iBacalao Privacy Policy

Who we are

ibacalao is an AI-powered study platform for Diploma Programme students. It gives criterion-by-criterion feedback on Internal Assessments, Extended Essays, and Theory of Knowledge essays across 26 supported subjects. It is an independent project and is not affiliated with, endorsed by, or connected to the International Baccalaureate Organization (IBO). The data controller is Wawa Labs, represented by its principal, Constantino Fernandez, with address at Vía Principal, Constantino Fernández, Ambato, Tungurahua, Ecuador, and telephone 098 356 0271.

What we collect

• Your email address — only if you choose to create an account. Providing your email is optional.
• Your sign-in provider identity — if you sign in with Google, Apple, or Microsoft, we store the display name and email that your provider shares with us.
• Your name, country, and school — only if you choose to provide them during onboarding. These are optional profile fields.
• Your profile photo — only if you choose one in the iOS app. The selected image is cropped and compressed into an avatar and stored with your profile.
• Your Work Setup preferences — if you save them, we store how you prefer tasks to be presented and paced, including smaller steps, focus view, estimate wording, optional break suggestions, text spacing, and reduced-motion preference. These settings change presentation and execution support; they do not change your academic record.
• Your IP address — used temporarily to enforce daily review limits and prevent abuse. It is automatically deleted after 48 hours, and is stored only as an irreversible hash, never as a raw address.
• Your review history — for signed-in users, we store your feedback results (scores, criteria, AI output) and an extract of your document text to power the history and annotation features. Up to 100 reviews are kept per account and are deleted when you delete your account.
• CAS and coursework data — if you use the CAS tracker, study planner, or class tools, we store the content you enter (experiences, reflections, plans, assignments) to provide those features.
• Optional feedback — if you submit a suggestion through the feedback form, we store the message you wrote.
• Waitlist signups — if you join our pre-launch waitlist, we store your email, a randomly generated referral code and link, your queue position, and how many people you've referred through your link. This is used only to run the referral program and to notify you when we launch.
• Referral reward redemptions — if you redeem a referral reward tier, we generate and store a one-time activation code linked to your account, the plan and duration it unlocks, and whether it has been used. The code is deleted once activated or after it expires.
• App subscription and purchase status — in the iOS app, RevenueCat receives your iBacalao account ID and App Store subscription, purchase, entitlement, and introductory-offer eligibility information so we can show your plan, unlock paid features, restore purchases, and provide subscription self-service. We do not receive your full payment-card details from the App Store.

Cookies

• Session cookie (ib_session) — a strictly necessary cookie set when you sign in. It keeps you authenticated across page loads. No consent is required for this cookie as it is essential for the service to function.
• OAuth state cookies — two short-lived cookies (oauth_state, oauth_return) set only during a Google, Apple, or Microsoft sign-in flow. They are deleted immediately after the flow completes.
• Optional analytics consent cookie (ib_analytics_consent) — records whether you accepted or declined optional analytics so we can apply your choice on later requests.
• Google Analytics cookies (_ga, _ga_*) — set only if you accept optional analytics. They help us understand how pages are used and are not loaded when you decline or when your browser sends GPC.
• PostHog, Vercel Analytics, and Meta analytics — loaded only if you accept optional analytics. Meta may set _fbp and _fbc cookies; the other services may use their own identifiers or storage.
• Browser local storage — stores your optional analytics choice. You can change it from the Privacy choices control or by clearing site data.

Site analytics

Google Analytics, PostHog, Vercel Analytics, and the Meta Pixel are optional analytics and are not loaded until you accept them. They remain off when you choose Necessary only or when your browser sends the Global Privacy Control signal (GPC). These services may receive technical information such as your browser, pages viewed, approximate location, and analytics identifiers. Page URLs are sent without query strings so tokens in links (for example password-reset URLs) are not sent to analytics providers. PostHog may link signed-in users to an analytics profile using their email address solely to understand product usage. We do not use these services for advertising or sell personal data.

Mobile analytics and diagnostics

• PostHog product analytics in the iOS app is off by default and is used only after you opt in. When enabled, it may receive your iBacalao account ID, plan status, app version, screen names, and basic app-lifecycle or feature-usage events. The mobile integration disables session replay and filters sensitive fields; drafts, document text, and school content are not intentionally sent to PostHog.
• Sentry is used for operational error and performance diagnostics in the iOS app. It may receive a pseudonymous iBacalao account ID and limited technical crash, error, device, and performance information. Default PII collection and session replay are disabled, request data and credentials are filtered, and URL parameters are removed before events are sent.

