Privacy policy

School Pack is a product of O.B. Holdings LLC, a limited liability company organized under the laws of the Commonwealth of Pennsylvania. When this policy says “we,” “us,” or “School Pack,” it refers to O.B. Holdings LLC operating the School Pack service.

For data protection purposes, O.B. Holdings LLC is the data controller of personal information collected through School Pack. You can reach us at the contact at the bottom of this page.

This policy applies to the School Pack marketing site, the authenticated studio web app, our backend API, and the School Pack browser extension (the Canvas companion). It does not apply to third-party sites linked from our pages; those have their own privacy policies, which you should read before sharing data with them.

We collect only what we need to provide the service. The categories are:

• Account data.Your email address, a password hash (we never see your plaintext password — it is hashed and stored by Supabase Auth), and any display name or avatar you choose to add.
• Google sign-in data.If you use “Continue with Google,” we receive your email address, basic profile name, and avatar URL from Google. We do not request any additional Google scopes such as Drive, Gmail, or Calendar.
• User content. Chat messages, uploaded PDFs, drawings, writing drafts, class notes, and syllabi that you create, upload, or paste into the product.
• Model inputs and outputs. Text you send to the humanizer or chat, along with the responses we generate, kept for the duration of your session and as long as you choose to retain the enclosing document.
• Technical telemetry. Request latencies, error codes, feature-use counts, and basic device information (browser family and version, operating system family). This telemetry is not linked to the content of your messages.
• Communications. Emails you send to our support addresses and any replies.

We do not collect: advertising identifiers, third-party tracking data, your location beyond what can be inferred from an IP address, browsing history outside of School Pack, or content from integrations we have not requested permission to access.

If you are in the European Economic Area or the United Kingdom, we rely on the following lawful bases:

• Performance of a contract— to create and maintain your account, run the features you use, and send service-related emails.
• Legitimate interests— to monitor product performance, diagnose outages, prevent abuse, and keep the service secure.
• Consent— for anything optional, such as marketing emails if and when we add them. You can withdraw consent at any time without affecting prior processing.

We use the data we collect to:

• Provide the features you are using and the workspace you expect.
• Personalize class memory so responses are grounded in your coursework.
• Diagnose outages and improve reliability, using telemetry that does not include your content.
• Send service notices, security alerts, and billing communications.
• Comply with legal obligations and enforce our Terms of Service.

We do not sell your personal information, do not share it for cross-context behavioral advertising, and do not train the humanizer model on user content.

We share data only with vendors that process it on our behalf under a written agreement that restricts them to the purposes we specify. Our sub-processors are:

We will post an updated list here if we add or remove a sub-processor. We do not disclose personal information to third parties for their own marketing or advertising purposes.

When you use our AI features (chat, the humanizer, document text extraction), the text you submit is processed by our model-inference subprocessor (the Inworld model router) and the model providers it routes to, solely to generate your results under processing terms. We do not sell this content, and we do not train the humanizer on it.

We may disclose information if required by law (for example, in response to a valid subpoena) or when we believe disclosure is necessary to protect the rights, property, or safety of School Pack, our users, or the public.

Your data is stored with Supabase (Postgres and object storage) in the United States and processed by our API on virtual servers hosted by Hetzner in the United States. All traffic between you and our systems is encrypted in transit using TLS. Data at rest is encrypted by our cloud providers using industry-standard AES-256 encryption.

Every table that holds user-scoped data in our database has Postgres row-level security enabled, which means a request authenticated as you cannot, by design, read or modify another user’s rows. Administrative access is restricted, logged, and requires multi-factor authentication.

No system is perfectly secure. If we become aware of a breach of your personal information, we will notify you and, where required, relevant authorities in the timeframes required by law.

We keep your data only as long as we have a reason to:

• Account data and user content— for as long as your account is active, and for up to 30 days after you delete your account so we can reverse accidental deletions. After that window, data is removed from primary storage and expires from backups on the same cycle.
• Technical telemetry— up to 90 days in detailed form, then aggregated without identifiers.
• Support communications— as long as needed to resolve your request and for a reasonable period afterwards for record-keeping.
• Legal obligations— where a longer retention period is required by law (tax, audit, dispute resolution), we keep the minimum data necessary for that purpose.

