Privacy Policy

Effective October 19, 2026

This Privacy Policy explains how bharris.app collects, uses, stores, and shares information when you use the website at https://bharris.app or the iPhone application.

bharris.app is operated by an individual in the United States, not a corporation or other separate business entity.

By creating an account, or by continuing with Apple or Google, you agree to this Privacy Policy. Signing in to an existing account does not require a new agreement.

For privacy questions or requests, contact bharris.app@gmail.com.

Last updated October 19, 2026

1. Information We Collect

We collect information that is necessary to operate your account and provide the Service. Depending on how you use the Service, this may include the categories below.

Account information

• Email address
• Display name, which you can edit up to 80 characters
• Account ID
• Account creation and update times
• Sign-in information handled through Firebase
• The name and email Google or Apple actually share when you choose those sign-in methods. Apple may hide your real email and often sends your name only the first time.
• Birthday, used only to check that you are old enough to use the Service
• For ages 13–17, the time a parent or legal guardian's permission was confirmed
• An optional answer to "How did you hear about us?", if you choose to give one
• The time you last opened the app, stored as last_seen_at and updated at most once an hour

Study information

This information is used to provide your study experience.

• Note titles, terms, definitions, and note transcripts
• Study session information, including the plan and phase
• Difficulty, confidence, mastery, grades, and recall history
• Panic-note content
• Information about how terms were studied
• Monthly AI usage: calls used, the limit, and the UTC month
• Counts of a few product actions: a cram started, study terms shown, an AI monthly cap hit and which feature hit it, a cram finished, the plans sheet shown, and a plan bought
• OpenAI token counts for each successful AI call: prompt tokens, completion tokens, total tokens, and which feature made the call. The note text is not stored in that record

Subscription information

• Current plan: Free, Study, Partner study, or a friend's seat on someone else's Partner study
• Stripe customer ID and subscription ID
• Subscription status, trial information, and period dates
• Cancellation status and promotional-code status
• RevenueCat app user ID, which is your account ID, for a supported older App Store subscription

We do not store your full payment-card number.

Security information

For security and abuse prevention, the Service may store:

• Failed Partner study code attempts, the account ID associated with those attempts, and the time of those attempts
• Development-tools code failure counts and temporary account lock information

Failed Partner study code-attempt records may remain after account deletion. Development-tools failure counts are removed when the account is deleted.

2. Information We Do Not Collect

The Service does not intentionally collect:

• Precise location
• Contacts
• Microphone recordings
• Payment-card numbers
• Advertising profiles or third-party advertising analytics
• Passwords in plaintext

Notes are not sent to advertising networks.

The Service does not use a third-party analytics product to create an analytics profile about you. The last_seen_at value is used only to count how many accounts were active in the previous seven days.

The Service does keep its own counts of those product actions and OpenAI token totals in the Cloudflare account that hosts the Service. The counts do not include notes, photos, or answers, and they are not shown in the app. The operator reviews them in that Cloudflare account. Per-account rows are removed when the account is deleted. Aggregate copies in Cloudflare Analytics Engine are not tied to an account, so deleting an account does not erase those copies.

The Service does not intentionally store your IP address as part of your account record. Cloudflare, as the infrastructure provider, may still receive normal technical request information through its infrastructure and logs.

3. Photos and Note Scanning

If you choose to scan notes, the Service temporarily processes the photo so that text and study material can be extracted.

Photos are currently limited to two images per scan, with a maximum size of 12 MB per image.

The current live Worker does not have a configured permanent photo-storage bucket. The original photo is held in memory during processing, sent to the Service's server, forwarded to OpenAI for processing, and then discarded.

The Service retains the resulting text, such as titles, terms, and definitions, as part of your stored notes.

Photos are not written to browser or iPhone local storage as part of the normal scanning process.

Photo upload does not ask for a separate password. The operator can turn photo upload off.

4. How We Use Your Information

Information is used to:

• Create and maintain your account
• Authenticate you
• Store and retrieve your notes
• Save study sessions
• Generate study plans and track study progress
• Provide AI-generated definitions, explanations, practice questions, incorrect answer choices, grading, and panic notes
• Provide spaced-study reminders
• Manage subscriptions and enforce plan and usage limits
• Prevent abuse of Partner study codes
• Protect the security of the Service
• Provide customer support
• Count how many accounts were active in the previous seven days
• Confirm an account is old enough to use the Service, and record parent or guardian permission for ages 13–17
• Count the product actions and AI token totals described above

A last_seen_at value may be updated no more than once per hour for that limited activity count. There is no third-party analytics product associated with it. Product-action counts are reviewed in the Cloudflare account that hosts the Service, not in the app.

