Privacy Policy

OCHA (“OCHA,” “we,” “us,” or “our”) operates the OCHA web application, a zen student productivity platform that helps students aggregate assignments from school systems, ingest syllabi, and plan their study schedules with AI assistance.

This Privacy Policy explains what information we collect when you use OCHA, how we use it, who we share it with, and the choices and rights you have. If anything here is unclear, contact us at harryjiang14@crescentschool.org.

[TODO: Replace “OCHA” with the registered legal entity name (or individual name if operated as a sole proprietorship) before publishing.]

We collect the following categories of information:

Account information

• Email address
• Display name and username
• Profile picture (from Google OAuth, if used)
• Authentication identifiers (Supabase user ID, OAuth provider tokens including Google access and refresh tokens)
• Password (stored hashed by our authentication provider, Supabase)

Profile and preference data

• Optional bio, major, and year of study
• Scheduling preferences (preferred work hours, average task durations, productivity coefficients)

Task and scheduling data

• Tasks you create or that we import from connected services, including task name, course, due date, duration, type, status, and preparedness rating
• Scheduled study blocks and calendar entries

Uploaded documents

• Files you upload for AI processing (PDFs, images, text, markdown, CSV, JSON) up to 4.5 MB per file
• Text extracted from those files (for example, the parsed text of a syllabus PDF)
• File metadata: filename, MIME type, size, and the Supabase Storage path where the file is held

AI chat content

• Your messages to the AI assistant and the assistant’s responses
• Tool calls made by the assistant on your behalf (for example, reading your task list, scheduling a block, or looking up an upcoming deadline)
• AI-extracted memory about your preferences, patterns, struggles, and goals to personalize future conversations

Data from connected services

• Google Classroom: your courses, coursework, assignments, and roster entries
• Google Drive: files you explicitly select for OCHA to read
• Google Calendar: calendar events you grant us read or write access to
• Schoology: courses, assignments, and related metadata

Usage, device, and diagnostic data

• Pages visited, features used, clicks, and events, collected via PostHog for product analytics
• IP address, browser type, device type, operating system, and approximate location (derived from IP)
• Crash reports, error stack traces, and diagnostic logs collected via Sentry
• Performance and request logs collected by our hosting provider, Vercel

Payment information

• If you subscribe to a paid plan, payment is processed by Stripe. Stripe receives your card details directly; we do not see or store raw card data.
• We receive and store your subscription status, plan, and Stripe customer ID.

OCHA’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We request the following Google OAuth scopes, each for a specific purpose:

• Basic profile (email, name, picture) — to create and identify your OCHA account.
• Google Classroom (courses, coursework, rosters) — to import your assignments and due dates so you do not have to re-enter them.
• Google Drive (read) — to read syllabi and documents that you explicitly select so the AI can extract deadlines and requirements.
• Google Calendar (read/write) — to read existing events (so we do not double-book you) and, with your permission, to add study blocks to your calendar.

Consistent with Google’s Limited Use policy, we commit that Google user data obtained through these scopes:

• Is used only to provide or improve the user-facing features described above;
• Is not sold to any third party;
• Is not used for advertising, including personalized or retargeted ads;
• Is not used to train generalized AI or machine-learning models. When we send content to AI providers (see Section 6), we rely on those providers’ commitments not to train their models on our API traffic;
• Is not accessed by humans except (a) with your explicit consent, (b) for security and abuse investigations, (c) to comply with applicable law, or (d) for internal operations in aggregated or anonymized form, and then only as required.

You can revoke OCHA’s access to your Google account at any time at https://myaccount.google.com/permissions.

We use the information we collect to:

• Provide the core scheduling, task-management, and AI chat features;
• Personalize your experience by learning your preferences and productivity patterns;
• Sync assignments and calendar data from the third-party services you connect;
• Process and store documents you upload for AI analysis;
• Operate, debug, secure, and improve OCHA;
• Respond to your support requests and legal notices;
• Detect, prevent, and respond to fraud, abuse, and security incidents;
• Comply with legal obligations and enforce our Terms of Service.

We do not sell your personal information, and we do not use it for third-party advertising.

OCHA’s AI assistant is powered by third-party large language models. To answer your questions, we send the following to the AI provider:

• The messages you type into the AI chat;
• Relevant context pulled from your tasks, memory, and connected services;
• Text extracted from documents you upload (for example, parsed syllabus content);
• Tool-call results the assistant needs to answer you.

Our AI providers are:

• OpenAI — our primary model provider, used for GPT-4o and GPT-4o-mini.
• Zhipu AI (GLM / ZAI) — a fallback provider used if our primary provider is unavailable. When we fall back, the same message content is sent to Zhipu AI’s API.

