Privacy Policy

UpAhead, Inc. ("UpAhead," "the Company," "we," "us," or "our") is committed to protecting the privacy of our users and visitors. This Privacy Policy explains what information we collect through our website (https://upahead.online), our browser extension, our applications, and related products and services (collectively, the "Services"), how we use it, how we share it, and the choices you have.

By using the Services or providing information to us, you consent to the practices described in this Privacy Policy. If you do not agree, please do not use the Services. If you limit the information you provide, some features may not be available to you.

MODIFICATIONS AND REVISIONS

We may update this Privacy Policy from time to time. We will post the revised policy with a new "Effective date," and if changes are material we will notify you by email or through the Services. Your continued use after the Effective date constitutes acceptance of the updated policy.

INFORMATION WE COLLECT

Information You Provide Directly

• Account data: first and last name, email, phone number, physical address, password, university, and GPA range.
• Onboarding data: your school, self-reported stress level, how far behind you feel, and referral source.
• Content you submit: tasks, notes, corrections to extracted course information, and anything you enter into the Services.
• Payment data: processed by our payment processor, Stripe. We do not collect or store your card or bank details; Stripe handles that under its own privacy policy (https://stripe.com/privacy).

Academic Information You Connect from Your School

When you choose to connect your school learning platform (such as Canvas, Blackboard, or D2L), you authenticate with your own login, and we retrieve your own academic information so it can be organized inside UpAhead. This may include your courses, assignments, due dates, grades, syllabi, announcements, and course materials. We retrieve only your own data, from your own authorized session. You can disconnect at any time, which stops future syncing.

Your School Login

You sign in to your school learning platform yourself, using your own credentials, including any multi-factor authentication your school requires. We do not store your school password, and we do not retain your school login session. Your authentication authorizes the sync and is not kept by us afterward. If we ever change this, we will update this Policy and tell you before it takes effect.

Email Information You Connect

If you connect an email account, we access certain email information to provide features such as your email digest and course-related email detection.

• Gmail. UpAhead's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and improve the features you connected it for, and we do not sell it, use it for advertising, or allow humans to read it except as permitted by that policy (for example, with your consent, for security, or to comply with law).
• Outlook and Microsoft 365. If you opt in, our browser extension checks your Outlook Web mailbox for course-related email while you have Outlook open, so those items can appear alongside your coursework in UpAhead. This is off unless you turn it on, it runs only while you are signed in to Outlook yourself, and it looks only for course-related messages.

You can disconnect either email account at any time.

Calendar Information You Connect

If you connect a calendar (Google Calendar, Apple, or Outlook), we read and write calendar events to keep your schedule and assignments in sync. You control which calendars are connected and can disconnect at any time.

BROWSER EXTENSION (UPAHEAD SYNC COMPANION)

UpAhead offers an optional browser extension, the UpAhead Sync Companion, which you install yourself from the Chrome Web Store. The extension exists so that you can bring your own course data out of your school's learning management system ("LMS") and into your UpAhead account. This section describes what the extension accesses, what it sends to us, and what it never does. It supplements, and where it conflicts controls over, the general descriptions elsewhere in this Privacy Policy.

Course Data You Ask Us to Import

When you start a sync, the extension reads the pages of your school's LMS that you are already signed in to, and collects your own course information: course names and enrollment, assignments and due dates, grades, announcements, syllabi, class schedules, and course files and materials. This content is sent to UpAhead so it can appear in your account.

The extension only accesses your school's domain, and only after you explicitly grant permission to that domain at the moment you begin a sync. It does not read your browsing history, and it does not read or collect data from other websites you visit. With your permission, it also reads the session cookies for your school's domain so that we can refresh your course data on your behalf without asking you to complete multi-factor authentication every time; those cookies are transmitted to UpAhead in encrypted form, are used only to access your own LMS account, and are never used for advertising or tracking.

The optional Outlook Web Email Helper runs only if you separately turn it on and grant permission. When enabled, it identifies course-related messages while Outlook Web is open in your browser and uploads those candidate messages for your review. It does not upload your full mailbox.

Extension Diagnostic and Usage Information

Separately from your course data, the extension sends us a small amount of technical information so that we can tell whether it is working. This information never contains the contents of your courses, and depending on whether the extension is linked to your UpAhead account at the time, it is either anonymous or associated with your account — see "How this information is identified" below. We use it only to detect and fix failures, to understand which parts of the extension are used, and to measure how many installations are active. We do not sell it, use it for advertising, or use it to build a profile of you.

