Privacy Policy

1.Who we are

In short: Corvano is run by HAVRA LLC, a small company in Florida. We are responsible for your information.

Corvano is operated by HAVRA LLC, a Florida limited liability company (“HAVRA LLC”, “we”, “us”). We decide how and why your information is used, which makes us the “controller” (or “business”) under privacy laws. You can reach us about anything in this policy at legal@corvano.app.

This policy applies to the website and apps at corvano.app and to emails we send about your account. Our Terms of Service are the rules for using Corvano; this policy is part of them.

2.Who Corvano is for

In short: You must be 13 or older. Because we can’t tell a 14-year-old from an adult, we protect every account as if it belongs to a teenager.

Corvano is for students aged 13 and older. We don’t allow anyone under 13 to create an account, and we don’t knowingly collect information from children under 13. Section 14 explains what happens if we learn that a child under 13 has signed up.

We ask only whether you are 13 or older, not your date of birth, so we can’t reliably tell a teenager from an adult. Instead, every account gets the protections we would give a 13-to-17-year-old: no personalized ads, no sale of information, no targeted advertising, no precise location, and private sets by default.

3.What we collect

In short: Your account details, the sets and answers you create, how you study, payment details if you buy a plan (handled by Stripe), and basic technical information from your browser.

Information you give us

• Account details. The name you want Corvano to use, your email address and your password. Your password is stored only as a one-way hash by our sign-in provider; nobody at Corvano can read it. If you use “Continue with Google” where it’s offered, Google shares your name, email address, Google account ID and profile photo link with us. If you choose to sign up or sign in with a phone number instead, we keep that number on your account: it is how you sign in.
• Sign-up choices. Your confirmation that you are 13 or older, the date and version of the Terms you accepted, and whether you asked for study tips and test-date reminders by email.
• Study preferences. What you want from Corvano first, the exam you’re preparing for, your target test date and score, your daily goal, your practice-exam timing preference (for example, time and a half; we never ask why), and display settings such as dark mode.
• Your content. Sets and cards you create or import (text, images and audio you add), folders, the visibility you choose for each set, and set passwords (stored only as a hash). Notes, files and photos you give our AI tools to make sets or study guides. Messages you send to Corbie and the other AI tutors. Answers you type, including written answers to practice questions. Reports, ratings and comments you send us about questions or sets.
• Payment details. If you buy a plan, our payment processor, Stripe, collects your card and billing details. We receive your name, email address, the card’s brand, last four digits, expiry date and country, a card “fingerprint” (a code that recognizes the same card again without revealing its number), and your payment and subscription history. We never receive or store your full card number.
• Payment links for a parent or guardian. If you ask a parent or guardian to pay, the plan you chose and when the link was made, opened, used and expires (the link itself is stored only as a one-way hash). When a parent or guardian pays through it, Stripe collects their card and billing details as described above, and we keep when they agreed to our Terms, which version they agreed to, and a keyed hash of the network they used (never the address itself). The payment page shows them nothing about you.
• Invites. If you invite friends: your invite code; the accounts that joined with it and whether each one confirmed their email, practised enough to earn the reward or paid (never what they study); the rewards given; and, for each friend’s sign-up, a keyed hash of the network it came from, used to check for self-invites.
• Tutor or school membership. If you join a tutoring company’s or school’s program, which organization and group you joined, the invitation you used, and when you agreed to the sharing the join screen described (section 15).
• Partner organizations. If you apply for or run a partner account: your organization’s name, website and logo, your name, role, email address and (if you give it) phone number, what you tell us in the application, your staff members’ roles, the billing contact, purchase-order numbers, and the agreements your organization accepted.
• Messages to us. Whatever you include when you email us.