5. Artificial Intelligence

The Service uses OpenAI's API through a Cloudflare Worker. The described implementation uses the gpt-4o-mini model, but models and implementation details may change.

Depending on the feature, information sent to OpenAI may include:

• A photo submitted for note scanning
• Terms and notes written alongside terms
• Term lists used to generate study materials or incorrect multiple-choice choices
• Answers and correct definitions used for grading or explanations
• Terms studied and information about recall or mastery used to generate study summaries

We send content to OpenAI only as needed to provide the requested AI feature. Our server is intended not to log the content of AI requests. A successful call does store the token counts OpenAI returns and which feature made the call. You should not submit highly sensitive information that is unnecessary for studying.

OpenAI states that API data is not used to train or improve its models unless the customer explicitly opts in. OpenAI's API data controls also describe abuse-monitoring logs that may contain prompts and responses and are generally retained for up to 30 days, subject to exceptions and the applicable configuration.

We do not sell your study content or use it to train our own AI model. If you withdraw consent for future AI processing, this does not undo processing already completed or automatically delete information already transmitted to a provider.

Only a successful AI call is intended to count toward the monthly quota. The quota resets at the beginning of each calendar month in UTC.

6. Third-Party Services

The Service relies on several third-party providers. The app and the website connect to our server over HTTPS.

Firebase / Google

Firebase is used for account authentication. Depending on your sign-in method, authentication may involve email and password, Google, or Apple.

Firebase handles account authentication and password storage. We do not store your password.

When you use Google sign-in, Google may provide your email and profile information.

When you use Apple sign-in, Apple may provide your email and name. Apple may also hide your real email address and may only provide your name during the first sign-in.

Password-reset emails are handled through Firebase. If an address has no account, the app tells you so.

Cloudflare

Cloudflare provides infrastructure for the website, API, and database.

Cloudflare hosts or processes information including account data, notes, and study sessions.

Cloudflare may also receive ordinary technical request information through its infrastructure and logs.

The Service does not intentionally store your IP address as part of your account record.

OpenAI

OpenAI provides the AI processing used by the Service. Information sent to OpenAI can include the study content described under Artificial Intelligence.

Stripe

Stripe processes payments for website subscriptions.

Stripe may receive information such as your email address and payment-card information.

The Service does not receive or store your full card number.

Stripe may retain its own records after your bharris.app account is deleted.

Apple and RevenueCat

An older App Store subscription may be checked through RevenueCat.

RevenueCat receives the account ID used to associate that subscription with your bharris.app account.

The current paywall does not sell a new App Store subscription. New purchases use Stripe.

7. Cookies

The website uses a small number of cookies. The iPhone application does not use these website cookies. The website shows a notice where you can accept or decline.

bharris_cookie

This cookie stores only whether you accepted or declined the website cookie notice. It lasts for 180 days, so the notice stays closed.

bharris_plan

This cookie is written only if you accept the cookie notice. It lasts until you sign out or close the browser. Declining deletes it. Signing out clears it. It may contain:

• Your account ID
• An internal plan code: solo, partner, or guest. A friend's seat is stored as guest and shown as Partner study.
• Whether the tier is free or paid
• For a Partner study owner, the private partner code and whether a friend has redeemed it
• A flag if your free week has ended

It does not contain your name, email address, notes, photos, or payment-card information.

There are no advertising or analytics cookies. If you decline, the site does not remember your plan between pages and checks it when a page needs it.

8. Local Storage and Device Data

The website and iPhone application may keep certain information locally on your device, associated with your signed-in account. Firebase also keeps its own sign-in session on the device.

Photos used for scanning are held in memory while the scan is taking place and are not normally saved to local storage.

• Your signed-in account and a cached profile
• Study sessions, note text, and panic notes
• Greeting preferences and onboarding status

Website session storage may temporarily contain the page to return to after signing in, and a development-tools unlock flag. Those values are cleared when the tab closes.