This information consists of a fixed set of events, each carrying only the fields listed below:

• What happened. That a sync started, succeeded, or failed; that a file transfer started, finished, or became stuck; that the extension was installed, updated, or removed; that the extension was active on a given day; that it was linked to an UpAhead account; that it encountered an internal error; and the outcome of a browser permission prompt.
• Limited technical context. The extension version, which LMS provider was involved (for example Blackboard or Canvas), a randomly generated identifier for the installation, a randomly generated identifier for the sync attempt, the time the event occurred, how long an operation took, a short predefined failure reason drawn from a fixed list, and an approximate size range for how many courses or files were involved.

This information deliberately excludes the contents of your courses. It does not contain course, assignment, or file names; web addresses or your school's domain; the text of any error message; your name, email address, or LMS credentials; or your location. We disable location lookup on these events, so we do not derive or store a geographic location from them.

How This Information Is Identified

The installation identifier is a random value generated on your device. It is not derived from your name, email address, or any other information about you, and on its own it does not identify you.

Whether an event is anonymous depends on whether the extension is linked to your UpAhead account when the event is sent. If an active link exists at that moment, the event is associated with your UpAhead account. If no active link exists, the event is associated only with the random installation identifier and is not connected to you. We do not apply identification retroactively: events sent before a link existed are not later connected to your account. The event recording that you removed the extension is always anonymous, because once the extension is removed there is no longer any link to read.

These events are retained for thirty (30) days and are then automatically deleted.

We share this information with our analytics providers, PostHog and Amplitude, who process it on our behalf under their respective terms. Because this information is generated by the extension itself, removing the extension from your browser stops it. Removing the extension causes one final event recording that it was removed.

PURPOSE OF COLLECTION

When you upload files such as a syllabus or course document, we process them to extract course and assignment information and to generate study materials (for example, flashcards and quizzes). See "AI Chat and Other AI Features" below.

Information Collected Automatically

As you use the Services, we and our providers automatically collect device and usage data, including IP address, device identifiers, operating system, browser type, pages and features used, clickstream, and similar diagnostic and analytics data, through cookies and similar technologies (cookies, web beacons, pixels). This helps us secure, operate, analyze, and improve the Services.

Information from Third Parties

We may receive information about you from partners, service providers, and platforms you use to sign in or interact with us (such as Google, Apple, or social platforms), governed by those platforms' own policies.

BROWSER EXTENSION

UpAhead offers an optional browser extension that helps you bring your school course information into UpAhead and keep it current. You choose to install it, and it works on your behalf using your own login to your own school learning platform.

What our browser extension accesses. When you are signed in to your school learning platform and viewing your own courses, the extension reads the academic information on the pages you view, such as your courses, assignments, due dates, grades, syllabi, and announcements, so that information can be organized (synched) inside UpAhead. Access is entirely student-initiated: it acts only on your own account, only while you are the one signed in, and only on the school learning-platform pages related to bringing your course information into UpAhead. If you have opted in to Outlook email checking, it also looks for course-related messages while Outlook is open, as described above.

What it does not collect. The extension is built to reject, not merely hide, sensitive data. It does not collect your passwords, cookies, authentication tokens, hidden form values, credential-like web-address parameters, raw page content, or screenshots. New categories of data cannot be turned on without passing an internal privacy review first.

Processed locally versus transmitted to us. The extension reads pages in your browser and sends UpAhead only the course information it is allowed to extract, so that information can be saved to your account and shown across your devices. Diagnostic information the extension reports back to us is limited to counts, status codes, and run identifiers, and cannot carry your course names, file names, web addresses, or personal details.

You control the browser extension and the course information you share with UpAhead. You can disconnect your school account or remove the extension at any time, which stops future syncing. Removing the extension does not by itself delete information already saved to your UpAhead account; you can delete that through your account or by contacting us.

AI CHAT AND OTHER AI FEATURES

Some features, including our AI chat, use artificial intelligence. When you use them, the relevant content is sent to an AI model to generate a response. We send only what the feature needs (for example, the relevant course information or the file you uploaded).

AI providers. Our AI chat and other AI features run on third-party providers, which currently include Anthropic and OpenAI, and may include other providers or models that we operate ourselves. We may change or add providers over time to improve quality, performance, and reliability.

Limits our AI providers are under. Where we rely on third-party providers, we use their business or enterprise API tiers, under terms that require them to:

• process your information only to provide the service to us, and not for their own purposes;
• not use information submitted through our account to train their models;
• not sell or otherwise disclose that information to further third parties, except as needed to run the service or to comply with law;
• maintain industry-standard security controls, including encryption in transit and at rest and access controls limiting who can view data; and
• retain information only for a limited period for abuse monitoring and legal compliance, after which it is deleted.

