Privacy Policy & Data Retention
Effective Date: February 20, 2026 • Last Updated: October 15, 2026
1. Introduction & Scope
At DueVinci ("we", "our", or "the Service"), we take student privacy and data security seriously. This Privacy Policy explains how information is collected, used, stored, and protected when you use the DueVinci web application at duevinci.tech.
By using DueVinci, you consent to the practices described in this policy. We do not sell your personal data to third parties or use student coursework for behavioral advertising.
2. Information We Collect
A. Account & Authentication Data
When you register or sign in, we collect your email address and authentication credentials managed securely through Supabase Auth (including WebAuthn/Passkey public key credentials where enabled). You may also provide a display name and an optional profile photo.
B. Student Academic Content
We store the academic records you explicitly enter, including: course names, term folders, assignment titles, due dates, completion statuses, grade percentages, custom calendar events, and study notes/scratchpads. Flashcard review progress (such as repetitions and next review dates) is stored on this device and synced to your account when you are online so it can follow you across devices. If you use the optional Nursing Hub, its workspace can include rotation dates and skill status, fictional care-plan drafts, dosage-practice progress, custom flashcards, and anatomy review progress. Do not enter real patient information into the Nursing Hub, including information that could identify a patient.
C. AI Processing Inputs
When you use syllabus parsing or the Socratic Study Companion, we send the minimum input needed to provide that feature through a secure server-side Supabase Edge Function to Google Gemini. This can include syllabus text or images, your Tutor question and recent session context, and—when you select a course—its description, objectives, notes, and a limited set of assignments. DueVinci does not store Tutor conversations, but stores account-level request counts to enforce usage limits. DueVinci does not use this content to train its own models. Google’s handling of API prompts and responses depends on the applicable Gemini service tier and terms; do not submit highly sensitive personal information to AI features.
D. Preferences and Nursing Hub Workspace
UI settings such as your active theme, preferred date format, calendar week start, timer audio profiles, workspace visibility, dashboard layout, and Pomodoro durations are cached in browser storage. Nursing Hub workspace data is also stored in browser storage and, for signed-in users, synchronizes while online through the protected Supabase user_preferences record associated with your account. The same record can sync preferences across your devices. The database applies account-level row access controls.
E. Connected Services & Subscription Data
If you connect Canvas, we process your Canvas instance address and access token to retrieve the coursework you request; the token is stored encrypted server-side and is removed when you disconnect or delete your account. If you subscribe, Stripe processes payment details. DueVinci stores subscription status and Stripe customer or subscription identifiers, but not full payment-card numbers. If you enable browser reminders, a browser push subscription endpoint and its keys may be stored so notices can be delivered.
3. How We Use Your Information
- To render your personal dashboard, courses, grade simulator, and calendar timeline.
- To compute cumulative GPA, course completion percentages, and 7-day workload distributions.
- To authenticate your session securely across multiple devices.
- To deliver syllabus parsing and the Socratic Study Companion through Google Gemini APIs.
- To calculate the Daily Brief from your own coursework and calendar records, and to meter Tutor requests against your plan allowance.
- To save and display optional Nursing Hub rotation tracking and educational practice progress that you choose to enter.
- To connect and import the Canvas coursework you expressly authorize.
- To administer trials, subscriptions, billing support, and browser reminders when you enable them.
- To provide customer support when you reach out via our support channels.
4. Data Retention & Storage Policy
We maintain strict data retention standards to ensure you remain in complete control of your academic data:
| Data Category | Retention Period | Storage Location |
|---|---|---|
| Account & Profile | Retained until account deletion requested | Supabase (PostgreSQL with RLS) |
| Coursework, Grades & Flashcard Mastery | Cloud copy until the course or account is deleted; each browser copy remains until app or browser storage is cleared | Supabase DB + account-scoped browser localStorage |
| Optional Nursing Hub Workspace | Cloud copy until account deletion; browser copy remains until app or browser storage is cleared | Supabase account preference record + browser localStorage |
| Uploaded Syllabus Files | Parsed ephemerally in memory; raw files are not permanently stored | Edge Function Memory (Ephemeral) |
| Tutor Session Content | Held in the browser for the active session; DueVinci does not provide chat-history storage | Browser memory; processed by Google Gemini when sent |
| Canvas Connection | Until you disconnect it or delete your account | Encrypted server-side connection record |
| Subscription & Push Data | While needed to provide the service, subject to legal or provider retention obligations | Supabase profile records; Stripe and browser push providers |
| Tutor Usage Counts | Deleted within 12 months of the last request or when the account is removed | Supabase (account-scoped usage table) |
| UI Preferences | Persistent until changed, account deletion, or browser-data clearing | Protected preference record + browser cache |
| Support Tickets | Resolved or closed tickets are deleted 90 days after resolution | Supabase (PostgreSQL with RLS) |
| Browser Error Reports | Deleted automatically after 90 days | Supabase (restricted diagnostic table) |
5. Account Deletion & Right to Be Forgotten
You have the right to permanently purge your account and all associated data at any time. DueVinci provides an automated, self-service Delete Account & Purge Data option inside the Settings modal.
What account deletion does:
When you confirm account deletion, DueVinci cancels outstanding subscriptions, removes the account, primary academic records, support tickets, error reports, flashcard progress, Nursing Hub workspace data, Tutor usage counts, stored Canvas connection, and profile photo, and clears local app storage on the browser where deletion is requested. An offline copy on another device cannot be cleared remotely; clear DueVinci site data on that device as well. Limited records held by payment, email, AI, or infrastructure providers may remain subject to their own policies and applicable legal obligations.
6. Security & Encryption Practices
We employ industry-standard administrative, physical, and technical safeguards:
- Transport Layer Security (TLS/HTTPS): All network traffic between your client browser and our servers is encrypted with modern TLS ciphers.
- Row Level Security (RLS): Database tables enforce PostgreSQL RLS policies ensuring users can only read and mutate records matching their authenticated UUID.
- Protected API Gateways: Gemini API keys are isolated within server-side Supabase Vault secrets and are never exposed in client bundles.
- Private Credentials: Canvas access tokens are encrypted before storage and profile photos are protected by per-user access controls.
7. Third-Party Service Providers
DueVinci utilizes trusted cloud infrastructure partners solely to operate the service:
- Supabase Inc.: Database hosting, user authentication, and serverless Edge Functions.
- Google Cloud (Gemini API): Natural language and optical document processing for syllabus parsing.
- Stripe: Payment processing and subscription management; payment-card information is handled by Stripe.
- Canvas LMS instances selected by you: Coursework retrieval using the access token you provide.
- Resend: Delivery of support emails when you submit a support request.
8. Your Choices, Rights & Contact
You can update much of your account information in Settings, disconnect Canvas, export your data, or delete your account. To request access, correction, deletion, or information about how your data is handled, contact support@duevinci.tech. We may need to verify your request before acting on it.