Privacy policy

School-Pack is a product of O.B. Holdings LLC, a limited liability company organized under the laws of the Commonwealth of Pennsylvania. When this policy says “we,” “us,” or “School-Pack,” it refers to O.B. Holdings LLC operating the School-Pack service.

For data protection purposes, O.B. Holdings LLC is the data controller of personal information collected through School-Pack. You can reach us at the contact at the bottom of this page.

This policy applies to the School-Pack marketing site, the authenticated studio web app, and our backend API. It does not apply to third-party sites linked from our pages; those have their own privacy policies, which you should read before sharing data with them.

We collect only what we need to provide the service. The categories are:

• Account data.Your email address, a password hash (we never see your plaintext password — it is hashed and stored by Supabase Auth), and any display name or avatar you choose to add.
• Google sign-in data.If you use “Continue with Google,” we receive your email address, basic profile name, and avatar URL from Google. We do not request any additional Google scopes such as Drive, Gmail, or Calendar.
• User content. Chat messages, uploaded PDFs, drawings, writing drafts, class notes, and syllabi that you create, upload, or paste into the product.
• Model inputs and outputs. Text you send to the humanizer or chat, along with the responses we generate, kept for the duration of your session and as long as you choose to retain the enclosing document.
• Technical telemetry. Request latencies, error codes, feature-use counts, and basic device information (browser family and version, operating system family). This telemetry is not linked to the content of your messages.
• Communications. Emails you send to our support addresses and any replies.

We do not collect: advertising identifiers, third-party tracking data, your location beyond what can be inferred from an IP address, browsing history outside of School-Pack, or content from integrations we have not requested permission to access.

If you are in the European Economic Area or the United Kingdom, we rely on the following lawful bases:

• Performance of a contract— to create and maintain your account, run the features you use, and send service-related emails.
• Legitimate interests— to monitor product performance, diagnose outages, prevent abuse, and keep the service secure.
• Consent— for anything optional, such as marketing emails if and when we add them. You can withdraw consent at any time without affecting prior processing.

We use the data we collect to:

• Provide the features you are using and the workspace you expect.
• Personalize class memory so responses are grounded in your coursework.
• Diagnose outages and improve reliability, using telemetry that does not include your content.
• Send service notices, security alerts, and billing communications.
• Comply with legal obligations and enforce our Terms of Service.

We do not sell your personal information, do not share it for cross-context behavioral advertising, and do not train the humanizer model on user content.

We share data only with vendors that process it on our behalf under a written agreement that restricts them to the purposes we specify. Our sub-processors are:

We will post an updated list here if we add or remove a sub-processor. We do not disclose personal information to third parties for their own marketing or advertising purposes.

We may disclose information if required by law (for example, in response to a valid subpoena) or when we believe disclosure is necessary to protect the rights, property, or safety of School-Pack, our users, or the public.

Your data is stored with Supabase (Postgres and object storage) in the United States and processed by our API on Google Cloud Platform. All traffic between you and our systems is encrypted in transit using TLS. Data at rest is encrypted by our cloud providers using industry-standard AES-256 encryption.

Every table that holds user-scoped data in our database has Postgres row-level security enabled, which means a request authenticated as you cannot, by design, read or modify another user’s rows. Administrative access is restricted, logged, and requires multi-factor authentication.

No system is perfectly secure. If we become aware of a breach of your personal information, we will notify you and, where required, relevant authorities in the timeframes required by law.

We keep your data only as long as we have a reason to:

• Account data and user content— for as long as your account is active, and for up to 30 days after you delete your account so we can reverse accidental deletions. After that window, data is removed from primary storage and expires from backups on the same cycle.
• Technical telemetry— up to 90 days in detailed form, then aggregated without identifiers.
• Support communications— as long as needed to resolve your request and for a reasonable period afterwards for record-keeping.
• Legal obligations— where a longer retention period is required by law (tax, audit, dispute resolution), we keep the minimum data necessary for that purpose.

Depending on where you live, you may have the right to access, correct, delete, export, or restrict processing of your personal information, and the right to object to certain uses. Specifically:

• Access and portability. Request a copy of the data we hold about you in a machine-readable format.
• Correction. Update account information at /settings/account or ask us to correct it.
• Deletion. Delete your account from /settings/account. Deletion cascades to your files, chats, drafts, and class memory within 30 days.
• Objection and restriction. Ask us to stop or limit certain processing.
• Withdraw consent. Where we rely on consent, you can withdraw it at any time.
• Lodge a complaint.You may contact your local data protection authority; we’d appreciate the chance to address the issue first.

To exercise a right, email us at the address below. We will respond within 30 days. We may need to verify your identity before acting on a request.

School-Pack is operated from the United States. If you use the service from outside the United States, your information will be transferred to, stored, and processed in the United States and in other countries where our sub-processors operate.

For transfers of personal data out of the European Economic Area, the United Kingdom, or Switzerland, we rely on Standard Contractual Clauses and, where available, the EU—U.S. Data Privacy Framework and its UK Extension.

We use a small number of first-party cookies and browser storage items to make the service work:

• Supabase session cookies— keep you signed in across requests.
• Theme preference— remembers whether you chose light or dark mode.

We do not use advertising cookies, cross-site tracking cookies, or third-party analytics cookies today. If that changes, we will update this section and, where required, ask for your consent before setting them.

School-Pack is intended for users aged 13 and older. In jurisdictions with a higher digital-consent age (for example, 16 in parts of the European Economic Area), the higher threshold applies. We do not knowingly collect personal information from children below the relevant age. If you believe we have, contact us and we will delete it.

Our humanizer and chat features generate text using machine learning models. These features assist with writing and do not make decisions with legal or similarly significant effects about you. You control when and how model outputs are used in your work, and you are responsible for reviewing any output before submitting it elsewhere.

We will post any changes on this page with an updated effective date. For material changes, we will notify you through the studio or by email before the change takes effect. Continuing to use the service after a change takes effect means you agree to the updated policy.