Privacy Policy

Last updated: July 12, 2026

1. What we collect

Account data (email, name), the study material you upload, the study artifacts generated from it (chat history, flashcards, quiz attempts, notes), and standard technical logs. Payment card details are handled entirely by Dodo Payments; we never see or store your card number.

2. How your material is used

Your uploads exist to serve you and only you. They are stored in a private bucket, isolated per-account with row-level security, and are processed by Google's Gemini API to extract text, build embeddings, and generate your study aids. We do not use your material to train models, we do not sell it, and no other Thaxas user can ever retrieve it.

3. Processors we rely on

Supabase (database, authentication, file storage), Google Gemini API (AI processing), Dodo Payments (payments, as merchant of record), and Vercel (hosting). Each receives only what it needs to do its job.

4. Retention and deletion

Your data is kept while your account exists. Deleting a space moves it to trash for 30 days, then it is permanently removed. Deleting your account removes everything — uploads, embeddings, history — immediately and irreversibly. You can export your data from settings first.

5. Cookies

We use only the session cookies required to keep you signed in. No advertising trackers, no third-party analytics cookies.

6. Your rights

You can access, export, correct, or delete your data from settings, or by emailing privacy@thaxas.com. Depending on where you live you may have additional rights (GDPR, CCPA); we honour reasonable requests regardless of jurisdiction.

7. Security

All traffic is encrypted in transit, storage is encrypted at rest, access to your rows is enforced by database-level policies, and file access uses short-lived signed URLs. No system is perfectly secure; if a breach affects you, we will notify you without undue delay.

8. Contact

privacy@thaxas.com