Privacy Policy

Scope

This Privacy Policy applies to the JEFF website, applications, and related services. It does not apply to third-party sites or services that have their own privacy policies.

Information we collect

Account information

When you sign in with Google, we may receive your name, email address, profile image, Google account identifier, and authentication information. We assign an internal user ID.

Course materials and instructions

We process files, images, PDFs, extracted text, filenames, document roles, instructions, and preferences you submit to analyze source material and generate an exam. You control what you upload and should remove personal, confidential, or restricted information first.

Generated exams and study activity

We may store generated exams, solutions, blueprints, generation traces, saved titles, practice attempts, completion status, scores, topic mastery, and shared exam copies.

Feedback

If you submit feedback, we may collect ratings, overlap reports, comments, the associated exam identifier and title, your user ID, and submission time.

Purchases and account usage

We store generation balances, free-use counts, purchased-credit history, Stripe customer and transaction references, account role, and related timestamps. Stripe, not JEFF, directly processes full payment card details.

Technical information

JEFF and its infrastructure providers may process IP addresses, browser and device data, authentication events, request metadata, error information, and security or usage logs as necessary to operate, secure, and diagnose the service.

How we use information

• Provide authentication, document analysis, exam generation, saving, sharing, practice, and grading features.
• Process payments, grant credits, maintain purchase records, and prevent duplicate fulfillment.
• Personalize study activity, preserve history, and improve output quality.
• Respond to support, privacy, safety, and legal requests.
• Detect fraud, abuse, security incidents, and violations of our terms.
• Monitor reliability, debug errors, enforce limits, and improve JEFF.
• Comply with law and protect the rights, safety, and integrity of users and the service.

JEFF does not itself use your course materials or generated exams to train a proprietary foundation model. Third-party AI processing is described below.

AI processing

JEFF sends your uploaded materials, extracted text, instructions, and related context to the Google Gemini API to analyze materials and generate content. JEFF does not intentionally save the original uploaded files in its application database after the generation request.

Google may retain prompts, files, responses, and technical metadata for limited periods for service delivery, abuse monitoring, security, and legal compliance under the applicable Gemini API terms and project settings. Google’s data use may differ between paid and unpaid service tiers. Do not submit sensitive personal information or material you are not authorized to send to an AI provider.

How we disclose information

We may disclose information in the following circumstances:

• Google and Firebase: for authentication, hosting, database storage, application infrastructure, and Gemini AI processing.
• Stripe: for checkout, payment processing, fraud prevention, and transaction administration.
• People you share with: a shared exam may be viewed by anyone who receives its link.
• Legal and safety: when reasonably necessary to comply with law, legal process, or protect rights, safety, and service integrity.
• Business transfers: in connection with a financing, reorganization, merger, sale, or transfer, subject to appropriate protections.
• With your direction: when you ask or authorize us to disclose information.

JEFF does not sell personal information. JEFF does not share personal information for cross-context behavioral advertising and does not serve targeted advertising.

Storage and retention

Signed-in account data, generated exams, study history, feedback, shared exams, and credit records may be stored in Firebase. In local development or fallback modes, exam history and blind-grading drafts may be stored in your browser’s local storage.

We retain information for as long as reasonably needed to provide JEFF, maintain transaction and security records, resolve disputes, enforce agreements, and comply with law. Saved exams remain until you delete them or request account deletion. A separately shared copy may remain accessible through its link until we delete it following a valid request. Payment processors and infrastructure providers apply their own retention requirements.

When information is no longer needed, we take reasonable steps to delete or deidentify it. Residual copies may remain temporarily in backups, security records, or legally required files.

Security

We use administrative, technical, and organizational safeguards designed to protect information, including authenticated access and encrypted provider connections. No system is completely secure, and we cannot guarantee that unauthorized access, loss, or misuse will never occur. Protect your Google account and avoid uploading unnecessary sensitive data.

Your choices and privacy rights

You can delete individual saved exams through JEFF and control whether to create a public share link. You can sign out at any time. Depending on where you live, you may have rights to access, correct, delete, receive, or restrict certain processing of your personal information, and to appeal a denied privacy request.

To request account data or deletion, email legal@jeff.aifrom the address associated with your account. We may verify your identity before fulfilling a request. We may retain information where permitted or required by law, including transaction, fraud-prevention, security, and legal records. Authorized agents may submit requests where law permits, subject to verification of their authority.

Cookies and similar technology

JEFF, Google authentication, Firebase, and Stripe may use cookies, local storage, tokens, or similar technology that is necessary to keep you signed in, preserve application state, prevent fraud, process checkout, and operate the service. JEFF does not currently use this technology for targeted advertising.

Because we do not sell personal information or use cross-context behavioral advertising, browser “Do Not Track” and Global Privacy Control signals do not change JEFF’s current practices. If our practices change, we will update this policy and honor legally required signals.

Children

JEFF is not directed to children under 13, and they may not create an account or use the service. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided information, contact us so we can investigate and delete it.

Schools and education records

A student or instructor should not upload education records or institution-controlled data unless authorized by the relevant school and applicable law. JEFF is not acting as a school official under FERPA or a similar educational privacy law unless a separate written agreement expressly says so. Schools should complete their own privacy, security, and vendor review before directing students to use JEFF.

International processing

JEFF and its providers may process information in the United States and other countries where they operate. Those countries may have different data-protection laws. Where required, we use recognized safeguards for international transfers.

Third-party privacy information

Additional information about major providers is available from:

• Google Privacy Policy
• Firebase privacy and security
• Gemini API terms
• Stripe Privacy Policy

Changes to this policy

We may update this policy as JEFF, our providers, or legal requirements change. We will post the revised policy and update the effective date. If changes are material, we will provide additional notice when reasonably practicable.

Contact

For privacy questions, requests, or complaints, email legal@jeff.ai. Please include enough detail for us to identify your account and understand the request, but do not send passwords, payment card numbers, or unnecessary sensitive information.