Information created as you use Corvano

• Study activity. The questions and cards you study, your answers, whether they were right, how long you took, practice sessions, practice exams (answers, timing, answer changes, which question was on screen and when, pauses), scores and score estimates, skill mastery, streaks, hearts, your spaced-repetition schedule, and sets you save or copy.
• Plan and usage records. Your plan and its status, renewal and trial dates, free Plus time you received (Plus Week, invite rewards) and passes you bought (Plus until test day) with their start and end, offers you used, your AI allowance use (which feature, which model, how much it cost), coupon use, hearts refills, and which ad spaces were shown to your account and when.
• Security records. With each practice question we serve, a keyed hash of your IP address and browser identifier (a scrambled code, not the address itself), used to spot automated copying of our question bank. The networks your account is used from, recorded the same way (a keyed hash of the IP address, never the address), at most once a day, used to enforce account closures and network bans. A log of practice-exam access events, used to protect exam integrity. Records of our automated checks’ results (for example, the score an automated grader gave, or a safety check’s verdict on a set), without the content they checked.

Information collected automatically

• Device and connection data. Like every website, our servers receive your IP address, browser and device type, the pages you request, the referring page and the time. Our hosting and database providers keep these request logs briefly for security and to keep the service running.
• Time zone. When you start a checkout for a free trial, your browser’s time zone (for example, America/Chicago), kept with that subscription at Stripe so the trial’s end time is shown in your local time.
• Cookies and local storage. Small files that keep you signed in and remember your settings. See section 10.
• Analytics events. Coarse, pseudonymous records of which features are used. See section 7.
• How you found us. If you arrive through a link tagged with campaign labels (utm_source, utm_medium, utm_campaign, utm_content, utm_term) or an ad click identifier (Google’s gclid, gbraid or wbraid, or Reddit’s rdt_cid), we keep those values, the time and the kind of page you landed on in a first-party cookie, and if you create an account we store the first and the most recent with it. We use them only to count which of our campaigns bring people who sign up and subscribe. We keep them on our own servers. The campaign labels also appear in the page address our analytics records when you land on a tagged link (Google Analytics, section 7); ad click identifiers never do. Neither the campaign labels nor the ad click identifiers are ever sent to an advertising platform. If your browser sends Global Privacy Control, we don’t record them.

What we don’t collect

We don’t ask students for their date of birth, school, home address, photo, contacts or government ID (if you join through your school, we know which school gave you your seat). A phone number is optional: we have one only if you choose to sign in with it, and we use it only to text you sign-in codes and security notices about your account and, as a keyed hash, to give each person one free trial or free week (section 11), never for marketing. We don’t collect precise location: our site tells your browser that it may not use location, camera or microphone at all. We don’t ask for sensitive information such as health, religion or ethnicity. Please don’t put personal or sensitive information about yourself or anyone else into your sets or AI messages.

4.How we use it

In short: To run Corvano, keep it safe, handle payments, and understand what to improve. Never to sell it, never for targeted ads, never to train AI models.

We use information to:

• Provide Corvano: run your account, save your sets and progress, pick practice questions at the right level, schedule reviews, score practice exams, and power the AI features you choose to use.
• Handle plans and payments: start, renew and cancel subscriptions, sell one-time passes, run free trials, offers, Plus Week and invite rewards, stop the same card from being used for repeat free trials, stop the same person from claiming a free trial, Plus Week or a friend’s free week twice, and email the payer a reminder before a free trial’s first charge.
• Apply plan limits fairly: measure AI allowance use, hearts, coupons and daily limits.
• Keep Corvano safe and fair: protect accounts, stop scraping, cheating on practice exams, fraud and abuse, filter unsafe AI output, check sets for content that breaks our Terms, and investigate reports.
• Talk to you: send account emails (confirming your email, password resets, security and billing notices) and, only if you asked for them at sign-up, study tips and test-date reminders.
• Improve Corvano: look at pseudonymous, aggregated usage and at the quality of AI results.
• Measure our own campaigns: count which tagged links lead to sign-ups and subscriptions, using the how-you-found-us data in section 3. It is kept on our own servers and never sent to an advertising platform.
• Show ads on the free plan: always non-personalized (section 6).
• Meet legal duties: comply with the law, answer lawful requests, enforce our Terms and defend legal claims.

What we never do

• Sell your personal information, or “share” it for cross-context behavioral advertising.
• Use your information for targeted advertising, or let advertisers build a profile of you through Corvano.
• Send information about you, including how you found us or what you bought, to an advertising platform, for conversion tracking or anything else.
• Use your content or study data to train AI models, ours or anyone else’s.
• Make decisions about you that have legal or similarly significant effects based solely on automated processing, other than the safety checks on sets described below, which a person will always review if you ask.
• Use student information for anything other than running and improving Corvano, except as the law requires.

