Privacy Policy

We collect account, study, usage, and billing information to operate ExamPull. To produce exams and feedback, we send relevant uploads, prompts, and generated content to outside AI services. Those services handle content under their own retention and model-improvement policies, as described below. You can export your data, delete your account, and ask us questions at privacy@exampull.com. The rest of this policy is the longer version of those commitments.

Account information

Email address, password (hashed via Firebase Authentication, or authenticated through Google OAuth), phone number (verified by SMS), and any optional profile fields you provide such as your name. We collect phone numbers because they are our primary safeguard against trial abuse: one phone number maps to one account.

Study materials you upload

PDFs, slide decks, Word and PowerPoint files, photos of notes and whiteboards, and plain text. We process this material to extract topics and generate exams. We retain it as part of your library so you can reuse it for future exams.

Exams and optional attempt review

The exam PDFs we generate, the answer keys, the rendered page images, and, if you use attempt review, your scanned or typed attempts and the resulting feedback, scores, and page corrections.

Billing and transaction data

Trial status, subscription plan and history, billing periods, payments, refunds, disputes, and payment-processing fees. Payment credentials are collected and stored by Stripe; we receive identifiers and limited display details rather than your full card or wallet credential.

Device and usage data

IP address, browser and device type, operating system, language, screen resolution, referring URL, and a device fingerprint derived from these signals (used solely to enforce one preview exam per device per 24 hours, per our anti-abuse policy). Page views, feature interactions, and error reports are collected through PostHog and Sentry. Test accounts and synthetic test data are flagged at the database level and excluded from product analytics by default.

AI request and cost records

For each AI-provider call, we record the account and billing period, workflow and feature stage, provider and model, request or generation identifiers, token or usage measures, provider-reported or estimated cost, status, and timestamps. We use this detailed ledger to enforce monthly usage limits, investigate failures, reconcile provider bills, and understand the cost of operating the Service. These records do not make your internal cost visible to other users.

We use the data described above to:

• Deliver the core Service: extract topics, generate exams, produce PDFs, host your library, and process attempt review
• Authenticate you, verify your phone, prevent duplicate accounts, and enforce abuse safeguards
• Manage trials and monthly usage, process payments and refunds, and manage subscriptions through Stripe
• Send transactional notifications (account, billing, exam-ready alerts) by email through Resend and by SMS through Twilio
• Investigate errors, measure feature usage in aggregate, and improve the product through PostHog analytics and Sentry error tracking
• Respond to your support requests, refund inquiries, and DMCA notices
• Comply with applicable law and protect the rights, safety, and property of ExamPull, our users, and the public

We do not sell your data or share it with advertisers. We disclose it to the service providers and for the legal and security purposes described in this policy.

ExamPull is built on outside AI services. We route requests through OpenRouter to the services that read your materials, write and check your exams and, when enabled, review attempts and mark up pages. The specific services we use may change as we tune for quality and cost.

When we send your uploads or exam content to one of these services:

• OpenRouter retains request metadata. Depending on the selected model and service, the company handling a request may retain prompts and outputs and may use them to improve its models or other products under its own published policy. For exam generation, we currently use a Meta Contributor service whose terms permit prompts and outputs to be used to improve Meta products.
• Your content is encrypted in transit using TLS. How the company handles it after receipt is governed by its published policy.
• ExamPull does not pool one student's content into another student's request. Any retention by the selected service is governed by that company's published policy.
• Topic extraction caches we maintain ourselves are scoped to your account and are never shared across users.

ExamPull is a direct-to-student tool, not a service contracted by a school district. If you upload education-record materials such as notes, returned tests, or course documents, we handle and disclose them as described in this policy and our Terms.

For users in the European Economic Area, the United Kingdom, and other GDPR-aligned jurisdictions, ExamPull acts as the data controller for personal data processed through this direct-to-student Service. You have the right to access, correct, port, and erase your data, and to object to or restrict certain processing. To exercise these rights, email privacy@exampull.com. We respond within 30 days. Our legal bases for processing are the performance of our contract with you (Article 6(1)(b)), our legitimate interests in operating and securing the Service (Article 6(1)(f)), and your consent for marketing-style communications you opt into.

