Privacy Policy

Account information: name, email, profile image, provider account identifiers, sign-in sessions, plan, legal-document acceptance, and account status. Sumichi does not receive your provider password. Your date of birth, asked once when you agree to the terms, to confirm you're old enough to use Sumichi and to apply protections for students under 18. It isn't shown to other users.

Your work: uploads, extracted text, notes, notebooks, study kits, mind maps, questions, flashcards, planner and class data, review history, progress, collaboration records, shared content, forum posts, feedback, reports you submit, and the people you block.

Sumichi STEM practice: Sumichi STEM saves your practice (what you drew, what you got right, and the hints you used) to plan your reviews and show your progress. We count common mistakes across all students, with no names attached. Your practice goes to the AI tutor only when you ask it for help. Deleting your account deletes it.

Service information: feature usage, AI model and token counts, estimated cost, operational events, error and security logs, timezone, notification preferences, and first-touch campaign information when present. Sumichi does not use third-party advertising trackers. Page visits are counted with Vercel Web Analytics, which records the approximate country from the network address, without cookies or cross-site tracking.

• provide, sync, personalize, export, and secure your account and work;
• generate the AI-assisted material you request;
• operate collaboration, school, community, and sharing features;
• enforce plan limits, prevent abuse, and maintain service reliability;
• respond to feedback, support requests, reports, and appeals;
• process billing when paid plans are enabled; and
• comply with law and protect users, Sumichi, and third-party rights.

When you request an AI feature, the content needed for that request is sent to an API service operated by Google, OpenAI, or Anthropic, depending on the model or feature. Audio, images, and documents may also be extracted or transcribed through those provider services.

Sumichi does not use your content to train its own general-purpose model, and Sumichi uses these providers only under paid API terms that do not permit training on your content. Avoid submitting information that is unnecessary for your study task.

Before your account's first AI request, Sumichi asks for your permission. Nothing is sent to these providers until you allow it, and you can turn AI features off in Profile at any time.

Sumichi uses vendors to provide authentication, hosting, databases, file storage, AI processing, email delivery, and payment processing. Current subprocessors: Vercel (hosting, edge network, file storage), Neon (database), Google Gemini API (paid tier — AI processing), OpenAI API (paid tier — AI processing, when enabled), Anthropic API (paid tier — AI processing, when enabled), your OAuth identity provider (Google, GitHub, Apple, or Microsoft), Resend (email), and, when billing is enabled, Stripe (payments). Each receives only information reasonably needed for its role.

Information may also be disclosed when you direct Sumichi to share it, when required by law, or when reasonably necessary to investigate fraud, abuse, security threats, or violations of rights. Sumichi does not sell or rent personal information and does not disclose it for targeted advertising.

Notes and study content are private by default and selected with owner-scoped database queries. Administrators do not have an ordinary interface for browsing private notes, impersonating users, or reading arbitrary accounts.

When you create a public link, publish to a gallery or school library, invite a collaborator, or post in a forum, the selected information is shown to that audience. Public or shared content may be reported and reviewed by moderators. Revoking access does not erase copies another person already exported, screenshotted, or lawfully forked.

You can connect an AI app you already use, such as Claude, ChatGPT or Codex, on the Connect your AI page. You sign in to Sumichi and choose Allow: the app never sees your Sumichi password.

A connected app can see the names of your classes and decks. It can add notes, flashcard decks and practice questions to your account. It can't read, change, share or delete anything already there.

What it sends is stored like anything you write in Sumichi: private to you, kept until you delete it, and deleted with your account. Sumichi records which app sent each item and when, to show you what each app sent and to count how the feature is used. What you say to the app itself is covered by that app's own privacy policy.

Disconnect it on the Connect your AI page at any time, and it stops working at once. What it already added stays until you delete it.

Moderators can review reports about public or shared kits, forum content, reviews, and comments; remove or delist that content; and suspend or reinstate accounts. A reported comment is shown to moderators with its author, even when it is on a private kit, notebook, or study group. Moderation actions are recorded. Report records may include the reporter, reason, affected content identifier, resolution, moderator, and timestamps.

Private content is not a routine customer-support surface. Exceptional direct access should occur only when narrowly necessary for a user-requested support case, security investigation, or legal obligation, with authorization and an audit record.

Active account information and work are retained while your account exists. Shorter-lived operational logs, temporary provider files, and cached device copies follow their operational retention periods. Safety, moderation, transaction, and legal records may be retained as reasonably needed to prevent abuse, resolve disputes, and meet legal obligations.

Account deletion removes your active database account and its associated content and initiates deletion of separately stored uploaded and generated files. A provider outage may delay the external-file sweep; limited backups, security logs, moderation records, and legally required records may persist until their retention period expires. Contact support if a public file remains reachable after deletion.

Notebook pages you open may be cached in your browser for offline editing. Browser data remains on that device until the browser, app, or device removes it; signing out does not necessarily erase every local browser cache.

• edit account and public-profile fields;
• choose what to share and revoke active links or collaborators;
• export your work without upgrading;
• manage notifications and accessibility preferences;
• cancel a paid subscription through the billing portal when enabled;
• appeal moderation at support@sumichi.app; and
• delete your account.

These account rights remain available when product participation is suspended.

Sumichi is not offered to children under 13, and we do not knowingly create accounts for them. If you believe a child under that age has provided personal information, contact support so the account can be reviewed and removed. School use may require additional agreements and consent before Sumichi can support younger students.

Sumichi uses HTTPS in transit, provider authentication, tenant-scoped data access, and restricted administrative routes. No online service can guarantee absolute security. Report suspected unauthorized access to support@sumichi.app.

Material changes will update the date and version above and may require a new acknowledgment. Questions, privacy requests, copyright/PII reports, or account concerns can be sent to support@sumichi.app.