Automated processing

Corvano uses automated processing to personalize your studying: choosing question difficulty, routing adaptive practice exams, scheduling card reviews, estimating scores, grading written practice answers with AI, and small decisions such as whether a card would be clearer with a picture. These results only shape your practice. They are estimates, they have no effect outside Corvano, and you can ask us to look again at any result you think is wrong.

Safety checks on sets. When a set is saved, imported, copied or reported, an automated check reads its text (title, description, tags and cards, not its pictures) for content that breaks our Terms. If it seems to, the set is hidden from others at once and a second, more careful AI model reviews it. That review puts the set back, removes it, or, for serious or repeated breaks, closes the account; a closed account can’t be used, its sets are no longer shared, and the networks it was used from may be blocked. We keep a record of each decision, without the set’s text. If you think a decision about you is wrong, email support@corvano.app and a person will review it. If we got it wrong, we restore the account and its sets.

5.AI features

In short: AI features send what you give them (and the cards or question involved) to AI model providers through OpenRouter. We send no name, email or account ID, and we require providers that keep nothing and train on nothing.

Corvano’s AI features include Corbie and the other tutors, the set writer (from notes, files, photos or a prompt), hints, explanations, memory aids, AI-built tests, grading of written answers, card pictures, set checks and study guides. They only run when you use them, except the safety checks on sets described in section 4, which run when a set is saved.

What is sent

To answer, a model needs the material in front of you: your message and the recent conversation, the question or cards you’re studying, your answer, the text taken from a file you upload, or the photos you upload to make a set. We don’t send your name, email address or any account identifier. Several features automatically hide email addresses, phone numbers and street addresses in your messages before they are sent, but please don’t include personal information at all.

Files and photos you give the set writer are read in memory and not stored. A file you upload for a study guide is stored privately only until the guide is made, then deleted; we keep the guide itself, its title and the file’s name.

Who processes it

Requests go through OpenRouter, a US service that routes each request to a company hosting the AI model (today, DeepSeek models run by independent hosting providers). On every request we tell OpenRouter to use only providers that do not store the content or use it for training, and only endpoints with zero data retention. If no provider meets those conditions, the request is not sent anywhere else. OpenRouter’s own policy is not to use request content to train models.

Some automated checks use Jev, a decision model from TypeSafe, reached through OpenRouter: for example, deciding whether a written answer can be marked correct without further review, whether a card needs a picture, which tutor should answer, which parts of an uploaded document matter, or whether a set might break our rules. These checks see the relevant card text, your answer or document excerpts, but never your name, email or account ID. This service is not covered by the zero-retention setting above, so we don’t make that promise for it.

When the tutor shows a molecule, we look up the compound’s name or structure in PubChem, a public database of the US National Library of Medicine. Nothing about you is sent.

What we keep

We store your tutor conversations (and short AI summaries of long ones) so you can pick up where you left off, the sets, tests, guides and feedback the AI makes for you, and usage records for your allowance. They are deleted with your account.

6.Ads

In short: Only the free plan shows ads. Every ad is non-personalized: it depends on the page, not on you. Paid plans load no ad code at all.

The free plan shows ads from Google AdSense, and offers optional rewarded ads from Google Ad Manager to refill hearts early. Paid plans show no ads, and on a paid account the ad code is never loaded. We don’t request Google ads at all for visitors we identify as being in New York (see New York).

Because any user may be a teenager, every ad request Corvano makes asks Google for non-personalized ads and for Google’s teen treatment, which turns off personalized advertising and remarketing and applies Google’s protections for teens. Rewarded-ad requests are also marked as coming from a user under the age of consent and limited to restricted data processing. Non-personalized ads are chosen from the page’s content and general location (such as your city, from your IP address), not from your interests or the other sites you visit.

Google and its partners may still place and read cookies or similar identifiers in your browser when an ad is shown, to limit how often you see the same ad, count views, and fight fraud and abuse. You can learn how Google uses this information at How Google uses information from sites or apps that use our services, and manage Google’s ad settings at adssettings.google.com. In the European Economic Area, the United Kingdom and Switzerland, Google shows a consent message before using ad cookies; you can change that choice in section 10.