For active accounts, we retain your uploaded materials, generated exams, attempts, and grading results indefinitely so you can return to them whenever you study. You can remove individual items from your ExamPull library at any time; removal from the library is immediate.

When you delete your account, we remove all exams, materials, page images, attempts, grading data, and profile information from ExamPull's primary databases and storage within seven days. Content already sent to outside AI services may remain subject to their retention policies and legal obligations; deleting your ExamPull account does not control copies they retain outside our systems. Encrypted off-site backups, used only for disaster recovery, expire on a 30-day rolling cycle; your data will not be restored from backups except in a catastrophic failure scenario, and any restoration will re-trigger the deletion within 24 hours.

Anonymous preview sessions (when a visitor generates a sample exam without creating an account) are retained for 30 days as a single bundle (uploads plus the generated exam) so the visitor has time to sign up and claim them. After 30 days the entire anonymous bundle is purged automatically.

Billing records and tax-required transaction data are retained for the period required by applicable tax and accounting law, typically seven years, even after account deletion. Audit-log entries about administrative actions are retained in an isolated project for security and forensic purposes.

You can:

• Access and download a complete export of your account data (exams, materials, attempts, grading feedback, and metadata) from the Settings page. Exports are delivered as a downloadable archive.
• Correct any account information from your profile.
• Delete individual exams, materials, or your entire account.
• Opt out of marketing emails and SMS at any time. Transactional notifications (security alerts, billing receipts, exam-ready notifications) cannot be turned off while the account is active.
• Object to specific processing activities. Contact privacy@exampull.com and we will respond within 30 days.

We use cookies and equivalent browser storage for three purposes:

• Essential: session cookies that keep you logged in, CSRF protection, theme preference, and a hash of your device fingerprint for preview-abuse prevention. These are required for the Service and cannot be disabled while you use the site.
• Analytics: PostHog uses a first-party cookie to attribute a session to a stable anonymous identifier so we can understand how features are used. We honor Do Not Track and Global Privacy Control signals.
• Error tracking: Sentry uses minimal storage to attach a session ID to error reports.

We do not run advertising cookies, and we do not embed third-party trackers from social platforms.

We rely on a focused set of vendors to operate the Service. The information each receives depends on its function:

• Google Firebase & Google Cloud: authentication, Firestore database, Cloud Storage for files, Cloud Tasks for background jobs, and Cloud Run hosting
• OpenRouter and outside AI services: the gateway and services (including Google, OpenAI, Meta, and others) used for topic extraction, exam generation, and attempt review
• Stripe: subscription billing, wallet and card payments, refunds, disputes, and tax handling
• Resend: transactional and account-related email delivery
• Twilio: phone verification and account recovery via SMS
• Sentry: application error monitoring
• PostHog: product analytics, restricted to first-party hosting
• Featurebase: public roadmap, feedback, and changelog tooling (only the content you choose to post is shared)

Each of these companies is bound by its own privacy commitments and a data processing agreement with ExamPull where applicable.

Data stored in ExamPull's Google Cloud systems is encrypted at rest using Google Cloud's default AES-256, and data sent from ExamPull is encrypted in transit using TLS. Access to user data within our systems is restricted by Firebase Security Rules to the owning account, and administrative access requires passkey-based authentication plus step-up verification for destructive operations. The systems that process your materials use dedicated service identities. Exact least-privilege permissions are a production-release requirement and are not represented as complete until their live postconditions are verified.

No system is perfectly secure. If we ever experience a breach that is reasonably likely to affect you, we will notify you without undue delay, in any case within 72 hours of confirming the breach, and will report to regulators where required.

ExamPull is not directed to children under 13. We do not knowingly collect personal information from a child under 13 without verifiable parental consent. If you are a parent and believe your child has created an account without consent, email privacy@exampull.com and we will delete the account and associated data promptly.

Users between 13 and 17 may use the Service with the involvement of a parent or legal guardian, who is bound by these Terms on the user's behalf.

We may update this policy as the Service evolves. The effective date at the top of this page reflects the latest revision. We will provide any notice or consent that applicable law requires.

For privacy questions, requests under GDPR or comparable laws, or any concern about how your data is handled, write to privacy@exampull.com. For general account or product support, use the support portal.