Each provider processes your data under its own privacy policy and data-processing terms. Under OpenAI’s API terms, data submitted through the API is not used to train OpenAI’s models by default. We do not opt in to any provider training program that would use your content.

We want you to know this in plain language: authorized members of the OCHA team can view stored AI conversations, AI-extracted memory, and uploaded documents associated with your account.

We do this only for the following purposes:

• Debugging and product improvement — diagnosing issues, fixing bugs, and making the assistant more helpful;
• Safety and abuse investigations — investigating reports of misuse, harmful content, or security incidents;
• Legal compliance — responding to lawful requests from courts or regulators.

We will never:

• Sell, rent, or trade your chats or AI memory;
• Use your chats for advertising, retargeting, or building profiles for marketing;
• Publish or share your chats outside the narrow purposes listed above;
• Use your chat content to train generalized AI models outside the processing our AI providers perform to answer your request.

If you want to delete your conversations, you can do so from within OCHA, or email us at harryjiang14@crescentschool.org and we will remove them within 30 days.

We use the following service providers to operate OCHA. Each receives only the information needed to perform its function and is bound by contractual confidentiality and data-protection obligations.

We may also share information (a) to comply with a subpoena, court order, or other legal process; (b) to investigate and defend legal claims; (c) to protect the rights, property, or safety of OCHA, our users, or the public; or (d) in connection with a merger, acquisition, or sale of assets, in which case you will be notified before your information becomes subject to a different privacy policy.

We keep your information for as long as your account is active and for a reasonable period afterward in case you reactivate. Specifically:

• Account, profile, tasks, and chats: retained until you request deletion, after which we remove them within 30 days, except where we are required by law to retain them longer.
• Uploaded documents: retained until you delete the associated task or request deletion.
• Analytics and diagnostic logs: retained for up to 12 months, then aggregated or deleted.
• Backups: may persist in encrypted backups for up to 30 days after deletion from the primary database.

Depending on where you live, you may have the following rights regarding your personal information:

• Access — request a copy of the personal information we hold about you;
• Correction — ask us to correct inaccurate information;
• Deletion — ask us to delete your account and personal information;
• Portability — request a machine-readable export of your data;
• Withdraw consent — revoke Google or Schoology permissions at any time, and disconnect integrations from your OCHA settings;
• Object or restrict — object to or restrict certain processing activities, where applicable law allows.

To exercise any of these rights, email us at harryjiang14@crescentschool.org. We will respond within the timeframe required by applicable law, generally within 30 days.

California residents: under the California Consumer Privacy Act (CCPA/CPRA), you have the right to know what personal information we collect, the right to delete it, the right to correct it, and the right to opt out of any “sale” or “sharing.” We do not sell or share your information as those terms are defined under the CCPA.

EEA, UK, and Swiss residents: the legal bases for our processing are (a) performance of the contract to provide OCHA to you, (b) your consent for optional features such as Google integrations, (c) our legitimate interests in operating and securing OCHA, and (d) compliance with legal obligations. You have the right to lodge a complaint with your local data protection authority.

We take reasonable measures to protect your information, including:

• TLS encryption for data in transit;
• Row-level security in our Supabase database so that users can only access their own records;
• Encrypted storage of OAuth tokens;
• Access controls and audit logging for our team.

No system is 100% secure. If we become aware of a breach that materially affects your personal information, we will notify you and the relevant authorities as required by law.

OCHA is intended for students who are at least 13 years old (or 16 years old if you live in the European Economic Area, the United Kingdom, or another jurisdiction where that is the minimum age). We do not knowingly collect personal information from children under those ages.

If you are a parent or guardian and you believe your child has provided personal information to OCHA, please contact us at harryjiang14@crescentschool.org and we will delete it.

If you are between 13 and 18 (or the age of majority in your jurisdiction), please obtain your parent or guardian’s permission before using OCHA.

OCHA and most of our service providers are located in the United States. If you access OCHA from outside the United States, your information will be transferred to, stored in, and processed in the United States and other jurisdictions where our providers operate. We rely on appropriate safeguards, including standard contractual clauses where required, to protect information transferred internationally.

We use cookies and similar technologies (including browser local storage) to keep you signed in, remember your preferences, measure how OCHA is used, and diagnose errors. You can control cookies through your browser settings, but disabling them may break parts of OCHA.

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date and notify you by email or through an in-app notice before the changes take effect. Your continued use of OCHA after the effective date of the updated policy constitutes acceptance of the changes.

If you have questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact us at harryjiang14@crescentschool.org.

[TODO: Add a postal mailing address before publishing if required by applicable law.]