We record which ad spaces were shown to your account and when, so we can pace ads. Advertisers never receive your study data.

7.Analytics

In short: We use Google Analytics to count which features are used. It gets coarse, pseudonymous events: never your name, email, what you type or your exact scores.

We use Google Analytics (through Google’s Firebase) to understand how Corvano is used: which pages and features people use, where they get stuck, and whether a change helped.

• What it receives: page views, reported as the kind of page (such as “a set page”) rather than the address or title, with the campaign labels of a tagged link you land on (such as utm_source and utm_campaign, never an ad click identifier), and product events from a fixed list, such as “a practice question was answered” with its section, skill, difficulty, whether it was right and a time band, “a study mode was started”, or “a plan was viewed or bought”. Values are codes and ranges (for example, a score band instead of your score). It also receives your plan tier, exam and main product, and what any browser reports: browser and device type, screen size, language, and a country and region that Google estimates from your IP address (Google Analytics does not store the IP address).
• How events are linked: by a random number stored in your browser, not by your account. When you buy a plan, that random number is kept with the checkout at Stripe, and our server tells Google Analytics that a purchase of that plan happened, linked only to that number.
• What it never receives: your name, email address, account ID, age, anything you type, your tutor conversations, set or folder names, cards, searches, uploaded content or exact scores.
• Settings: Google signals, ad personalization and data sharing with Google are turned off, and Analytics is not linked to any advertising product, so this data is not used for advertising. Google processes it for us as a service provider.
• Where it runs: only where our review found that this kind of measurement of teenagers is allowed without a separate consent step: currently the United States (except New York) and its territories, Canada (except Quebec), Australia and India. Anywhere else, including the European Economic Area, the United Kingdom, Switzerland, New York and Quebec, or wherever we can’t tell where you are, Corvano does not load Google Analytics at all. It also never loads for students who hold a seat from a school.
• How long: detailed analytics data is kept for 2 months. After that only totals remain (for example, “1,200 questions answered on Monday”).
• How to opt out: turn on Global Privacy Control in your browser (Corvano then doesn’t load analytics at all), block cookies for corvano.app, or install Google’s Analytics opt-out add-on. If you tell us you are under 13, analytics stops on that device and stays off.

We don’t use any other analytics or session-recording tools.

8.Who we share it with

In short: Only with the companies that run parts of Corvano for us, with other users when you make a set public, and when the law requires it. Never sold.

We share information with service providers that process it on our behalf, under contracts that limit what they can do with it.

The same list, with where each provider works, is on our subprocessors page.

We also share information:

• With other users, only when you make a set public or share its link (section 9).
• With a tutor or school you joined, only what the join screen listed, while you hold their seat (section 15).
• With a parent or guardian who asks about their teen’s account and whose identity we verify.
• With the person who pays for your plan. If a parent or guardian pays through a payment link, Stripe sends them the receipts, and when they write to us from the email address a receipt went to, we may confirm the plan and its status to them (for example, to cancel it).
• For legal reasons: when we believe in good faith it’s needed to comply with the law or a valid legal request, to protect the safety of anyone, to prevent fraud or abuse, or to enforce our Terms.
• In a business transfer: if HAVRA LLC is involved in a merger, acquisition or sale of assets, your information may move to the new owner, who must keep honoring this policy or tell you before changing it.
• With your permission, in any other case.

9.Public and shared sets

In short: Your sets are private unless you change that. A public set can be found and read by other signed-in Corvano users, along with your display name.

Every new set is private. You can change a set’s visibility at any time:

• Public: other signed-in Corvano users can find it in search and similar-set suggestions, read it, study it, save it and copy it into their own account. They see the set and your display name (or “A Corvano member” if you left it blank). Corvano pages aren’t open to people who aren’t signed in.
• Unlisted: anyone signed in who has the link can open it, but it never appears in search or suggestions.
• Password-protected: only people who have the link and the password can open it.

You can make a public set private again or delete it at any time, and it stops being visible to others straight away. Copies that other users made, or downloaded for offline study, while it was public stay with them. Don’t put personal information in a set you share.

