What it keeps, and why

What it collects

Only what each feature needs. By feature:

Signing in

Your email address. You sign in with a link sent to it. There is no password to store.

Canvas

Your school’s Canvas address and a personal Canvas access token you create yourself. With that token the app reads your courses, your teachers’ names, your assignments, the assignment directions and rubrics, due dates and points, and whether something was submitted. It keeps a copy so the dashboard loads fast. It never writes anything to Canvas, and it does not read Canvas messages or anything about other students.

Check-offs

Which assignments you marked done in the app, and when. These stay in the app; Canvas never sees them.

The tutor

Your Claude API key, the model you picked, and your chat transcripts, so a chat is still there when you come back.

Your voice and memory (optional)

Writing samples you upload (the app keeps the text it pulled out, not the file), a voice profile built from them, and a memory profile you paste in. All three are things you chose to add. You can remove each one in Settings.

Plus (only if you buy it)

Your plan, the date it is paid through, and the customer and subscription IDs Stripe gives back, so the app knows you have Plus. Billing details and the card are entered on Stripe’s page and stay with Stripe; card numbers are never on our servers. The app also counts messages and web searches per day so it can apply each plan’s limits.

Reminders

Your reminder settings, including the email address reminders go to, and a push-notification subscription if you turn notifications on.

Server logs

Vercel, which runs the app, keeps its standard server logs. Beyond that there are no analytics, no tracking pixel, and no third-party script on the page.

Why

Three reasons, and that is the whole list:

• To show your dashboard: what is due, when, and what the directions say.
• To run the tutor on your own key, with the assignment in front of it.
• To send the reminders you set up.

Nothing is used for ads. Nothing is sold. Nothing is shared with your school.

Where it is stored

Everything above lives in one Supabase database (Postgres) in the United States. The app itself runs on Vercel. Your data is stored under your account and nobody else’s account can reach it.

Who else sees it

Six companies touch your data, each for one job. Nobody else does.

Supabase

Stores the database and handles sign-in sessions. Holds everything listed above, with the two keys encrypted.

Vercel

Runs the app and keeps its standard server logs.

Resend

Sends the sign-in links and reminder emails. It gets your email address and the text of each email.

Anthropic

Runs the tutor. When you chat, your messages, the assignment text and rubric, and your voice and memory profiles go to Anthropic’s API, under your own key on Free or under the app’s key on Plus. Under Anthropic’s API terms, that data is not used to train their models by default.

Stripe

Takes payment for Plus, only if you buy it. It gets the billing details and card entered on its page and the account’s email address. Card numbers never touch our servers.

Instructure (Canvas)

Your school’s Canvas server. The app reads from it with your token. It sends nothing there except the read requests, and it never writes.

Encryption

Your Canvas token and your Claude key are encrypted with AES-256-GCM before they are stored. They are decrypted only on the server, only when the app reads Canvas or calls the tutor. They are never sent to the browser and never shown again, which is why the key fields in Settings stay blank.

Everything between your browser and the app travels over HTTPS.

Keeping, deleting, exporting

Your data is kept until you delete it. Both controls are in Settings → Your account:

• Download my data gives you one JSON file with your settings, chats, check-offs, writing samples and reminders. The two keys are never included.
• Delete my account removes the account and everything in it right away: settings, keys, cached Canvas data, chats, check-offs, samples, profiles and reminders. There is no waiting period.

What was already sent to Anthropic or Resend before you deleted is covered by their own policies, not this one.

Children

SM AI is for students 13 and older. Anthropic requires API account holders to be 18 or older, so the Claude key comes from a parent or guardian, and Anthropic bills them for what the tutor uses.

If you are under 13, please do not sign up. If a parent finds an account for a child under 13, email the address below and it will be deleted.

No ads, nothing sold

There are no ads and never will be. Your data is not sold, rented or traded. There is no social feed, so nobody at school sees your work.

Changes

If this page changes, the date at the top changes. A change that affects your data gets a note in the app before it takes effect.

Contact

Questions, requests about your data, and security reports all go to ethan5thgrade@gmail.com. For how the app may be used, see the terms.