How ThetaOS handles your data.

Last updated October 10, 2026.

ThetaOS ("we", "us") is built in Seattle, Washington. This policy explains what we collect when you use ThetaOS, how we use it, who can see it, and the choices you have. By using ThetaOS you agree to this policy.

1. Information we collect

Account information. When you sign in with Google we receive your name, email address, and profile photo. If you contact us, we keep the correspondence.

Email links. If you ask us to email a link to your computer, we use that address to send it. A link identifier and a protected address hash let us measure whether the link is visited and a matching new account is created, including on a computer. The identifier does not sign you in. This first-party signup measurement also works when you decline optional ad measurement.

School content. When you connect a school system (for example Canvas or Brightspace) or upload a syllabus, we sync and store the content those connections return for your account: classes, assignments, due dates, grades, modules, files you open through ThetaOS, and course images. Connection credentials and tokens are encrypted at rest.

Lectures. In the iPhone app, a lecture is transcribed by your own device. The audio never leaves it, and no transcription provider ever receives it. The words on screen while the class runs are the record, and if that pass comes back empty the app reads the audio it kept and tries again, still on the phone. The audio stays on your iPhone and is deleted after a week. Only the transcript and the summaries made from it are sent to us and stored in your account. On the web, audio is saved in your browser for recovery and sent in short chunks through OpenRouter for transcription using Whisper large-v3-turbo. OpenRouter routes these requests to its available transcription providers, currently Groq and DeepInfra. When cloud transcription is unavailable or your monthly allowance is used, an on-device model transcribes the saved audio. Recording other people has legal rules, and section 3 of the Terms puts responsibility for them on you.

Chats and files. Your conversations with the ThetaOS agent, files and images you attach, and documents ThetaOS generates for you are stored in your account.

Device files and data. ThetaOS reads from your device when you use features that ask it to: files you attach, images you paste, lectures you record, and, in desktop versions of ThetaOS, files and folders on your computer that ThetaOS features access to give the agent context. Anything a feature reads this way is collected under this policy, and using the feature is your permission for that access.

Agent browser sessions. On plans that include it, ThetaOS can open a real browser inside your school system using the session you signed in with, and stream it to your screen while it works. We store a record of every such session: what it was for, the page it opened, whether it read or changed something, whether you approved it, and how it ended. The video of the session is streamed to you live and is not recorded. Page contents the agent reads are handled the same way as the rest of your school content above.

Writing samples. If you teach ThetaOS your writing voice, the samples you provide and the style profile built from them are stored in your account. You can delete either at any time in the product.

School research. ThetaOS researches how schools work - which system they run, how they grade, how their year is shaped - from public sources. That research is about the institution, not about you, and is shared across students at the same school. It contains no personal information.

AI detection and humanizing. When you ask ThetaOS to check or humanize a draft, the text of that draft is sent to Copyleaks, a third-party AI-detection service, which returns a score. ThetaOS may then rewrite the draft in your own voice and check it again. The draft text and the scores are stored in your account.

Payment information. Payments are processed by Stripe. We receive your plan, billing status, and a customer reference. Your card number never touches our servers.

Usage information.Log data, device and browser information, feature usage, and model usage metrics (for example credits consumed), used to run, secure, and improve the service. On the website this includes which pages you open and which buttons you use, and recordings of how the app is used (the layout, the pointer and the scrolling) with every letter, everything you type and every image hidden, so they never show the content of your classes. They are tied to your account's ID, not your name or email. We keep this record on our own database as well as in PostHog. Before you have an account, it is tied to a random ID your browser stores, which is not derived from anything about you and is cleared when you sign out.

2. How we use information

We use the information we collect to:

(a) provide and personalize the service, including giving the ThetaOS agent the context that makes it useful (your classes, assignments, grades, syllabi, lectures, and chat history);
(b) process payments and manage plans;
(c) keep the service safe, prevent abuse, and enforce our terms;
(d) provide support and respond to you;
(e) improve and develop our products and AI systems, including training and fine-tuning the models and systems that power ThetaOS, using content and usage data from your account; and
(f) analyze aggregate usage to understand what to build next;
(g) create aggregated and de-identified data, which we own and may keep and use without limit, including after your account closes; and
(h) comply with the law and respond to lawful requests.

Who can read what is in your account. Authorized ThetaOS people and systems can access, view and process any content and activity in an account where it is needed for the purposes above: fixing faults, support you asked for, safety and abuse review, legal compliance, enforcing the Terms, and building the product. Access is limited to people who need it for those purposes and every account is isolated from every other one.

Ad measurement is optional. If you choose Allow under Ad choices on our public pages, we send TikTok accepted email requests, new account registrations, the public page visited, and generic milestones for a successful class import and the start of free product access, along with your IP address, browser information and, when present, the TikTok ad click identifier. If you accept our updated email-matching choice, we also send a SHA-256 hash of your verified account email, normalized to lowercase with surrounding spaces removed. TikTok can match this hash to an email it already has; hashing does not make it anonymous. Older consent does not permit this matching. With your permission, TikTok may also use its browser identifier and cookies. On the public home page its browser pixel runs inside an isolated frame that cannot read our forms or account information. It can also run on a separate signup confirmation page containing no account or school data. We do not send names, raw emails, account IDs, classes, grades, assignments, lectures or chats. We remember your choice for a year and an allowed click identifier for up to 30 days. For background milestones, we keep your consented browser information encrypted for up to 30 days. Failed deliveries retry with the same event identifier and original time, for at most seven days. The email hash is kept in that encrypted context under the same retention limit. We ask again before adding milestones or email matching to an older consent. Choose No thanks under Ad choices to stop future ad measurement. We honor Global Privacy Control and Do Not Track. Declining does not affect your access to ThetaOS.