10.Cookies and similar tools

In short: Cookies keep you signed in and remember settings. Analytics and ad cookies are described here, with ways to turn them off.

Cookies are small files a website stores in your browser. Corvano also uses your browser’s local storage for a few settings. Here is what we use:

You can block or delete cookies in your browser settings. If you block essential cookies you won’t be able to stay signed in. Turning on Global Privacy Control stops Corvano from loading analytics.

If you’re in the European Economic Area, the United Kingdom or Switzerland, you can review the choice you made in Google’s consent message here:

Change cookie choices (EEA, UK and Switzerland)

11.How long we keep it

In short: As long as your account exists. When you delete it, we delete your data straight away, except a few records the law or security needs.

• Your account and content: for as long as your account exists. If an account has been unused for three years, we may delete it after emailing a warning.
• When you delete your account: your profile, sets, cards, progress, practice history, tutor conversations, study guides, usage records, free Plus time, invite code and invite records, payment links and how-you-found-us records are deleted immediately, along with the files you uploaded. If a file can’t be removed at that moment because of a technical problem, we remove it as soon as we find it. Any paid plan is cancelled at once.
• Payment records: invoices, receipts and payment history are kept by Stripe and in our billing records for as long as tax, accounting and anti-fraud rules require.
• Security and integrity records: the keyed hashes of IP addresses and browser identifiers, practice-exam access logs, card fingerprints used to prevent repeat free trials, and automated-check results are kept after an account is deleted, without your name or email, for as long as they are needed to protect Corvano against scraping, cheating and fraud. The hashed networks an account was used from are forgotten 180 days after they were last seen, except a network that is banned, which is kept while the ban lasts.
• Text sign-in records: when we text you a code, we keep a keyed hash of the number (not the number itself) with the time, so we can limit how many texts one number gets. Those records are deleted within a day. A sign-in security log of the same keyed hashes is kept for 180 days, then deleted.
• One free trial or free week per person: when an account starts a free trial, or receives Plus Week or a friend’s free week, we record a keyed hash of its email address and, if it has one, of its verified phone number (normalised, so that variations of one address or number count as one). They are linked to no account and contain no name, address or number, and they are kept after the account is deleted, like card fingerprints, so the same person can’t claim the same free time again. A note that a trial’s reminder email was sent is kept with the trial’s Stripe reference only.
• Invite limits: when a friend who joined with your link deletes their account, their invite records go with it, but your account keeps a note that a reward was counted (with nothing about the friend), so yearly limits can’t be reset.
• How you found us: campaign labels for as long as your account exists; ad click identifiers until 90 days after you create your account (before that they wait in a cookie for at most 30 days), then erased. Both are deleted with your account.
• Backups: deleted data can remain in our database provider’s encrypted backups until they expire on their regular schedule. We use backups only to recover from failures, and if one is ever restored we delete your data again.
• Server logs: kept by our hosting and database providers for short periods, generally days to weeks.
• Analytics: detailed data for 2 months, then only totals (section 7).
• Emails with us and privacy requests: as long as needed to deal with them, and records of privacy requests for 24 months.
• Information about a child under 13: deleted as soon as we learn of it.

12.How we protect it

In short: Encryption, strict access rules, private file storage and as little data as possible. If something ever goes wrong, we’ll tell you.

• Every connection to Corvano is encrypted (HTTPS), and our providers encrypt stored data.
• Database rules make sure an account can only read its own private data. Uploaded files are private and opened only through links that expire within an hour.
• Passwords are stored only as one-way hashes. Card numbers are handled only by Stripe, a PCI-certified payment processor.
• IP addresses in our security logs are stored as keyed hashes, and AI requests carry no name, email or account ID.
• Access to production systems is limited to the people who run Corvano at HAVRA LLC, and only to run and fix it.

No system is perfectly secure. If a breach affects your information, we will notify you and the authorities as the law requires. If you find a security problem, please report it to legal@corvano.app.

13.Your rights and choices

In short: You can see, download, fix and delete your information, wherever you live. Most of it you can do yourself from your account page.