Depending on where you live, you may have the right to access, correct, delete, export, or restrict processing of your personal information, and the right to object to certain uses. Specifically:

• Access and portability. Request a copy of the data we hold about you in a machine-readable format.
• Correction. Update account information at /settings/account or ask us to correct it.
• Deletion. Delete your account from /settings/account. Deletion cascades to your files, chats, drafts, and class memory within 30 days.
• Objection and restriction. Ask us to stop or limit certain processing.
• Withdraw consent. Where we rely on consent, you can withdraw it at any time.
• Lodge a complaint.You may contact your local data protection authority; we’d appreciate the chance to address the issue first.

To exercise a right, email us at the address below. We will respond within 30 days. We may need to verify your identity before acting on a request.

School Pack is operated from the United States. If you use the service from outside the United States, your information will be transferred to, stored, and processed in the United States and in other countries where our sub-processors operate.

For transfers of personal data out of the European Economic Area, the United Kingdom, or Switzerland, we rely on Standard Contractual Clauses and, where available, the EU—U.S. Data Privacy Framework and its UK Extension.

We use a small number of first-party cookies and browser storage items to make the service work:

• Supabase session cookies— keep you signed in across requests.
• Theme preference— remembers whether you chose light or dark mode.

We do not use advertising cookies, cross-site tracking cookies, or third-party analytics cookies today. If that changes, we will update this section and, where required, ask for your consent before setting them.

School Pack is intended for users aged 13 and older. In jurisdictions with a higher digital-consent age (for example, 16 in parts of the European Economic Area), the higher threshold applies. We do not knowingly collect personal information from children below the relevant age. If you believe we have, contact us and we will delete it.

Our humanizer and chat features generate text using machine learning models. These features assist with writing and do not make decisions with legal or similarly significant effects about you. You control when and how model outputs are used in your work, and you are responsible for reviewing any output before submitting it elsewhere.

The School Pack browser extension is an optional companion that runs only on Canvas pages (*.instructure.com) and the School Pack site. It is not active anywhere else on the web.

When you connect a class and choose what to sync, the extension reads the following data from your logged-in Canvas session and sends it to your own School Pack account: course files and documents, announcements, grades, assignments and due dates, calendar events, and related course material (syllabus, wiki pages, and module outlines). Each of these is an independent opt-in. Nothing is read, stored, or transmitted until you start a sync or enable auto-sync, and you can turn any data type off at any time. Turning a type off stops the extension from fetching, storing, or sending that data and clears its local copy.

The extension signs you in directly with Supabase (our authentication provider) and sends synced data only to our backend API for storage in your account. It keeps your sign-in session and sync preferences in your browser’s local extension storage so you stay signed in and your settings persist. It does not read your browsing history, your other tabs, or any site other than Canvas and School Pack, and it contains no advertising or third-party tracking.

Data synced through the extension is treated as your user content under this policy, including the sharing, retention, and your rights sections above. Uninstalling the extension removes its locally stored data; to delete data already synced to your account, use the deletion controls described in section 9.

If you use the browser extension to sync Canvas data, some of that data (such as grades, assignments, and coursework) may be an “education record” under the U.S. Family Educational Rights and Privacy Act (FERPA) and similar state laws.

You import this data yourself, from your own Canvas account, at your own direction. School Pack is not your educational institution and does not act on its behalf. FERPA places obligations on schools, not on a tool you choose to use with your own records. We handle this data the same way we handle your other content under this policy: we use it only to provide the features you enable, we do not sell it or share it for advertising, and you can delete it at any time. If a school formally engages School Pack as a service provider, a separate institutional agreement governs that use.

We will post any changes on this page with an updated effective date. For material changes, we will notify you through the studio or by email before the change takes effect. Continuing to use the service after a change takes effect means you agree to the updated policy.