Privacy Policy

Syllavo is based in Reykjavík, Iceland, and is the data controller for the personal data described in this policy. For any privacy request, question, or concern, contact us at syllavohelp@gmail.com.

• Account data: your name, email, and password (stored as a bcrypt hash, never in plain text)
• Canvas data you sync via the Chrome extension: courses, assignments, grades, rubrics, syllabi, announcements, calendar events, and uploaded course files (PDFs, slides). The extension reads this from canvas.instructure.com using your own logged-in session — we never see or store your Canvas password.
• Content you create: notes, flashcard decks, quiz attempts, and chat messages with our AI features.
• Lecture recordings and transcripts, if you choose to use the Ghost Note-Taker feature — audio is transcribed and the transcript is stored; we ask for explicit microphone/tab-capture permission before this feature activates.
• Usage data: feature usage and study activity (streaks, points, review history) used to power the product — not the content of your private notes for model training.

• Your Canvas password (we use your existing browser session, not credentials)
• Your activity on websites other than Canvas and Syllavo
• Location, financial account details, or health information
• No advertising trackers, pixels, or third-party analytics SDKs run in the app

We use a small number of trusted providers to run the service:

• AI providers — to generate flashcards, quizzes, summaries, and chat responses from your course materials. Course content and your prompts are sent to our AI provider for the single purpose of producing that response; we have not opted in to model-training programs for this data.
• Infrastructure and communications providers — cloud hosting, and account-related email or SMS notifications (only if you opt in to that channel).

Some of these providers are based in the United States. Where we transfer personal data outside the EEA, we rely on the provider's Standard Contractual Clauses or equivalent safeguards.

• Contract: processing your account and Canvas data to provide the study features you sign up for.
• Consent: microphone/tab capture for lecture recording, and SMS notifications — both opt-in and revocable at any time.
• Legitimate interest:aggregate, de-identified product analytics to improve reliability and features.

• We don't sell your data
• We don't share your data with advertisers
• We don't read your Canvas content for any purpose other than the features you actively use

If you're in the EEA/UK, you have rights under the GDPR. If you're a US student, we extend the same set of rights to everyone regardless of location:

• Access: view your account data any time in Settings.
• Export (data portability): download a full JSON export of everything we store about you from Settings → Privacy & data.
• Delete (erasure): delete your account and all associated data — notes, decks, grades, materials, recordings — immediately and irreversibly from Settings → Privacy & data. This takes effect immediately; there is no 30-day grace period.
• Rectification: correct inaccurate account data in Settings, or by emailing us.
• Withdraw consent: turn off lecture recording or SMS notifications at any time without affecting other features.
• Complain: EEA/UK users may lodge a complaint with their local data protection authority — for Iceland, the Icelandic Data Protection Authority (Persónuvernd).

For anything not self-serviceable in Settings, email syllavohelp@gmail.com and we'll respond within 30 days.

• We keep your account data for as long as your account is active, plus a reasonable period to comply with any applicable legal obligations.
• Deleting your account removes your account data and all directly associated content immediately — this is a hard delete, not a soft/recoverable one.
• Synced Canvas content (course materials, assignments) tied only to a course, not to an individual, may persist for other enrolled users until the course itself is removed.

Syllavo is intended for use by college and university students, generally 18 or older. We don't knowingly collect data from children under 13, and the service is not directed at them. Because Canvas data may include records covered by FERPA (in the US) or equivalent education-records law elsewhere, you should only connect Syllavo to Canvas using your own student account, and only sync materials you have the right to access.

• All connections use HTTPS/TLS encryption
• Passwords are hashed with bcrypt (12 rounds) — we never store plain-text passwords
• Database access is restricted to authenticated backend services
• No system is perfectly secure; we review and improve security as the product matures