9. Reminders

Spaced Cram may provide a reminder that says "Time for your next sitting" and "Your memory needs this gap to stick." These reminders do not contain your notes.

On iPhone, the reminder is stored as a local notification on the device. On the website, the reminder only operates while the relevant browser tab remains open.

The Service does not currently use a push-notification service.

10. Data Retention

We retain information for as long as reasonably necessary to provide the Service, maintain accounts, provide study history, manage subscriptions, maintain security, or comply with legal obligations.

Completed study sessions are subject to the saved-session limit of the applicable plan. Older finished sessions may be removed when the applicable limit is reached. The active session is not counted against that limit.

Monthly AI usage information is retained to enforce monthly limits.

Certain security records, such as failed Partner study code attempts, may be retained even after account deletion.

Third-party providers may retain information according to their own policies and legal obligations.

11. Account Deletion

You may delete your account through Settings. Signing out does not delete your cloud data. When you delete your account, the Service removes or ends, as applicable:

• Your Firebase account
• Stored notes and study sessions
• On-device copies associated with the Service
• Your Stripe subscription
• A friend's Partner study access associated with your account
• Birthday, parent or guardian permission time, and the optional referral answer
• Product action counts and AI token totals stored for the account

Account deletion does not cancel an Apple App Store subscription, delete failed Partner study code-attempt records, or remove information already sent to OpenAI. It does not require Stripe to delete records it independently retains.

There is currently no full-account download feature. You can view your notes and sessions in the Service, and you can change your display name in Settings, before deleting your account.

12. Your Privacy Rights

Depending on where you live, you may have legal rights concerning your personal information. These rights may include rights to request access to, correction of, deletion of, or information about the processing of your personal information.

Users in California, the European Union, the European Economic Area, and other jurisdictions with applicable privacy laws may submit privacy requests to bharris.app@gmail.com. We will evaluate and respond to requests according to applicable law.

Deleting your account in Settings is how the data we hold is removed, with the limits in Account Deletion. We do not sell personal information, and a privacy request does not change your price or your access.

If you are in the EU or EEA, you can also complain to your local data protection authority.

13. California Privacy Information

If California privacy law applies to you, you may have rights concerning your personal information, including certain rights to know, delete, correct, or limit certain uses of information.

The Service does not sell your personal information for money. The Service does not use your information to create advertising profiles.

To submit a California privacy request, contact bharris.app@gmail.com. We may need to verify your identity before completing certain requests.

14. Children's Privacy

The Service is designed to support students, including high-school students. The Service is not intended for children under 13, and children under 13 may not create an account or use the Service.

You must be 18 or older to use the Service, or 13–17 with permission from a parent or legal guardian.

The account screen asks for a birthday before the account can be used. Anyone under 13 is stopped, and that birthday is not saved. Ages 13–17 cannot continue unless they confirm a parent or legal guardian has given permission.

If we learn that a child under 13 has provided personal information, we will take appropriate steps to stop the relevant processing and delete the information or account where required by law.

Users aged 13–17 may use the Service only with permission from a parent or legal guardian. Parents or guardians should review this Privacy Policy with the teen and understand that study material, answers, and photos submitted for scanning may be processed by our service providers, including OpenAI.

If you believe a child under 13 has provided personal information to the Service, contact bharris.app@gmail.com.

15. Data Security

We take reasonable measures to protect information used by the Service. These measures include server-side authentication, restricted access to server credentials, password hashing where applicable, and controls intended to prevent unauthorized access.

The development-tools code is stored as a hash on the server, not as the code itself. The app does not save that code.

No internet service or storage system can guarantee absolute security. You should avoid submitting sensitive information that is not necessary for studying.

16. International Data Transfers

The Service operator is located in the United States and uses service providers that may process information in the United States or other locations where those providers operate. By using the Service, you understand that your information may be processed in countries other than the country where you live, subject to applicable law and the practices of the third-party providers described in this Policy.

17. Changes to This Privacy Policy

This Privacy Policy may be updated as the Service changes.

When changes are made, the updated effective date will be shown at the top of the Policy.

If material changes are made, reasonable notice may be provided through the Service when appropriate.

Your continued use of the Service after an updated Privacy Policy becomes effective means you accept the updated Policy to the extent permitted by law.

18. Contact

For privacy questions, requests, or concerns, contact bharris.app@gmail.com.