Privacy Policy

We collect the following types of information:

• Account Information: When you sign up, we collect your name and email address. If you sign in via Google, we receive your name, email, and profile picture from Google. We do not store your Google password.
• Academic Data: Courses, assignments, schedules, grades, attendance records, study sessions, finance records, and other academic information you enter into the platform or import from Google Classroom.
• Files You Upload: Documents, images, and other files you upload or import, including files from Google Drive via our browser extension.
• AI Conversations: Messages you send to the AI assistant and the responses generated. These are stored in your account and can be deleted at any time.
• Usage & Device Data: Browser type, operating system, IP address, pages visited, and performance metrics. On login events, we log your IP address, browser, and operating system for security purposes.
• Payment Information: If you purchase a paid plan, payment processing is handled entirely by our payment providers. We do not store your credit card or payment account details. We only receive transaction references and payment status.

We use the information we collect to:

• Provide, maintain, and improve the Service
• Personalize your experience, including AI-powered features that use your academic data as context
• Process file uploads and imports for your account
• Generate search indexes from your materials so you can find content quickly
• Send you important updates, security alerts, and optional academic digest emails
• Analyze usage patterns to improve performance and usability
• Detect and prevent fraud, abuse, and unauthorized access
• Process payments and manage subscriptions

RuntimeOS offers an optional Google Classroom integration and a companion browser extension ("RuntimeOS for Classroom") that allows you to import courses, assignments, materials, and file attachments from Google Classroom into your account.

What we access:

• Classroom metadata: Course names, assignments, materials, announcements, grades, and rosters - accessed via the Google Classroom API using read-only scopes.
• Drive file attachments: When you choose to import a file, our browser extension downloads it from Google Drive using your existing browser session. We only access files you explicitly select for import. We do not scan, index, or access any files you have not selected.

How imported files are handled:

• Imported files are stored securely in cloud storage and linked to your account.
• Files are private and only accessible through your authenticated session.
• When you delete a material or assignment, the associated files are removed from storage.

Disconnecting: You can disconnect Google Classroom at any time from your dashboard. Disconnecting revokes our access to your Classroom data. Previously imported materials remain in your account unless you delete them.

RuntimeOS includes AI-powered features such as a study assistant and smart search. When you use these features:

• AI chat: Your messages, attached files, and relevant academic context (such as course names, deadlines, and grades) may be sent to third-party AI service providers to generate responses. These providers process your data according to their own privacy policies. Data may be transferred internationally.
• Smart search: If enabled, text from your materials (including imported files) is processed to create search indexes. These indexes are stored securely and used solely to power search within your own account. They are not shared with other users.
• No model training: Your data is never used to train, improve, or fine-tune any AI models.

Your data is stored with row-level security policies ensuring that each user can only access their own data. All data is encrypted in transit via TLS. Sensitive credentials (such as Google Classroom tokens) are encrypted at rest using AES-256-GCM.

Files you upload are stored in secure cloud storage with access scoped to your user account. Uploaded files are only accessible via time-limited, signed URLs.

We implement rate limiting, CSRF protection, input validation, and content security policies to protect against common web security threats. While we strive to protect your information, no method of electronic storage is 100% secure.

We use third-party services to operate the platform. These include providers for:

• Authentication - Sign-in via email/password, magic link, or Google OAuth. When using Google sign-in, we receive your name, email, and profile picture.
• Database & file storage - Your academic data, files, and account information are stored with our infrastructure providers.
• AI processing - Chat messages and file contents are processed by third-party AI providers. Your data may be transferred internationally. These providers do not use your data for model training under our agreements.
• Payment processing - Payments are handled by third-party payment providers. We never receive or store your full payment details.
• Email delivery - Transactional emails (verification, password reset, academic digests) are sent via a third-party email provider.
• Error monitoring - We use error tracking services to identify and fix bugs. Error reports may include your IP address, browser type, and device information.
• Analytics - We collect anonymous, aggregated usage statistics and performance metrics. No cookies are used for analytics.
• Push notifications - If you enable push notifications, your browser subscription endpoint is stored to deliver notifications about deadlines and tasks.

We do not sell your personal information to third parties. We only share data with service providers who need it to operate the Service, and they are contractually obligated to protect your information.

We use cookies strictly for functional purposes:

• Authentication cookies - Secure, httpOnly cookies to maintain your login session.
• Security cookies - Short-lived cookies for CSRF protection during OAuth flows.

We do not use tracking cookies, advertising cookies, or any third-party cookies for analytics. Your browser's local storage is used to save your UI preferences (theme, layout, accessibility settings) - this data never leaves your device.

Our browser extension ("RuntimeOS for Classroom") uses your existing Google browser cookies solely to download files you select for import. The extension does not read, store, or transmit your cookies.

You can create share links for your schedule, grades, and materials. When you share content:

• Anyone with the link can view the shared content, including your display name.
• Share links expire after 90 days by default. You can deactivate them at any time.
• Shared pages are marked as non-indexable by search engines.

No data is shared publicly unless you explicitly create a share link.

RuntimeOS's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• We only request access to Google Classroom data that is necessary for the features you use (read-only course, assignment, and material metadata).
• We do not use Google user data for advertising, market research, or to build user profiles unrelated to the Service.
• We do not transfer Google user data to third parties except as necessary to provide the Service or as required by law.
• We do not use Google user data to train AI or machine learning models.

You have the right to:

• Access and review the personal data we hold about you
• Request correction of inaccurate or incomplete data
• Request deletion of your account and associated data
• Export your academic data (courses, assignments, grades, materials, and more) from within the platform
• Disconnect Google Classroom at any time
• Opt out of email digests and push notifications
• Delete individual AI conversations, materials, or any other content at any time

To exercise any of these rights, you can use the settings in your dashboard or contact us using the information below.

We retain your personal information for as long as your account is active or as needed to provide you with the Service.

If you delete your account, there is a 30-day grace period during which you can cancel the deletion. After the grace period, your account and all associated data (academic records, files, AI conversations, payment records, and activity logs) are permanently deleted.

Activity logs are automatically pruned after 90 days (180 days for authentication-related logs). Orphaned files in cloud storage are cleaned up automatically within 24 hours.

RuntimeOS is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If we discover that we have collected information from a child under 13, we will delete it promptly.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date.

We encourage you to review this policy periodically. Your continued use of the Service after changes are posted constitutes acceptance of the updated policy.

If you have any questions or concerns about this Privacy Policy, or if you wish to exercise your data rights, please contact us at:

Email: privacy@runtimeos.com

You may also refer to our Terms of Service for additional information about your use of the platform.