We give these rights to every user, whether or not a privacy law in your state or country requires it:

• Access and portability. “Download my data” on your account page gives you a copy of your account details, profile, plan, practice history, and your sets and cards, as a JSON file. Each set can also be exported from its own page. For a complete copy of everything tied to your account, email us and we’ll send it.
• Correction. Change your name and study preferences in your account, edit your sets any time, or ask us to fix anything else.
• Deletion. “Delete my account” on your account page deletes your account and data as described in section 11. You can also delete individual sets and study guides, and clear a set’s tutor chat.
• Email choices. Study tips and reminders are sent only if you asked for them, and each one will include a way to stop them. Account and security emails can’t be turned off while you have an account.
• Opting out of sale, sharing, targeted ads and profiling. We don’t do any of these, so there is nothing to opt out of. We treat a Global Privacy Control signal as a valid opt-out request for your browser, and it also turns off our analytics there.
• Withdrawing consent. Where we rely on your consent, you can withdraw it at any time.

How to make a request

Email legal@corvano.app from the address on your account, saying what you’d like. To protect your account, we’ll confirm the request through that email address and may ask for a little more information. We answer within 30 days; if we need longer, we’ll tell you why and when to expect an answer. Requests are free.

Authorized agents and parents. Someone can make a request for you if they have your signed permission or a power of attorney, and we may ask you to confirm your identity directly. A parent or legal guardian can make requests for their child’s account after we verify they are the parent or guardian.

Appeals. If we decline your request, you can appeal by replying to our answer or emailing us with “Appeal” in the subject within 60 days. We’ll respond within 45 days and explain our decision. If you’re still unhappy, you can contact your state attorney general or your local data protection authority.

No discrimination. We will never charge you more, give you a worse service or deny you anything for using your privacy rights.

14.Teens, children and parents

In short: No accounts for children under 13. Teens get strong privacy by default. Parents can contact us about their child’s account.

Children under 13

Corvano is not meant for children under 13 and is not directed to them. We ask every new user whether they are 13 or older, once at sign-up and again when they set up their account. If someone says they are under 13, we don’t create the account and we delete what they entered. If we learn in any other way that a child under 13 has an account, we delete the account and its information, and cancel any subscription.

Parents: if you believe your child under 13 has used Corvano, email legal@corvano.app with the email address they used, and we’ll delete the account.

Teens (13 to 17)

Because any account may belong to a teenager, every account has these protections:

• Sets are private by default. There are no public profiles, followers, direct messages or comments between users.
• No personalized ads, no targeted advertising, no sale or sharing of personal information, and no profiling for advertising.
• No precise location, camera or microphone access.
• AI tutors are instructed to stay on schoolwork, and automated safety filters check messages and replies in the set tutor and the practice-exam tutor.

Removing what you posted: you can delete any set you made, or make it private, at any time, and it disappears from public view. If you’d like help removing something, email us.

Parents and guardians of a teen can ask to see, correct or delete their teen’s information, or to close the account. Email legal@corvano.app with the account’s email address; we’ll verify that you are the parent or guardian before acting.

A parent or guardian who paid for their teen’s plan through a payment link can cancel it by emailing support@corvano.app from the email address the receipt went to. Our help page for parents explains paying, canceling and refunds.

15.Tutors and schools

In short: A tutor or school can give you Corvano Plus. You choose to join, you see exactly what they’ll see first, and your own sets and chats stay yours.

Tutoring companies, independent tutors and schools (“partners”) can give their students a seat: Corvano Plus on Corvano and Corvano Prep, paid for by the partner. This section explains what changes for your information when you join one.

Joining is your choice

A partner invites you with a link, a code or an email. Nobody can add your account without you accepting on your own screen, and partners can’t search Corvano for accounts. Before you accept, the join screen shows who is offering the seat and exactly what they will see. If you already have an account, you keep everything in it.

What a partner sees, and what it never sees

• What it sees, for as long as you hold its seat: your name and email address, the group it put you in, when you were last active, the practice questions you answered and your accuracy by section, domain and skill, your practice-exam scores and score estimates, your streaks, the assignments and exams it set you and your results, and how much of its AI allowance you used.
• What it never sees: your own study sets and folders, your conversations with Corbie and the other AI tutors, notes or files you upload, your study guides, your payment details, or anything from before you joined that isn’t in the list above.

