI model that generates your response. Our third-party AI providers process this content only to fulfill your request, under terms that prohibit using it to train or improve their models. We do not use Google user data to train our own models, and we do not retain your calendar events, emails, or Classroom data beyond what is needed to complete your request. If you explicitly bring a file from Google Drive onto your canvas, we store that file so we can display it to you as part of the feature you requested; you can delete it at any time by removing it from your canvas or disconnecting your Google account.

Storage and security. Google OAuth access and refresh tokens are encrypted at rest using AES-256-GCM (with per-record initialization vectors) and are transmitted only over TLS. Token content is never exposed to the client.

Revocation. You can disconnect your Google account at any time from your account settings. Disconnecting immediately and permanently deletes all stored tokens and revokes our access. You can also review and revoke access at any time from your Google Account permissions page.

7. International Compliance

  • By using our Service, you consent to the transfer and processing of your information.
  • We comply with applicable local laws and regulations.

8. User Rights

  • Access, Correction, Deletion

    • You may request access to or deletion of your personal data at any time.
    • Deleting your account removes personal data, but de-identified, non-personalized data may remain for AI training. This does not include data obtained through Google APIs, which is never used for AI training and whose tokens are deleted when you disconnect your Google account (see Section 6).

  • Opt-Out

    • You may opt out of marketing communications at any time.

  • California Privacy Rights

    • If you are a California resident, you have the right to know what personal information we collect and how we use and disclose it; to request access to, correction of, or deletion of your personal information; to opt out of the sale or sharing of personal information; and not to be discriminated against for exercising these rights. We do not sell your personal information or share it for cross-context behavioral advertising. To exercise any of these rights, contact us using the details in Section 11, and we will verify and respond to your request as required by law.

9. Children’s Privacy

  • The Service is intended for users who are at least 13 years old and is not directed to children under 13.
  • We do not knowingly collect personal data from children under 13. If we learn that we have collected personal data from a child under 13 without verifiable parental consent as required by the Children's Online Privacy Protection Act (COPPA), we will delete it promptly. If you believe a child under 13 has provided us with personal data, please contact us so we can remove it.

10. Changes to the Privacy Policy

  • We may update this Privacy Policy periodically.
  • Significant changes will be notified via email or in-service notifications.
  • Continuing to use the Service after updates indicates acceptance of the revised Privacy Policy.

11. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, you can contact us by email at contact@paradigm.study or through in-service support. We will respond to your request within the timeframe required by applicable law.