Your choice about training. You can opt out of your content being used to train our AI systems at any time by emailing duggalshaurya1234@gmail.com from your account email with the subject "Do not train". Opting out does not change anything else about your service.

3. Who can see your information

Our team. Authorized ThetaOS team members can access account content when needed to operate the service: debugging, support you request, safety and abuse review, and product development, including reviewing content used to improve our systems under section 2(e).

Classmates. Students who share a class with you can see your name, profile photo, and which classes you share. They can never see your chats, plans, grades, files, or plan tier.

Organizations.If your account is provisioned by, or you join it to, an organization such as a school, district, or team, administrators of that organization may be able to view account activity and content covered by that organization's agreement with us. We will make the scope of organizational access clear when you join one.

Legal. We may disclose information if required by law, or to protect the rights, safety, or property of ThetaOS, our users, or others.

We do not sell your personal information. We do not share your data with your school unless you or your organization set that up under the paragraph above.

4. Subprocessors

We use the following service providers to run ThetaOS. AI providers may also use request data as described below:

Supabase (database, authentication, and storage, United States)
Vercel (application hosting and content delivery)
Railway (background sync workers)
Stripe (payment processing)
Google (sign-in)
OpenRouter (AI model routing and web audio transcription)
Groq and DeepInfra (web audio transcription through OpenRouter)
Anthropic (AI models)
OpenAI, Google, Meta, xAI, and Moonshot AI (AI models, reached through OpenRouter)
Copyleaks (AI detection on drafts you ask us to check)
Apple (push notifications, and the on-device transcription that runs on your phone and sends us nothing)
PostHog (product analytics: which pages and buttons are used, and recordings of the app with all text, typing and images hidden; never the content of your classes)
TikTok (optional ad measurement of public visits, email requests, registrations, successful class imports and trial starts, only after you choose Allow)

AI model providers process the content of a request in order to generate the response. We pay these providers for that access on commercial terms. As of September 21, 2026, Theta uses Muse Spark Contributor through OpenRouter with paid-provider training enabled. Eligible providers may use prompts and responses to train their models under their terms. This includes class content included in those requests. Our training opt-out in section 2 concerns Theta's own systems; it does not itself change a provider's data policy. We will update this list as providers change; material changes will be reflected in this policy's date.

Where a recording actually goes. In the iPhone app, nowhere: the audio is transcribed by your own device and stays on it, and only the resulting text reaches us. On the web, short audio chunks pass through our server and OpenRouter to a transcription provider. The original audio stays in browser storage for recovery; we store the resulting transcript and usage records in your account.

The history of this paragraph, kept because a privacy policy should not quietly rewrite itself. It once said the audio never left your phone. That was wrong: until September 2026 the app sent every piece to Groq for transcription, and the paragraph was corrected to say so on September 5, 2026. On September 7, 2026 that path was removed from the iPhone product and Groq was dropped as a subprocessor. On September 21, 2026, cloud transcription was reintroduced for web recordings through OpenRouter. The iPhone recording path remains on-device.

5. Retention and deletion

We keep your information while your account exists. Settings has a delete-account control: it permanently removes your profile, classes, assignments, transcripts, chats, files, writing samples, browser action records, and school credentials, then the account itself. Research about your school is not deleted with your account because it is not about you. Residual copies in encrypted backups are purged within 30 days. Data already used to improve our systems under section 2(e) before deletion is retained in derived form (for example, inside a trained model) but is no longer attributable to you.

6. Your rights

You can access and export your content from the product, correct your profile, delete your account, and opt out of training as described above. Depending on where you live (for example California or the EEA) you may have additional rights to access, correct, delete, or port your data, and to object to certain processing. To exercise any right, email us; we will respond within 30 days.

7. Students under 18, and children

ThetaOS is for students 13 and older. We do not knowingly collect personal information from children under 13. If we learn that an account belongs to a child under 13, we close it and delete its information. A parent who believes their child under 13 has an account should email us and we will delete it.

If you are 13 to 17, a parent or legal guardian must read this policy and the Terms and agree to them on your behalf before you use ThetaOS. By using ThetaOS while under 18 you confirm that they have done so and that they consent to the collection and use of your information described here, including the recording and transcription of classes, the use of your content to improve and train our systems (which they or you can opt out of at any time), the sending of drafts to the AI-detection service, and the charges on the payment method used for the account. Your parent or guardian may exercise every right in section 6 on your behalf, including seeing your data, correcting it, opting out of training, and deleting the account, by emailing us from the address on the account or verifying their identity another way.

ThetaOS is sold directly to students and families, not to schools. We are not a school official acting under FERPA, and content synced from your school system sits in your account because you connected it, not because your school gave it to us.

8. Security

School credentials are encrypted at rest with keys that never leave our servers. Every account's data is isolated with row-level security; no other user or agent can read it. Traffic is encrypted in transit. No system is perfectly secure, so use a strong sign-in and tell us immediately about anything suspicious.

9. Changes

We may update this policy at any time as the product and its providers change. If a change meaningfully expands how we use your data we will notify you in the product or by email before it takes effect. Continuing to use ThetaOS after the effective date means you accept it; if you do not, stop using ThetaOS and delete your account. The version on this page is always the one in force, and its date is at the top.

10. Contact

Privacy questions: duggalshaurya1234@gmail.com.