AI conversation history. Your conversations with our AI chat are saved to your account so you can pick up where you left off, and may be reviewed and used to maintain and improve the Services, including the quality and safety of our AI features. You can delete conversations at any time, or request full deletion of your history by contacting us or deleting your account. Deleted conversations are removed from your account immediately and from our systems within 30 days.

HOW WE USE YOUR INFORMATION

• Provide the Services, including syncing your academic data, organizing assignments, calendar, grades, and study tools.
• Provide the AI chat and other AI features (see above).
• Process payments.
• Send service and transactional messages about your account and the Services.
• Market to you. We may use your contact information to send marketing and promotional messages about UpAhead products, new features, offers, and other UpAhead services, including to existing customers. You can opt out of marketing messages at any time via the unsubscribe link; we will still send necessary service and transactional messages.
• Secure and improve the Services, diagnose issues, analyze usage, and develop new features.
• Comply with law and enforce our agreements.

HOW WE SHARE INFORMATION

We do not sell your personal information. We share it only as described in this section.

• Service providers and sub-processors who help us run the Services under contract, including: Google Firebase / Google Cloud (hosting and storage), Stripe (payments), Anthropic and OpenAI (AI chat and other AI features), Amplitude and PostHog (product analytics), and Sentry (error monitoring). They may use your information only to provide services to us.
• Sharing you choose (organization and supporter access). If you belong to a group that uses UpAhead (such as a fraternity, sorority, or other student organization), or if you invite a parent or supporter, you may choose to share certain information with that group's administrator or your supporter. This sharing happens only when you opt in and consent. An administrator or supporter cannot see your information unless you have chosen to share it, and supporter views are filtered consistent with student-privacy expectations. You can review what you have shared and stop sharing at any time.
• Advertising and measurement. We work with advertising and measurement partners (including Meta) to understand how well our own marketing works, using pixels and conversion measurement, so we can promote UpAhead to people likely to find it useful. See "Advertising" below for your choices.
• Legal and safety, where reasonably necessary to comply with law, respond to lawful requests, enforce our terms, prevent fraud or abuse, or protect rights, property, and safety.
• Business transfers. Your data may transfer to another entity in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.
• De-identified or aggregate data, which we may share for any lawful purpose.

What we never sell or share for advertising. We never sell, and never use for third-party advertising, any of the following:

• Data obtained through Google APIs. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
• Academic data derived from your school learning platform, including courses, assignments, grades, syllabi, announcements, and related course materials.
• Email content from any mailbox you connect.
• Education records.
• Any data provided under an institutional agreement.

TRACKING TECHNOLOGIES AND COOKIES

We use cookies and similar technologies (cookies, web beacons, pixels) to operate the Services, remember preferences, secure accounts, analyze usage, and measure how well our own marketing performs. Some of these are set by our analytics and advertising partners, including Meta, Amplitude, and PostHog. We do not use these technologies on academic data, education records, or email content. You can control cookies through your browser settings, though some features may not work without them.

ADVERTISING

We may use advertising and marketing partners to promote the Services, including interest-based advertising for UpAhead's own products. You can learn about and opt out of interest-based advertising through the Digital Advertising Alliance (https://www.aboutads.info/choices) and the Network Advertising Initiative (https://www.networkadvertising.org/choices).

YOUR CHOICES

• Access and update: review or update your information in your account, or by contacting us.
• Export and deletion: request a copy of your data or delete your account and associated data.
• Disconnect integrations: disconnect your LMS, Gmail, Outlook, our browser extension, or calendar at any time.
• Stop sharing: revoke sharing with any organization administrator or supporter.
• Marketing opt-out: unsubscribe from marketing messages at any time.
• Do Not Track: browser DNT signals are not standardized; we do not currently respond to them.

CHILDREN

The Services are built for college students and are not intended for children under 18. If you are under 18, you may use the Services only with the permission of a parent or guardian. We do not knowingly collect personal data from children under 13. If we learn we have collected such data without appropriate consent, we will take reasonable steps to delete it. If you believe a child under 13 has provided us information, contact us.

RETENTION

We retain your personal data for as long as your account is active and for up to 12 months after account deletion, unless a longer period is required or permitted by law (for example, for tax, accounting, or legal purposes), after which we delete or de-identify it.

SECURITY

We use appropriate technical and organizational measures to protect your information from unauthorized access, disclosure, or destruction, including encryption in transit and at rest, access controls, and review of new data collection before it ships. No system is 100% secure, and we cannot guarantee absolute security.

INTERNATIONAL TRANSFER

The Services are hosted in the United States. If you access them from outside the U.S., your information will be transferred to, stored, and processed in the U.S., which may have different data-protection laws than your country. By using the Services, you consent to this transfer.

Contact Us

Questions about this Privacy Policy: