Privacy

Privacy Policy

The short version: your data never leaves your browser. is a static website. There is no server receiving your subjects, grades, or plans, because there is no server to receive them.

What is stored, and where

  • Tool data (subjects, exam dates, grades, syllabus topics, saved timetables) is kept in your browser — localStorage for small preferences, IndexedDB for larger data — under namespaced keys. It lives on your device only.
  • Study space files and notes are stored in IndexedDB, also on your device only. Files you upload are never transmitted anywhere; previews are generated locally in your browser.
  • Theme preference is stored locally so the site remembers light or dark mode.

Clearing your browser’s site data deletes everything. You can export a full backup of your study space as a JSON file at any time from My Study Space → Backup — that file is yours to keep wherever you like, so back it up regularly.

Share links

Timetables can be shared as a read-only link. The plan’s state is encoded in the URL hash itself — nothing is uploaded anywhere. That also means anyone who has the link can read what it contains, so treat a share link like a document and only send it to people you trust.

Analytics

There are no analytics at launch. No tracking pixels, no third-party scripts, no fingerprinting. If a privacy-respecting analytics option is ever added, this page will say so first.

AI features (bring your own key)

Optional AI features work on a bring-your-own-key basis: you supply your own API key for the AI provider you choose. Requests go directly from your browser to that provider — there is no ExamElm server in between. We never see your prompts, and we never see your key on any server. AI features are always opt-in, and nothing is transmitted anywhere until you press Send.

  • What the provider receives: every prompt you submit, plus any text you paste into the chat. Providers do not receive the rest of your Study Space unless you explicitly include it.
  • Key storage: keys are kept in your browser's memory by default and vanish when the tab closes. You may optionally store them on your device encrypted with a passphrase you choose (PBKDF2 + AES-GCM); plaintext keys are never written to disk. If you forget the passphrase, the stored keys are unrecoverable.
  • Key exposure risk: an unlocked key in your browser could be read by a malicious script. This is why the site uses a strict Content Security Policy, sanitizes rendered content, and loads no third-party scripts — and why you should keep your browser updated and never paste secrets into chat.
  • Billing: API usage is billed by your chosen provider at their API rates, which are separate from ChatGPT, Claude, Gemini, or any other consumer subscription you may hold. The chat shows an estimated maximum cost before you send.

Offline use

A service worker caches the site’s own files on your device so the tools keep working with poor or no connectivity. The cache never leaves your device.

Changes

If this policy changes, the new version will be published here with an updated date. Last updated: 2026-11-04.