Partners agree to use what they see only to teach and support you, never to sell it or use it for advertising. Seats never show ads.

Leaving

You can leave a tutor’s program at any time from your account page (Account, then Organizations). The partner stops seeing your information straight away, and your account returns to the Free plan or to your own plan. The same happens if the partner removes you or its plan ends.

Accounts provided through a school

When a school or district gives students Corvano, we act for the school as a “school official” under the Family Educational Rights and Privacy Act, under the school’s direct control, and we sign a Student Data Privacy Agreement before any student joins. For those students:

• we use their information only to provide Corvano to them and to the school, never for advertising, and never sell it;
• Corvano doesn’t load analytics for them;
• if they joined through a school link that required the school’s email address, the account is managed by the school: the school decides whether it can leave the program, and can ask us to delete it, which we do within 60 days;
• parents and eligible students ask the school to see or correct school records, and we help the school answer; students can also download their own data from their account page.

Schools can add students aged 13 and over only. Outside these programs, Corvano remains a service students choose for themselves, and we follow the same core promises of student-privacy laws for everyone: we don’t sell student information, don’t use it for targeted advertising, don’t build profiles of students for any purpose other than their own studying, and delete it when asked.

16.US state privacy notices

In short: State privacy laws give residents specific rights. We give those rights to everyone, and we don’t sell, share or target ads.

Privacy laws in California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, New York, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia and other states give residents rights over their personal information, with extra protections for minors. Whether or not a particular law applies to a company our size, we follow this policy for everyone and honor the rights in section 13.

California

In the past 12 months we have collected these categories of personal information, from you, your device and our payment processor:

We use these categories for the purposes in section 4 and keep them as described in section 11. We don’t sell or share personal information (as California law defines those words), including that of consumers under 16, and we don’t use sensitive personal information to infer anything about you.

“Shine the Light”: we don’t disclose personal information to third parties for their own direct marketing. Do Not Track: there is no common standard for browser “Do Not Track” signals, so we don’t respond to them separately; we honor Global Privacy Control instead, and we don’t allow third parties to track you across other websites for advertising through Corvano. Minors: you can remove content you posted, as section 14 explains.

New York

We don’t sell the information of users in New York. For visitors we identify as being in New York, from the approximate location of their IP address, we don’t run analytics and we don’t request ads from Google: the free plan shows our own banners instead, and hearts refill without an ad.

17.Visitors outside the US

In short: Corvano is run from the US and your information is stored there. If you’re in Europe or the UK, you have extra rights, including complaining to a regulator.

Corvano is operated from the United States, and our database is in the United States. If you use Corvano from another country, you send your information to us in the US. Where our service providers receive personal information from the European Economic Area, the United Kingdom or Switzerland, they rely on the EU–US Data Privacy Framework (and its UK and Swiss extensions) or on the European Commission’s standard contractual clauses.

Legal bases (EEA, UK and Switzerland)

• Performing our contract with you: running your account and Corvano’s features, AI features you use, plans and payments, usage limits, and account emails.
• Legitimate interests: security, preventing scraping, cheating and fraud, improving Corvano, and showing contextual ads on the free plan. We have weighed these against your rights, taking particular care because users may be children.
• Consent: ad cookies (through Google’s consent message) and optional emails. If you are under the age at which your country lets you consent on your own (13 to 16, depending on the country), a parent or guardian must give or approve that consent.
• Legal obligation: tax and accounting records, and answering lawful requests.

You have the right to access, correct, delete, restrict or object to our use of your information, to data portability, and to withdraw consent at any time. You also have the right to complain to your data protection authority, such as the Information Commissioner’s Office in the UK or the authority in your EU country; we’d appreciate the chance to help first at legal@corvano.app.

18.Changes to this policy

In short: If we change this policy in a way that matters, we’ll tell you before it takes effect.

We’ll post any change here with a new effective date. If a change is significant, we’ll tell you by email or in Corvano before it takes effect, and where the law requires it we’ll ask for your consent. We will never use information we already hold in a materially different way without your consent.

19.Contact us

For privacy questions and requests, parents’ requests, and anything else about this policy, email legal@corvano.app.