Privacy Policy

• Your account: your name, your email address, and your password. The password is stored as a one-way scrypt hash, never as the password itself.
• Your plan and setup answers: which plan you are on, when your free trial ends, when you cancelled your plan if you have, your answers to the three questions asked when you set up your account (your year level, how you plan to use Grasp, and what you most want help with), and whether you have used the one-time timetable read.
• Email confirmation: when you confirmed your email address, and a record of each confirmation link sent to you until it is used or expires 24 hours later.
• Password resets: a record of each password reset link sent to you, kept until it is used or expires one hour later.
• Your study material: your subjects, class times and assessment dates, the notes you write or record, your quizzes with your answers and marks, and the text Grasp reads out of documents you add to a Resource Bank.
• Usage records: when you generate or mark a quiz, make a recording (and how long it ran), have a Resource Bank document read, or use AI tokens, with the time, so Grasp can apply your plan's weekly limits.
• Answers you flag: if you mark an AI answer as wrong, a copy of that answer is kept so it can be looked into.
• Payment records: when you start a plan, your card is taken directly by Stripe, our payment processor — Grasp never sees or stores your full card number. Grasp keeps Stripe's customer and subscription ids for your account, and the status and renewal date of your subscription, so it can show you your plan and apply your weekly limits.
• Free trial records: when you start a free trial, Grasp keeps a one-way scrambled form of a reference to the card used, so that the same card cannot be used to claim a second free trial under a different account. It cannot be turned back into your card details.
• Sessions: a record of each device you are logged in on, so you stay logged in.
• Failed sign-in attempts: a count of recent failed attempts to log in, sign up or change a password, so that nobody can guess their way into your account. Grasp stores only a one-way scrambled form of the email address tried and the network address it came from, which cannot be turned back into either, and these counts are deleted automatically within 24 hours.
• Visits and sign-up steps: when you open the home, sign-up, log-in or legal pages, Grasp records which page it was, the site that linked you there and any campaign tag in the link. Your network address and browser are combined into a one-way scrambled code that changes every day, so visits can be counted without following anyone from one day to the next. Grasp also records when you make an account, confirm your email, go to checkout and start a plan. The record of making an account carries that day's code, so visits made on the day you sign up can be linked to your account, which is how Grasp tells which advert brought you. Visits on other days cannot be. No cookie is used for this and nothing is shared with an analytics company. Visit records are deleted after 180 days, and the rest go when your account does.

Lecture audio, timetable screenshots and Resource Bank files are sent for processing and then discarded as soon as the request finishes. Grasp keeps only the text that comes out of them: the transcript and notes, the subjects on your timetable, and the details read from a document. The files themselves are never saved.

Grasp does not use analytics tools, advertising trackers or third-party cookies, and it does not sell your information to anyone.

Your information is used to run Grasp for you: to show and save your notebooks, to generate notes, explanations and quizzes from your own material, to mark your answers, to apply your plan's limits, and to look into answers you flag. Your setup answers help Grasp understand what the students using it need. None of it is used to advertise to you, and Grasp does not use it to train AI models.

Grasp relies on five services to run:

• OpenAI provides the AI features. When you use one, the material it needs is sent to OpenAI: your note text, a highlighted passage and your question, lecture audio, timetable screenshots, Resource Bank documents, or your quiz answers. Under OpenAI's API terms this is not used to train their models, and it may be kept by OpenAI for up to 30 days to monitor for abuse before being deleted.
• Stripe handles payment when you start a plan. It receives your card details directly — Grasp's own servers never see or store your full card number — along with your email address and name to bill you and send receipts.
• Railway hosts the website and the database your account and study material are stored in. Like any web host, it handles technical details of each request, such as your IP address, to deliver the site and keep it secure.
• Cloudflare sits in front of the website to deliver it quickly and protect it from attacks. Every request passes through it, so it handles technical details such as your IP address and the country it is from, which Grasp uses to show prices in your currency.
• Resend sends the email that confirms your address and any password reset email you ask for. It receives your email address, your name and the link, and nothing from your study material.

Grasp is run from Australia, but these services are based overseas, mainly in the United States, so your information is stored and processed outside Australia. Each of them handles it only to provide its service to Grasp.

Grasp sets one cookie, grasp_session, which keeps you logged in. It can only be read by Grasp's server, and it expires after 30 days, after 30 minutes with no Grasp tab open, or when you log out. It is strictly necessary for your account to work, which is why Grasp does not show a cookie banner asking you to accept it. Grasp's own staff may also have a grasp_admin cookie, used only for testing; it is never set for students and is deleted when the browser closes.

Grasp also stores one setting in your browser: whether you have hidden the tip at the bottom of the notes editor. It never leaves your device.

Your information is kept for as long as you have an account. You can delete any note, quiz, subject or Resource Bank document at any time, and it is removed straight away.

You can delete your whole account from Settings. That immediately removes your account and everything stored with it: your plan and setup answers, study material, usage records, flagged answers and sessions, and it cancels your subscription with Stripe straight away. It cannot be undone. The scrambled sign-in attempt counts described above are not tied to your account and are not deleted with it; they expire on their own within 24 hours.

One thing outlives a deleted account, on purpose: the scrambled free trial record described above. It has to, or deleting an account would let the same card claim another free trial. What is left behind is that scrambled reference and the date, with your name removed from it, so it no longer identifies you.

Grasp does not have a download or export feature yet. To ask for a copy of your information, to correct something, or to ask anything else about your privacy, email [email protected].

If you are not happy with how your information has been handled, email first and you will get a reply within 30 days. If that does not resolve it, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

You must be at least 13 years old to use Grasp. Grasp is not meant for children under 13 and does not knowingly collect their information. If you believe a child under 13 has made an account, email us and it will be deleted.

If you are under the age where you can agree to this yourself where you live (up to 16 in some countries), you need a parent or guardian to agree for you before using Grasp.

The site is only served over HTTPS, passwords are hashed, the session cookie cannot be read by scripts on the page, and every request for your material is checked against your account. No system is perfectly secure, so use a password you do not use anywhere else.

If this policy changes, this page will be updated and the date at the top will change. If a change affects how your information is used in a significant way, you will be emailed before it applies.