Privacy Policy

1. Introduction

Welcome to Clamly ("we," "us," or "our"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains what information we collect, how we use it, and what rights you have in relation to it.

Clamly is operated by Clamly SRL, a company registered in Romania with its registered office at Aleea Timonei 4, Constanța 900118, Romania. Clamly SRL is the data controller responsible for your personal data. As Romania is part of the European Union, your data is handled in accordance with the EU General Data Protection Regulation (GDPR).

By using Clamly at clamly.app (the "Service"), you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Name and display name
• Email address
• Password (securely hashed; we never store plaintext passwords)
• Profile preferences (country, study purpose, theme, and notification settings)

2.2 Social Login

If you sign in with Google, we receive your name, email, and profile picture. We do not access any other data from your Google account unless you explicitly grant additional permissions (e.g., Google Calendar sync).

2.3 Content You Create

We store data you create within the Service, including:

• Quizzes, quiz attempts, and scores
• Flashcard decks and review history
• Notes and todos
• Exam calendar entries
• AI chat conversations
• Uploaded files (PDFs, documents) for AI quiz generation
• Study group memberships and shared content
• Pomodoro session history
• Achievement progress

2.4 Automatically Collected Data

When you use the Service, we automatically collect:

• Session cookies for authentication
• Your IP address, used for security and rate limiting
• Browser and device information (e.g., browser type, screen size)
• Product analytics and error diagnostics, but only if you consent via our cookie banner (see Section 11)

3. How We Use Your Information

We use your information to:

• Provide, maintain, and improve the Service
• Authenticate your identity and manage your account
• Generate AI-powered quizzes and study materials from your uploads
• Power AI chat conversations to help you study
• Schedule flashcard reviews using spaced repetition
• Facilitate study groups and shared quizzes
• Sync exam data with Google Calendar (only when you explicitly connect)
• Send verification emails, push notifications, and study reminders
• Track study streaks, achievements, and progress
• Process subscription payments through Stripe (we never store card details)

We do not sell, rent, or share your personal data with third parties for advertising or marketing purposes.

4. Google Calendar Integration

If you choose to connect Google Calendar, we request access to read and write calendar events. This is used exclusively to sync your Clamly exam schedule with your Google Calendar. You can disconnect at any time from the Exams page, which revokes our access and deletes your stored tokens.

5. AI Features

When you use AI features (quiz generation, highlights, or chat), the content you provide (text, uploaded documents, or messages) is sent to our AI processing provider, which runs the AI model that answers the request. If a PDF you upload is a scan with no text we can extract, the file itself is sent so the AI can read its pages, and this counts toward your AI usage. It processes your content only on our instructions, as our data processor, and does not use it to train or improve its models. It keeps a copy of requests and answers for a limited period, only to detect abuse and keep the service secure. It may process your content in the United States or in other countries where it has facilities, outside the European Union (see section 14). We do not use your content to train AI models. AI-generated results are stored in your account for your convenience.

So that we can find and fix failures in the AI features, a shortened copy of the request and of the answer (up to 4,096 characters of each) is sent to our AI tracing provider in the European Union, along with your account identifier and timing information. It is used to operate and debug the service, never for advertising, and never to train a model.

To make AI answers about your documents faster and more accurate, the text of documents you upload may also be stored as a search index with our search index provider, which is in the United States. This index contains passages of your document text and is used only to find the parts of your document relevant to your question. It is deleted when you delete the upload or your account. A deletion that fails is retried automatically, and if the retries run out it is flagged to us as an open item rather than forgotten. Our search index provider does not use your content to train AI models.

So that the AI assistant can act as a study coach rather than a generic chatbot, your chat messages are accompanied by a summary of your study activity in Clamly. This includes your display name, country, study goal, streak, quiz scores and recent attempts, and the titles of your classes, upcoming exams and flashcard decks. It is sent with each message and is not kept by the AI provider beyond answering it.

Your to-do titles are treated more carefully, because a to-do can name something personal. They are included only when your message is about planning or scheduling, which we check before the message is sent. When that check cannot run, the titles are left out. Even so, if you would rather a title stayed private, do not put private information in it: a to-do or exam title is treated as study material, not as a private note.

6. Payments

Subscription payments are processed by Stripe. When you subscribe to a paid plan, your payment information is collected and processed directly by Stripe. We never see or store your card details. Please refer to Stripe's Privacy Policy for how they handle payment data.

7. Notifications and Email

If you opt in, we send push notifications for study reminders, exam alerts, and achievement updates. You can manage notification preferences from your Settings page or disable them at any time through your browser settings.

We send service email (address verification, password reset, security and billing notices, and the reminders you switch on) because it is part of providing the Service. We also send occasional product email about new features and study tips. You can turn product email off at any time from your Settings page or with the unsubscribe link in any such message, and turning it off never affects service email. Email is delivered by our email provider, which is in the United States, from mails.clamly.app.

8. Data Storage & Security

Your data is stored in secure, encrypted databases. Passwords are hashed using industry-standard algorithms. Authentication sessions use secure, HTTP-only cookies. We take reasonable measures to protect your information, though no system is 100% secure.

9. Data Retention

We keep your account and the content in it for as long as your account exists. Beyond that, these are the periods we apply:

• Account deletion: your account and its content are removed from our database as a single operation when you confirm deletion. Your uploaded files and your document search index are deleted with it, and a deletion that fails at one of those providers is retried automatically and flagged to us if the retries run out. Anything still outstanding is cleared within 30 days.
• Trash: notes, to-dos, quizzes, and flashcard decks you delete stay in Trash for 30 days so you can restore them, then are purged automatically.
• Diagnostic and rate-limiting records: 30 days.
• Unverified accounts: an account whose email address is never verified is deleted 7 days after sign-up, with everything stored for it.
• Billing records: invoices and payment records are kept for as long as accounting and tax law requires, which is longer than the account itself.

