Privacy Policy
The short version. Your projects, notes, AI Record, AI conversations and files stay on your own device. We do not see them, and we do not want them. We keep only what we need to run your account: your name, your email address, your plan and payment status, and the records of the agreements you gave. We do not sell or rent personal information, we do not share it for advertising, we show no advertising, and we do not track you across other websites.
1. Who we are and what this policy covers
1.1. This Privacy Policy explains how Mark T. Fulwider, doing business as TheoreticalPhysics.ai ("we," "us," "our"), handles personal information in connection with the website at theoreticalphysics.ai and its related domains, Study Hall, Desk Top, the AI Record, the installable app, and the AI Record browser add-on (the "Service"). We are the business responsible for your personal information. Our contact details are in Section 17.
1.2. This policy is part of our Terms of Service. Words defined in the Terms have the same meaning here. Our Children's and Students' Privacy Notice gives additional information for parents of children and teenagers, and for schools.
2. What we never collect
2.1. The Service is built so that the following never reach us:
- Your Work. Projects, notes, questions, sources, reading lists, drafts, equations, AI Record pages and files are saved in your browser's own storage on your device and in the TP.AI folder you choose on your computer. They are not sent to our servers.
- Your AI conversations. When you talk to an AI assistant (such as ChatGPT, Grok, Claude or Gemini) on its own website, the AI Record add-on copies your questions and the answers only into your own AI Record on your own device. The add-on sends nothing to us or to anyone else.
- Your AI keys. If you choose to enter a key for an AI service, it is kept only in your browser on your device, and your browser sends requests directly to that AI service.
- Your full card number. Payments are made on Stripe's or PayPal's own secure pages. We receive only a reference to your customer account and the status of your plan.
- Your birth date. We ask for the month and year you were born when you create an account, use it only to decide which age rules apply, and do not keep it.
- The contents of anything you share. A copy you choose to share is locked (encrypted) in your browser before it is uploaded. The key is in the private link, after the "#" sign, which browsers do not send to servers. We store the locked copy but cannot open it.
3. Personal information we collect
3.1. Account information you give us. Your name (or the username you choose), your email address and your password. We store the password only as a one-way, salted hash; we cannot read it. If you sign in with Google or X, we receive your name, your email address and an identifier for your account from that company, through the sign-in service that connects us to it.
3.2. Age group and consent records. Whether your account is an adult account, a teen account (13 to 17) or a family account for a child under 13; the date and version of the Terms and Policies you agreed to; for a teen account, your parent's or guardian's email address and the confirmation that they agreed; for a family account, the parent's consent and the date it was verified; and your agreement to automatic renewal when you buy a plan, as California law requires us to keep.
3.3. Plan and payment information. Your plan, monthly or yearly cycle, whether you have used your free trial, the dates your plan started, renews or ends, whether a payment succeeded or failed, and the identifiers Stripe or PayPal give us for your customer account and subscription. Stripe and PayPal collect your payment details directly under their own privacy policies.
3.4. Shared copies. For each copy you share: the locked copy itself (which we cannot read), its size, when it was made and when it expires, its settings (such as whether it has a passcode, which is checked only in the recipient's browser, and whether it may be downloaded), and a one-way fingerprint of your account (a value derived from your account identifier that cannot be turned back into it) so that we can count the storage you use against your allowance.
3.5. Password-reset requests. When you ask to reset your password, we store a one-way fingerprint of the one-time link we email you, and its expiry time (one hour).
3.6. Messages you send us. If you write to us, we keep your message, your email address and our reply so that we can help you.
3.7. Technical information. Like every website, our servers and our hosting provider receive technical information with each request your browser makes, such as your IP address, the date and time, the page or address requested, your browser type and operating system, and the referring page. We use it to deliver the Service, to keep it secure (for example, to limit the number of requests from one address so the Service cannot be overwhelmed), and to find and fix problems. Our servers keep request counts for these limits in memory only for a few minutes; our hosting provider keeps access logs for a limited time under its own policy.
3.8. Old Word documents. If you open an older Microsoft Word file (".doc") in Study Hall, the file is sent to our server only so its text can be read and returned to your browser at once. We do not store the file or its text.
3.9. Cookies and storage on your device. We use only what is strictly necessary: a sign-in cookie that keeps you signed in, and your browser's own storage to keep Your Work, your settings and pages for use offline. We use no advertising cookies and no analytics or tracking cookies. See the Cookies and Local Storage Notice.
