01Data We Collect
- Email address — Used for account login and identity verification. We support both email verification-code login and Google login; we do not store passwords.
- Google account information — When you sign in with Google, we request the openid, email, and profile scopes from Google, but we only obtain and store your email address and Google account identifier (openid sub) for login and identity purposes; we do not obtain or store your profile picture or name.
- YouTube video information — The video ID, subtitle/transcript text, and title extracted by the browser extension from the YouTube video page you are watching, used to provide the video tutoring service.
- Bilibili video information — The bvid, video part number, subtitle text, and title extracted by the browser extension from the Bilibili video page you are watching, used to provide the video tutoring service.
- AI-generated content — Video summaries, outlines, and overviews generated from the above transcripts.
- Chat history — Your conversations with the AI tutor.
- Screenshot images — Video-frame images you capture using the “Screenshot to ask” feature. These images are held in object storage and are automatically deleted 90 days after capture (see Section 4).
- IP address — When you use the Service without logging in, we use your IP address for free-usage rate limiting and store it only as a salted SHA-256 hash; we do not store the raw IP for this purpose. Separately, our web server writes standard access logs that include the requesting IP address; these logs are kept for a short period (currently 14 days) for security, abuse prevention, and diagnostics, and are then deleted.
- Login session token — Used to maintain your login state.
The browser extension reads page content only on video pages of the sites listed above. It does not collect or transmit content from other websites you visit.
02How We Use Data
All data we collect is used solely to provide the AI tutoring service, including conversational Q&A, video summarization, quiz generation, and other core features, together with the usage limits and abuse prevention needed to keep the Service available. We do not use your data for advertising, user profiling, or any other commercial purpose, and we do not sell it to any third party.
The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.
03Third-Party Processing and Sharing
To provide the AI tutoring service, some of your data is sent to the following necessary third-party processing services:
- Alibaba Cloud Model Studio (DashScope) — Qwen models (United States, Virginia region) — Processes video transcripts, AI conversation content, screenshot images (multimodal image understanding), and quiz-generation requests. This content is sent to the service for AI processing during the request.
- Cloudflare R2 (United States) — Stores the screenshot images you capture. The storage location is private; images are retrieved only through short-lived signed links.
- DigitalOcean (United States, New York) — Hosts the Service’s application server and database.
- Resend (United States) — Sends verification-code emails when you use email verification-code login.
- Google — Provides Google Sign-In when you choose to log in with your Google account.
Apart from the processing necessary to provide the Service described above, we do not sell or share your personal data with any third party. The Service contains no advertising, tracking, or analytics SDKs.
04Data Storage, Security, and Retention
Where your data is stored. The Service’s application server and database are located in the United States (New York), and screenshot images are stored in the United States. AI processing is performed in the United States (Virginia), and verification emails are sent through a provider in the United States. If you use the Service from outside the United States, your data is transferred to and processed in the United States.
Security. All communications are encrypted in transit via HTTPS. Data at rest resides on encrypted storage provided by our infrastructure providers. The database is not reachable from the public internet. Login credentials are stored securely to prevent leakage.
Retention. Video transcripts, AI-generated summaries, chat history, and quiz records are stored in our database and retained for as long as your account remains active, so that you can review your own history. Please note: transcripts, conversations, and screenshot images are sent to the AI service provider above for processing, and are also saved in our database so you can review your history — these are two separate steps, both as described above; this content in our database is not “not retained.”
Screenshot images are an exception. They are removed by an automated lifecycle rule 90 days after capture. The automated process may take a short additional period to complete. After an image has been removed, the chat message it was attached to remains in your history, but the picture is no longer displayed.
05Your Rights
Depending on where you live, you may have rights over your personal data, including the right to access, correct, or delete it, to object to or restrict certain processing, to receive a copy of it, and to lodge a complaint with your local data protection authority. We process your data in order to provide the service you have requested and, for usage limits and abuse prevention, on the basis of our legitimate interests.
To make a request, email privacy@lessonside.com from the email address registered to your account. We act only on requests we can verify come from the account owner.
06Cookies
We use only necessary functional cookies, primarily the JWT token used to maintain your login state. We do not use any tracking cookies, advertising cookies, or third-party analytics cookies.
07Protection of Minors
The Service is open to learners of all ages. We do not actively collect additional personal information from minors; the scope of data collected is the same for all users and limited to the minimum necessary to provide the Service. If a minor’s guardian discovers that their child has submitted personal information without consent, please contact us at the email below and we will delete the relevant data promptly.
08Policy Updates
This policy may be updated in response to regulatory changes or adjustments to the Service. For significant changes, we will notify you via in-app notice or email. The “Last updated” date at the top of this page reflects the currently effective version.