Privacy Policy

Last updated 18 October 2026 · draft

Who we are

NucHub (“we”), a company based in the United States, runs nuchub.app and is the controller of the personal data described here. Questions about privacy go to support@nuchub.app.

What we collect, and why

• Account details — your name, the name Ion calls you, email, a hashed password, your school, major, year and timezone. To run your account and personalise your study (contract).
• Your study material — files, recordings, links and notes you add, and what NucHub makes from them: notes, cards, questions, the concept map. To provide the service (contract).
• Your learning record — answers, reviews, confidence ratings, test results and Ion conversations. To schedule reviews, forecast readiness and teach you (contract).
• Your age group and agreement — the age group you choose at sign-up and when you agreed to these terms. To meet age rules and keep a record of consent (legal obligation).
• Payments — your plan, its status and Stripe's customer reference; Stripe holds your card and billing address. To bill you and meet tax law (contract, legal obligation).
• Abuse prevention — a normalised form of your email (so one inbox gets one free trial) and a one-way hash of the network you signed up from, kept 30 days. To stop free-account farms (legitimate interests).
• Usage and cost records — which AI task ran, how many tokens it used and what it cost, with no content. To keep the service affordable and set fair limits (legitimate interests).

We don't use your data for advertising, we don't sell it, and we don't use your files or conversations to train AI models. A question written only from public material may be shared with other students on the same exam; anything written from your own files stays yours.

Who processes it

These services process data for us, only for the job named, under contracts that require them to protect it. Optional services run only when we switch them on.

Our domain's DNS is hosted by Vercel; it handles no account data.

In oral practice, the live words shown while you speak come from your browser's built-in speech recognition. Some browsers (Chrome, Edge) send that audio to the browser maker under their own privacy terms; NucHub doesn't control or receive it. Typing your answer avoids it.

International transfers

Some processors are outside the UK and the European Economic Area. Where a country has no UK or EU adequacy decision, we rely on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum (or the UK International Data Transfer Agreement), with a transfer risk assessment and extra safeguards.

DeepSeek, in China. AI processing by DeepSeek takes place in the People's Republic of China, which has no adequacy decision from the UK or the EU. Because Chinese law can allow public authorities to access data, we limit what goes there: only the passages and text a task needs, with your email, password, payment details and account identifiers never included, and web searches stripped of names, emails and numbers. Transfers are covered by Standard Contractual Clauses and the UK Addendum, and by our transfer risk assessment. If you'd rather your files were not processed this way, don't upload them; you can delete anything you have uploaded at any time.

How long we keep it

• Lecture recordings: the audio file is deleted 30 days after upload. The transcript and everything made from it stay until you delete them.
• Photos of whiteboards and pages: the image is deleted 365 days after upload; the text read from it stays.
• Other files (slides, PDFs, documents, syllabi): until you delete them, or your account.
• Your account: until you delete it. Deletion waits 7 days in case it was a mistake (signing in cancels it), then your account, files and learning record are erased.
• Sign-in codes: valid 15 minutes and removed once used or replaced. The sign-in cookie lasts 30 days.
• The sign-up network hash: 30 days.
• Cost records of AI tasks hold no content and stay after deletion under an ID that no longer links to you.
• Payment records are kept by Stripe and by us for as long as tax law requires (usually seven years in the US, six in the UK, up to ten in some EU countries).
• Database backups roll over on a short schedule, and deleted data leaves them when they expire.

Cookies

Today NucHub uses only what it needs to work, so there is no cookie banner:

• a sign-in cookie that keeps you signed in (strictly necessary);
• a currency cookie, set only if you pick a currency on the pricing or billing page, to remember that choice;
• your theme, stored in your browser (not sent to us) so the page doesn't flash on load.

No analytics, advertising or tracking cookies. If we add analytics later, it will be off until you opt in.

Your rights

Under UK GDPR and EU GDPR you can ask to access your data, correct it, delete it, restrict or object to how we use it, and take it with you (portability). Where we rely on consent, you can withdraw it at any time.

• Do it yourself: Settings › Privacy & data exports everything as JSON or CSV, deletes all your files, and Settings › Account deletes your account.
• Ask us: email support@nuchub.app from the address on your account, saying what you want. We reply within one month (we may extend that by two months for complex requests, and we'll tell you if so). It's free.
• Complain: you can complain to the UK Information Commissioner's Office (ico.org.uk) or to the data protection authority where you live in the EU. We'd appreciate the chance to fix it first.

Children and schools

NucHub is for students aged 16 and over, or 13 and over in the United States with a parent or guardian's permission. We don't knowingly collect data from children under 13; if you think we have, write to us and we'll delete it. NucHub is a consumer service students sign up for themselves. It is not provided on behalf of a school, so we are not a “school official” under FERPA; selling to schools would come with its own data processing agreement.

Security

Passwords are hashed, sign-in is rate-limited, files are private and opened only through links that expire in minutes, and everything travels over HTTPS. No system is perfectly secure; if a breach affects you we'll tell you and the regulator as the law requires.

Changes

If we change how we use your data in a way that matters, we'll tell you in the app or by email before it takes effect. Questions: support@nuchub.app.