Privacy policy

Last updated 7 October 2026

Lectheo is a study tool built for the ForgeHacks 2026 hackathon. This page explains what we store, who processes it, and how to delete it. We keep as little as we can.

What we collect

• Google sign-in: your name, email address and a Google account id (scopes openid, email, profile only). We never see your Google password.
• Sample accounts: an anonymous account with no personal details.
• Your study data: courses and lectures you add, lecture transcripts, the moments you mark (“lost” / “important”), your answers, confidence ratings, practice conversations and the resulting mastery state.
• Operational data: request logs (time, route, anonymous request id) and a record of AI calls (task, model, token counts, cost) used to keep the service within budget.
• Your IP address, only as the key of a counter that limits how often the sample-account button can be used. Counters older than 24 hours are removed when the next sample account is created.

What we don't collect

• Imported video never leaves your device. It plays from your own laptop; only its transcript is uploaded.
• Uploaded or recorded audio is deleted as soon as it has been transcribed, and the copy at the transcription provider is deleted too.
• Speaker names are removed from imported transcripts.
• No advertising, no tracking cookies, no selling of data.

Who processes your data

• Supabase — database, sign-in and file storage.
• Vercel — hosting, and the AI Gateway that routes AI requests.
• Anthropic, OpenAI, Google and TypeSafe (via Vercel AI Gateway) — generate questions, play the practice personas, check questions and grade answers. They receive lecture text and your practice answers, not your name or email.
• Google (Gemini API, called directly) — receives the link of a YouTube video you add, to transcribe it. Only the link is sent: the video is never downloaded. The transcript of a public video is kept and reused for other students; it holds none of your data.
• YouTube Data API — checks a video you paste (public, embeddable, length, language) before anything else happens. It receives the video's id only.
• AssemblyAI — transcribes audio, only when you upload or record audio.
• Cloudflare Turnstile — bot check on the sample-account button.
• YouTube — plays the library lectures and the YouTube lectures you add. Your browser loads YouTube's player script and a privacy-enhanced embed (youtube-nocookie.com) when you watch one, and the video's thumbnail (i.ytimg.com) when you paste a link.
• CS50 — if the YouTube embed fails, your browser fetches the lecture's official audio from cdn.cs50.net instead.

Recording consent

Before you record or upload a lecture, Lectheo asks you to confirm you have permission to record or use it. Please respect your institution's rules and your classmates' privacy.

Retention and deletion

• Sample accounts and all their data are deleted automatically after 24 hours.
• Deleting a lecture removes its transcript, markers, questions and practice history. Deleting a course does the same for every lecture in it.
• Google accounts are kept until you delete them. You can delete your account at any time from the account menu (Delete account): it removes your courses, lectures, markers, practice, uploaded files and your sign-in. The AI-call cost record (token counts and cost, no content) is kept, with your bare user id, for budget accounting. If you can't sign in, email adam.c11304@gmail.com and we will delete it for you.

Contact

Questions about this policy: adam.c11304@gmail.com.