4. How we use personal information
4.1. We use personal information only to:
- create and run your account, sign you in, and keep your account secure;
- provide the features you ask for, such as sharing, and enforce the sharing allowance;
- process payments, run free trials, renew and cancel plans, and send the notices the law requires, such as receipts, trial and renewal reminders, and notices of price changes;
- apply the age rules, obtain and record the consents described in Section 3.2, and send the notices to parents described in the Children's and Students' Privacy Notice;
- answer your questions and requests;
- send you messages about your account, your plan, security, and changes to our Terms or this policy (we do not send marketing email unless you ask us to, and you can stop it at any time);
- keep the Service and its users safe, prevent fraud and misuse, and enforce our Terms; and
- comply with the law, respond to lawful requests, and establish or defend legal claims.
4.2. We do not use personal information for advertising, we do not build profiles of you for any purpose other than running your account, and we do not make decisions about you using automated processing that has legal or similarly significant effects.
4.3. We do not use Your Work or your conversations to train artificial-intelligence models; we do not have them.
5. How we share personal information
5.1. We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have not done so in the past 12 months.
5.2. We share personal information only as follows:
- Service providers that run parts of the Service for us, under contracts that allow them to use it only to provide their services to us: our website hosting provider (Vercel); our account database provider (Neon); our storage provider for locked shared copies (Cloudflare R2); our email delivery provider for account and password-reset email (Resend); our payment processors (Stripe and PayPal); and the sign-in service that connects Google and X sign-in to our Service. These providers are located in the United States.
- Companies you choose to use, such as Google or X when you sign in with them, and Stripe or PayPal when you pay. They receive information directly from you under their own privacy policies.
- People you share with. Anyone you give a sharing link to (and its passcode, if any) can open that shared copy.
- Your teacher, when you turn in an assignment. A teacher's class link carries the assignment and its AI rule inside the link itself; we do not receive it. When you press Turn in, a locked shared copy is made of only what the Turn in page shows you (the paper you choose, that assignment's AI Record conversations, its sources, your reflection, and that assignment's Notes only if the teacher asked), and you send the link yourself. Your teacher sees nothing else, and we cannot read it.
- For legal reasons, when we believe in good faith that disclosure is required by law, subpoena or other legal process, or is necessary to protect the safety of any person, to protect the rights and property of TheoreticalPhysics.ai or our users, or to investigate fraud or a security incident.
- In a business transfer, such as a sale, merger or reorganization of the Service, to a successor that agrees to honor this policy for information already collected. We will notify you before your information becomes subject to a different privacy policy.
6. Artificial-intelligence services
6.1. When you talk to an AI assistant on its own website, or when your browser sends a request to an AI service using a key you entered, you are dealing directly with that AI company, and its terms and privacy policy apply to what you send it. We do not receive, see or store those conversations. Please read the privacy policy of every AI service you use. See the AI Features Notice.
7. The AI Record add-on
7.1. The AI Record add-on runs only on the AI websites it names and on theoreticalphysics.ai. It asks your browser for one permission, to store data in the browser. While your AI Record is turned on, it reads the questions you send and the answers you receive on those AI websites, and passes them to your AI Record on your device. If no AI Record page is open, it keeps the lines in your browser until one is. It reads nothing else, sends nothing to us or to any other server, and does not type or click on the AI websites. Removing the add-on deletes everything it was keeping.
7.2. Chrome Web Store User Data Policy. The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. The add-on uses the information it handles only to provide its single purpose, copying your AI conversations into your own AI Record; it does not transfer that information to anyone, does not use it for advertising or for creditworthiness or lending, and no person reads it.
8. How long we keep personal information
- Account information: while your account is open. When an account is closed, we delete it within 30 days, except for what we must keep for the reasons below.
- Consent records (agreements to the Terms, parental consent, agreement to automatic renewal): for as long as the account is open and then for the longer of three years after the consent was given or one year after the plan ends, as California's automatic renewal law requires, or longer if needed to establish or defend a legal claim.
- Payment and plan records: as long as needed to provide the plan and for the period tax and accounting laws require (generally up to seven years); card details are held by Stripe or PayPal, not by us.
- Shared copies: until the end of the period you chose (7, 30 or 120 days, renewable, but never more than 240 days after the copy was made), or until you or the account is deleted, whichever is first. Our storage provider removes anything left over after 245 days.
- Password-reset links: one hour.
- Support messages: up to two years after the conversation ends.
- Technical request information: minutes in our own servers' memory; our hosting provider keeps access logs for a limited period under its policy.
