Privacy Policy

1. Who we are

AllyLearns ("we", "us") provides AI-assisted homework help, learning sessions, quizzes, and progress reporting for households, tutors, and tuition centres. Parent and teacher accounts manage student profiles; children do not create standalone adult billing accounts. For PDPA questions, our Data Protection Officer can be reached through the Contact page or at allylearnssg@gmail.com.

2. Information we collect

• Account details: name, email, password (stored hashed), organisation or school details when you register a centre, and profile preferences such as avatar choices. If you create an account with Google, we store the Google account identifier, verified email, and display name returned by Google. If you connect Google to an existing account, we store the Google account identifier and verified-email status while keeping the account name and email already on that account.
• Child / student profiles: first name or display name, username, age group, grade or year if provided, tutor and mode settings, and classroom or home-room enrollment.
• Learning activity: homework and learning transcripts, quiz attempts and scores, session history, and reports generated for parents or teachers.
• Billing: plan, usage meters, and payment metadata processed by our payment provider (for example Stripe). We do not store full card numbers on our servers.
• Support and security: messages you send via Contact or Help, approximate location from IP for fraud and rate limiting, and technical logs needed to keep the service reliable.
• Consent records and analytics: the legal-document versions and time you accepted them, IP address and browser details used as evidence of acceptance, and product analytics such as page views and sign-in or sign-up events. We do not enable session replay.
• Waitlist details: your email address, whether you are joining as a parent, teacher, tutor, or organisation, referral or campaign information, your consent and confirmation times, and the delivery, invitation, registration, bonus, or unsubscribe status associated with your waitlist entry.

3. How we use information

• Provide tutoring, quizzes, reports, and parent or teacher portals.
• Authenticate users, reset adult passwords, and enforce safety controls.
• Process subscriptions, invoices, and plan limits.
• Improve product quality, detect abuse, and respond to support requests.
• Confirm waitlist requests, send launch or early-access updates you asked for, issue invitations, and determine or record eligibility for a disclosed early-bird credit bonus.
• Meet legal obligations. We do not sell personal data to third parties for their advertising.

4. AI tutoring and children

Study chats are processed by AI systems so the tutor can reply in context. Parents and authorised adults can review transcripts and set help modes. We design prompts and product rules for age-appropriate study use. Student passwords are managed by parents or teachers in their portals; students cannot reset passwords by email. Adults who create or link a student profile must have authority to provide that student's data and obtain any required parent or guardian consent. If we have reason to believe a child can consent under applicable law, notices must still be clear and understandable to that child; AllyLearns nevertheless uses adult-managed accounts for paid services and student-profile administration.

5. Sharing

We share data only as needed to run AllyLearns: hosting and database providers, email delivery, payment processors, analytics and error-monitoring providers, and AI model providers that process study content under our instructions. Current core providers include Cloudflare (hosting and private upload storage), Supabase (database and staging-only legacy upload reads), OpenAI (AI processing), Stripe (payments), Resend (email), Google (optional sign-in), PostHog and Google Analytics (product and traffic analytics), and Sentry and Better Stack (error monitoring and logs). Google sign-in requests your basic OpenID Connect identity only; AllyLearns does not request access to Gmail, Drive, or other Google services. Linked parents, teachers, or school staff see the student information their role allows. We may disclose information if required by law or to protect users from serious harm.

6. Retention and security

We keep account and learning records while your account is active and for a period afterward only as needed for billing, dispute resolution, safety, and legal compliance. Closing an adult account removes sign-in access and anonymises direct account identifiers, while records that must remain linked for those purposes may be retained. Unreferenced uploaded files are scheduled for deletion after 30 days; referenced learning files remain with the related learning record until that record is deleted or no longer needs to be retained. We keep legal acceptance and billing evidence for the period needed to establish or defend legal claims. You may close your account in settings, or contact us about the personal data we hold. We use safeguards such as encrypted transport, hashed passwords, and access controls. No online service is perfectly secure; please choose strong passwords and keep adult credentials private.

Waitlist records are kept while the early-access campaign is active and afterward only as needed to deliver an invitation or bonus, document the consent you gave, resolve delivery or abuse issues, and honour an unsubscribe. If you unsubscribe, we may retain a minimal suppression record so we do not contact you again. You can ask us to delete other waitlist data using the Contact page.

7. Your choices (PDPA)

Depending on your location, you may request access to, correction of, or deletion of personal data we hold about you or your child, withdraw consent where processing is consent-based, or ask questions about our practices. Parents manage children's profiles and can unlink teachers or schools from the parent portal. To exercise these rights, contact us using the details below. Every waitlist email includes an unsubscribe option; using it stops further waitlist and launch-update emails.

8. International transfers

Our infrastructure and vendors may process data outside Singapore. Where we do so, we take steps consistent with PDPA expectations so personal data remains protected.

9. Changes

We may update this policy as AllyLearns evolves. Material changes will be reflected by updating the date above and, when appropriate, notifying account holders by email or in-product notice.

10. Contact

Privacy questions: use our Contact page. For account-specific requests, sign in and open Help so we can verify you.