Privacy Policy
Effective May 18, 2026 · Version policy_v1
Didactic is a personal AI tutoring service that you, the parent, use on behalf of your children. This policy explains exactly what data we collect, where it goes, and how to remove it. Plain language; no dark patterns.
Who we are
Didactic is operated by an independent developer. Contact: vlukereddy@gmail.com.
What we collect
About you, the parent:
- Email address (for sign-in)
- Password (stored only as a salted PBKDF2-SHA256 hash)
- Account creation timestamp
About each student you add:
- Display name (first name or nickname only — capped at 50 characters; please don't enter surnames)
- Grade band (e.g. K-2, 3-5, 5-8, 9-12, Adult)
- Tutoring session transcripts (the full conversation between the student and the AI tutor)
- Per-session events (concept-engagement signals, pathway validations)
- AI-generated session evaluations (rubric scores, summaries, concept mastery signals)
- Any per-subject tutoring instructions you write
We don't collect device identifiers, IP addresses (beyond what your browser sends with each request, which we don't store), location, contacts, photos, or anything from any other app.
How we use it
- To run your tutoring sessions and show you progress over time.
- To send transcripts to our AI evaluator so we can score sessions against a rubric.
- To authenticate you and your devices.
We do not use your or your child's data for advertising. We do not sell data. We have no analytics SDKs.
Third parties
We use two third-party services and no others:
- Cloudflare hosts the application, database, and file storage. Your data lives in Cloudflare's global infrastructure. See Cloudflare's privacy policy.
- Anthropic (Claude) is the AI provider. The tutor runs inside Claude (desktop, mobile, or web), and when a tutoring session ends we also send the session's transcript and concept-engagement events to Anthropic's API for evaluation. We do not pass the student's display name as a separate identifier to the evaluator, but the transcript itself may contain whatever the student or tutor said during the conversation — which is why we ask you to use a first name or nickname only. See Anthropic's privacy policy. Per Anthropic's API terms, API inputs are not used to train their models.
Where data is stored
All data is stored on Cloudflare's infrastructure. Cloudflare encrypts data at rest and in transit. We use industry-standard hashing for passwords and authentication tokens — we never store either in cleartext.
How long we keep it
- Session transcripts: retained for 1 year, then deleted.
- Session metadata and evaluations: retained for 3 years (so you can see long-term progress).
- Audit logs of administrative actions: retained for 7 years.
- Expired authentication tokens: pruned regularly.
You can also delete your entire account at any time, which removes all data immediately.
Children under 13 (COPPA)
You are the account holder. When you create an account or add a student, you affirm that you are the parent or legal guardian and consent on the student's behalf to the collection and processing described in this policy. We record the timestamp and the version of this policy you accepted.
You can review or delete any student's data at any time. You can revoke consent for a specific student by deleting them from your account, or revoke consent for the entire account by deleting your account (Settings → Delete account). We do not knowingly collect data from anyone under 13 without parental consent.
Your choices
- Access: sign in to see all stored sessions, evaluations, and progress for each student.
- Delete a student: from the app, delete the student. All their sessions, transcripts, and evaluations are permanently removed.
- Delete your account: Settings → Delete account. Everything is permanently removed within minutes — no soft-delete, no grace period.
- Email us: vlukereddy@gmail.com for any privacy question or request.
Cookies
We set one cookie: tutor_session, a signed session token used only to keep you
signed in on the website. It is HttpOnly, Secure, and
SameSite=Strict. We do not use any tracking, advertising, or analytics cookies.
Security
Passwords are stored as PBKDF2-SHA256 hashes with 100,000 iterations and a random per-user salt. OAuth and MCP tokens are stored only as SHA-256 hashes with a server-side pepper. We sign session cookies with HMAC and verify them with constant-time comparison. The platform runs over HTTPS only.
Changes to this policy
If we make material changes, we'll update the version at the top and notify you at next sign-in. Continued use after a change means you accept the updated policy.
Contact
Questions, complaints, or requests: vlukereddy@gmail.com.