10. Your Rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and data
• Withdraw consent for optional features (e.g., Google Calendar sync) at any time
• Object to processing based on our legitimate interests
• Request that we restrict processing of your data
• Receive your data in a portable, machine-readable format (data portability)
• Lodge a complaint with a data protection supervisory authority

We answer a request within one month. If a request is complex we may need up to two months more, and we will tell you why inside the first month. Exercising these rights is free.

You can export all your data directly from your Settings page using the "Export your data" button. To exercise any other rights, please contact us at support@clamly.app.

You also have the right to lodge a complaint with a data protection supervisory authority, and you do not need to contact us first, though we would rather hear from you and put it right. Our lead authority is the Romanian one, the ANSPDCP (dataprotection.ro). If you live elsewhere in the EU/EEA or the UK, you can complain to your local supervisory authority.

11. Cookies & Analytics

We use essential cookies for authentication, session management, and theme and language preferences. These are always active because the Service cannot function without them.

We also use consent-based cookies and scripts: PostHog (product analytics), Sentry (error and performance diagnostics), Vercel Analytics (aggregate usage statistics), and Intercom (in-app support chat). They load only after you opt in through our cookie consent banner. If you decline, none of them is loaded. You can change your choice at any time using the "Cookie settings" link in the footer or on your Profile page. We do not use advertising cookies or share analytics data with third parties for marketing.

12. Third-Party Service Providers

We share the minimum data necessary with the following categories of service provider ("subprocessors") to operate the Service. Each processes data only on our instructions, under a written agreement. The country shown is where that provider processes your data:

• Application hosting (United States): serving the Service and its request logs
• Database hosting (European Union): your account and content
• File storage (United States): the documents and images you upload
• AI processing (United States and other countries): quiz generation, chat, and document answers (see section 5)
• AI document index (United States): the search index built from documents you upload (see section 5)
• AI tracing (European Union): a shortened copy of AI requests and answers, for debugging (see section 5)
• Payment processing (United States and European Union): subscription billing (see section 6)
• Email delivery (United States): service and product email (see section 7)
• Rate limiting and abuse prevention (European Union): your IP address
• Sign-in and calendar (United States): Google, where you choose to use it (see section 4)
• Analytics, diagnostics, and support chat: loaded only with your consent, and named individually in section 11

You have the right to ask us which specific companies sit behind these categories, and we will tell you. Write to support@clamly.app and we will send you the current list, and a copy of the transfer safeguards for any of them.

13. Legal Bases for Processing (EEA/UK)

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases under the GDPR:

• Performance of a contract: to create your account, store your content, and deliver the features you sign up for
• Consent: for analytics cookies, optional Google Calendar sync, and push notifications (you may withdraw consent at any time)
• Legitimate interests: for security, rate limiting, and fraud prevention
• Legal obligation: to keep records required by law (e.g., payment records) and to respond to lawful requests

14. International Data Transfers

Clamly SRL is established in Romania. Our database, our rate limiting, and our AI tracing are in the European Union. Other providers, including those handling hosting, payments, email, AI processing, and the AI document index, are based in the United States or other countries outside the EEA and process your data there. Section 12 gives the country for each category. Where data is transferred outside the EEA or the UK, we rely on appropriate safeguards, principally the European Commission's Standard Contractual Clauses. You can ask us for a copy of the safeguards that apply to a given provider at support@clamly.app.

15. Children's Privacy

You must be at least 16 years old to use Clamly. We are established in Romania, whose law sets the digital consent age at 16, and we apply that threshold to everyone rather than varying it by country. We ask you to confirm your age when you set up your account, and we do not knowingly collect personal data from anyone below it. If you believe a child has provided us with personal data, please contact us and we will delete it.

16. Safeguarding Signals

Students sometimes tell a study app things they are not telling anyone else. If a chat message contains an explicit statement of self-harm, hopelessness, or abuse, the AI answers with support and points to real help, such as a crisis helpline.

The check runs inside Clamly by matching wording, so no extra copy of your message is sent anywhere for it. Nothing about it is recorded. Apart from the conversation itself, which is kept like any other chat, Clamly keeps no note that a signal happened, and no one at Clamly is alerted or reads the conversation because of it.

17. Automated Evaluation of Your Study Activity

Clamly evaluates your activity automatically to run its study features: it scores quiz attempts, schedules flashcards by how well you recalled them, works out which quizzes you struggle with, tracks streaks and focus time, and awards achievements. The AI coach reads that summary so its advice fits your situation.

This shapes what Clamly suggests to you. It produces no decision with a legal or similarly significant effect, so it is not automated decision-making of the kind Article 22 of the GDPR restricts. You can see the underlying figures on your dashboard, export them from your Settings page, and correct or delete the content behind them at any time.

18. Changes to This Policy

We may update this Privacy Policy from time to time. The date at the top of this page tells you when it last changed. Where a change materially affects you, such as a new provider receiving your content or a new purpose, we will tell you in the app or by email before it takes effect, and where the change needs your consent we will ask for it rather than assume it.

19. Contact Us

For any question about this Privacy Policy, or to exercise any of the rights in section 10, contact us at support@clamly.app.

Clamly SRL, Aleea Timonei 4, Constanța 900118, Romania.