8.1. Your Work is kept on your device for as long as you keep it there; deleting your account does not delete it from your device.
9. Security
9.1. We protect personal information with administrative, technical and physical safeguards suited to its sensitivity, including encryption of all connections (HTTPS), hashing of passwords and one-time links, locking of shared copies in your browser before upload, keeping secret keys only in the server environment, limits on requests, verification of payment notifications, and a written information-security program that we review at least once a year. No system is perfectly secure, and we cannot guarantee the security of information sent over the internet. If we learn of a security breach affecting your personal information, we will notify you and the authorities as the law requires.
10. Your choices and rights
10.1. Everyone. Whatever the law where you live, you may ask us to: tell you what personal information we hold about you and give you a copy; correct it; delete it and close your account; or stop sending you any non-essential messages. You can cancel your plan and delete your shared copies yourself in the Service.
10.2. California residents. California law gives you the right to know the categories and specific pieces of personal information we collect, the sources, the purposes, and the categories of third parties we disclose it to; to delete it; to correct it; to opt out of its sale or sharing for cross-context behavioral advertising (we do neither); to limit the use of sensitive personal information (we use account log-in information only to sign you in); and not to be discriminated against for exercising these rights. The categories we collect are: identifiers (name, email address, account identifiers, IP address); customer records (plan and payment status); characteristics of protected classifications (only your age group); commercial information (plans bought); internet activity information (technical request information); and inferences (none). Sources: you, your browser, the sign-in companies you choose, and our payment processors. We disclose these categories for business purposes only to the service providers named in Section 5.
10.3. "Shine the Light." We do not disclose personal information to third parties for their own direct-marketing purposes (California Civil Code § 1798.83).
10.4. How to make a request. Email privacy@theoreticalphysics.ai from the email address on your account, or write to us at the address in Section 17. We will confirm your request within 10 business days and answer within 45 days (we may extend this once by 45 days if we tell you why). To protect you, we verify a request by confirming it from the email address on the account. You may use an authorized agent; we will ask the agent for your signed permission and may ask you to confirm your identity directly. We do not charge for requests unless they are manifestly unfounded or excessive. If we deny a request, we will explain why and how you can appeal, by replying with the word "Appeal"; we will answer an appeal within 45 days.
10.5. Minors' right to remove content. If you are under 18 and a registered user, you may remove any copy you have shared at any time in the Service, or ask us at privacy@theoreticalphysics.ai to remove it. Removal makes the copy unavailable to others, but it does not remove copies that people you shared the link with may have made (California Business and Professions Code § 22581).
11. Do Not Track and Global Privacy Control
11.1. We do not track you across other websites over time, and we do not allow other companies to do so through our Service, so there is nothing for a "Do Not Track" signal to turn off. We honor Global Privacy Control signals as a request to opt out of the sale or sharing of personal information, which we do not do in any case.
12. Children and teenagers
12.1. The Service is meant for people 13 and older, and for children under 13 only through a family account set up by a parent who has given verifiable consent. Teens 13 to 17 need a parent's or guardian's agreement. We do not knowingly collect personal information from a child under 13 without verified parental consent. Please read the Children's and Students' Privacy Notice, which explains what we collect, the rights of parents, and how to exercise them.
13. Students and schools
13.1. Many of our users are students, including students taught at home. We do not use students' personal information for targeted advertising, we do not build profiles of students except to run their accounts, and we never sell students' information. If a school or school district wishes to use the Service, please contact us so that we can put an appropriate written agreement in place, including for the purposes of the Family Educational Rights and Privacy Act and state student-privacy laws.
14. People outside the United States
14.1. The Service is operated from the United States, and the personal information we hold is stored and processed in the United States, where the law may differ from the law where you live. By using the Service you understand that your information will be handled in the United States as this policy describes.
15. Links to other websites
15.1. The Service links to other websites and services that we do not control. Their privacy practices are governed by their own policies.
16. Changes to this policy
16.1. We will post any change to this policy on this page with a new effective date. If a change is material, we will tell you by email or by a notice in the Service before it takes effect, and where the law requires (for example, before using a child's information in a materially different way), we will ask for consent again.
17. Contact
Mark T. Fulwider, doing business as TheoreticalPhysics.ai
4100 Cedar St., Rocklin, California 95677
Telephone: (916) 412-9720
Email: mark@theoreticalphysics.ai
Privacy questions and requests: privacy@theoreticalphysics.ai
Help: support@theoreticalphysics.ai
