Privacy & student data

What Nutshell collects

Account details include your email, profile name, handle and sign-in information. Your study data can include courses, chapters, notes, uploaded files, extracted text, tasks, exams, calendar entries, flashcards, AI conversations and saved focus sessions.

We also process subscription status, credit usage, technical errors and basic product activity. Avoid uploading other students’ personal information, confidential records or material you do not have permission to use.

How your data is used

We use account and study data to sign you in, save your work, run study tools, display your progress and provide features you request. Billing records enforce your plan and AI credit allowance. Technical records help investigate failures and protect accounts.

Nutshell is a study companion. Its progress indicators and AI feedback are not official academic assessments.

Uploads and AI answers

When you request an AI feature, your prompt, relevant study content and sometimes recent conversation context are sent to the configured AI provider. Document extraction can also send pages or images to an AI service when ordinary text extraction is insufficient, including for scanned or handwritten material.

The current integration uses OpenRouter and its selected model providers, with Google Gemini available for some processing and fallbacks. The provider and model can vary by feature, account configuration and availability. These services have their own processing and retention terms. This draft does not promise zero retention or that every provider excludes data from training.

AI can misunderstand text and handwriting or give an incorrect answer. Check important answers against your source. You do not need to upload identifying or sensitive information to ask a study question.

What friends and room members see

Accepted friends can see your profile name, focus activity and aggregate saved focus time for the last seven days on the circle leaderboard. The leaderboard is not public and does not show your subjects, individual session records, notes, uploaded materials or AI messages.

Room members can see the room title, goal, member names, presence and shared timer. A room invitation link or QR code grants an opportunity to join; keep it within the intended group. Room links expire and can be revoked before use. A friend QR code opens a friend request form; it does not automatically create a friendship.

Usage analytics and browser storage

Nutshell records first-party page views and feature events such as starting focus, saving a session, creating a course, using the tour and opening a calendar link. Events include an account identifier, page path, time, visit identifier and limited event properties. They help measure feature use and return visits; they are not anonymous statistics at collection time.

The event logger is designed not to include note bodies, uploaded text or chat messages. Authentication uses cookies. Local browser storage also keeps preferences and session state, such as theme, timer, tour progress and chat panel size. Clearing browser storage can reset those preferences.

Services that process data

Supabase provides authentication and database storage. Cloudflare R2 stores uploaded files. Vercel hosts the application. Stripe handles checkout and payment details; Nutshell stores subscription references and status rather than full card details. AI processing is described above.

Optional Google integrations process calendar information or files you choose to connect. Embedded music can contact YouTube or other audio providers when loaded. These services may process technical information such as your IP address. Their locations and terms can differ from yours; the final policy must document applicable international-transfer arrangements.

Calendar links are private access links

A calendar subscription link lets anyone holding it read the schedule included in that feed. Do not post it publicly. Resetting the link in Settings stops future access through the old link, but cannot erase copies already imported by another calendar app. Calendar providers choose when to refresh their copies.

Your choices and data requests

You can edit your profile and study records, choose which files to upload, use study features without starting an AI request, and manage calendar connections in Settings. Keep your account credentials and private invitation or calendar links secure.

You may have rights to access, correct, export, delete or restrict use of personal information, depending on where you live. A dedicated privacy contact and request process still need to be confirmed for this draft. There is currently no complete self-service account export or account deletion flow; deleting a study item is not the same as deleting your account.

Retention and security

Study records are stored so you can return to them. Removing a visible item does not necessarily erase backup copies, provider records, technical logs or related data immediately. A documented retention and deletion schedule is still required; this draft does not claim an automatic expiry that the application has not implemented.

Account access controls and private storage help protect your work, but no online service can guarantee perfect security. Only share information you are comfortable processing through the study services described here.

Younger students and policy updates

If you are a younger student, ask a parent or guardian before sharing personal information or buying a subscription. The service’s minimum age, parental-consent process and regional eligibility rules still need confirmation before this policy is finalized.

Material changes to data use should be explained before they take effect. This page shows its revision date so you can identify which draft you are reading.