This notice explains what personal data Learning Buddy collects, why we collect it, who we share it with, and the rights you and your child have under Singapore's Personal Data Protection Act 2012 (PDPA). It applies to anyone using https://alevel.kanchasinau.com.
Learning Buddy is a personal AI tutoring tool operated by the project maintainer. For data-protection questions or requests, contact us at [email protected].
Parent account. Email address, your name (optional), a salted bcrypt hash of your password, and (if you sign in with Google) your Google account ID and email. We never see or store your raw password.
Child profile. First name, date of birth, exam level/board, daily quiz time, subject preferences, and the Telegram chat ID once paired.
Quiz activity. Generated questions, the child's typed answers, photo uploads of handwritten work, AI-generated grades and feedback, and per-topic performance summaries.
Operational logs. IP address and user agent at the time of consent (for the consent audit log only); standard server logs of HTTP requests for security and debugging.
We do not sell or share personal data for advertising. Limited sharing happens with the following processors, only to provide the service:
api.openai.com for generation and grading. OpenAI does not train models on API data by default.Photo grading additionally depends on legibility — handwriting that is unclear in the photo may be misread. AI-generated diagrams or worked solutions may contain mathematical or scientific errors. Always cross-check important content with your teacher or a textbook.
We keep account and quiz data for as long as the account is active. You can delete a child profile (which removes its quizzes, submissions, drafts, and progress) or your entire account from the dashboard at any time. Server logs are kept for up to 30 days.
Under PDPA you have the right to:
Account → Export my data in the dashboard, or email us.Learning Buddy is intended to be set up by a parent or legal guardian on behalf of their child. When you create a child profile, you confirm that you are the child's parent or guardian and that you consent to the processing described in this notice on their behalf.
For children aged 13 and over, we additionally ask the child to acknowledge the AI limitations described in section 5 the first time they open a quiz on the web. We do not knowingly collect data directly from a child under 13 without parental consent.
Passwords are stored as bcrypt hashes. Sessions use a signed JWT cookie marked HttpOnly and Secure. Traffic is encrypted in transit via TLS (Cloudflare). The service runs on a private home server; access to the database is restricted to the application container and the operator.
If we materially change this notice, the version number above changes and we will ask you to re-consent on your next login. Past consents (with version, timestamp, IP, and user agent) are retained as an audit trail.