Optional Meta analytics

If you accept optional analytics in our cookie notice, we use the Meta Pixel to record basic events such as page visits. Meta may receive technical information such as your IP address, browser information and the page visited. We do not load the Meta Pixel if you decline or when your browser sends GPC. We do not send document contents, email addresses or other sensitive information to Meta through the Pixel.

Your privacy choices

We do not sell personal data. Optional analytics are off until you choose Accept optional analytics. You can choose Necessary only or reopen Privacy choices at any time. We honor the Global Privacy Control signal: when your browser sends GPC, optional analytics remain off even if a previous choice was granted. GPC is an opt-out signal for sale, sharing, or cross-context behavioral advertising; it does not delete your account or stop processing needed to provide the service. California residents can use GPC or contact us to exercise applicable opt-out rights.

Your submitted document

When you request feedback, your document text is sent to our configured AI providers — OpenAI first when available, with Anthropic as a fallback — to generate your feedback. For signed-in users, an extract of that text may also be stored in your review history to power the annotation and history features. We never use your submissions to train AI models. If you use the plagiarism or AI-content detection features, your document text is also sent to Winston AI (gowinston.ai) for analysis.

iOS app permissions and mobile media

• Camera — used only when you choose a camera-based feature, such as capturing schoolwork for feedback or scanning a pairing code. For Camera Feedback, text is extracted on the phone and only the extracted text is sent to iBacalao for review; the captured page image itself is not uploaded by that flow.
• Photo library — used only when you choose an existing image, for example as your profile photo or schoolwork input. iBacalao does not browse your library in the background.
• Microphone — used only when you start Audio to Notes. The recording is uploaded to iBacalao's server and sent to OpenAI's transcription API to create a transcript and notes. The Audio to Notes route processes the recording without intentionally retaining the audio file as long-term iBacalao account content.
• Local network — used for device-pairing features that connect the iOS app to iBacalao on your Mac. It is not used to scan unrelated devices or networks.
• Notifications — local reminders stay on your device. If you separately enable remote school-update notifications, we register an installation identifier, platform, time zone, locale, and Expo push token so notifications can be delivered. Disabling the feature or signing out disables that installation for future sends; deleting your account deletes its registered push devices.

Third-party services

• OpenAI — our primary AI provider when configured. Your document text may be sent to OpenAI's API to generate feedback. OpenAI may process or retain API requests according to its own privacy policy.
• Anthropic — our fallback AI provider. Your document text may be sent to Anthropic's API when the primary providers are unavailable. Anthropic may log API requests per their own privacy policy.
• Winston AI (gowinston.ai) — plagiarism checking and AI-content detection. Document text is sent to Winston AI only when you use those features.
• Stripe — payment processing. When you purchase a plan or day pass, your payment details are handled by Stripe. We do not store card numbers.
• Payphone — payment processing for supported regions. Same scope as Stripe.
• RevenueCat — manages App Store subscription entitlements in the iOS app. It receives your iBacalao account ID and subscription or purchase status so the app can unlock the correct plan, restore purchases, and provide subscription self-service.
• Apple App Store — processes iOS in-app purchases and subscriptions. Apple handles your payment method; iBacalao receives the purchase and entitlement information needed to provide the subscription.
• Supabase — our primary database. Stores CAS data, class data, teacher and student records, and other structured content you create on the platform.
• Upstash (Redis) — stores user accounts, sessions, review history, and rate-limit counters.
• Neon — a separate database used only for the Creator Rewards Program (challenges, submitted video URLs, and payout records).
• ScrapeCreators — used to verify TikTok and Instagram video view counts for creators whose submissions need an automated check beyond our own heuristics.
• YouTube Data API — used to verify YouTube video view counts for the Creator Rewards Program.
• PayPal — used to send cash rewards under the Creator Rewards Program. Your PayPal email address is shared with PayPal only to process that payout.
• Cloudflare Turnstile — bot and abuse prevention during account and form flows. Cloudflare may process browser, device, and network information to verify that a request is human.
• Resend — transactional email delivery for sign-in codes, password resets, parent notifications, and other service messages. Resend receives the recipient address and message needed to deliver the email.
• Lemon Squeezy — subscription and selected hardware checkout processing when that payment rail is used.
• NOWPayments — cryptocurrency payment processing when that payment rail is used. We receive payment status and references, not your wallet credentials.
• Persona — hosted identity verification for first-time cash payouts in the Creator Rewards Program. Persona receives the identity information required for that verification flow.
• Sentry — error monitoring, crash reporting, and limited performance diagnostics for the web and iOS app. The mobile integration uses a pseudonymous account ID when signed in, disables default PII collection and session replay, and filters sensitive request and content fields.
• Expo — provides the push-notification delivery service used for optional remote school-update notifications. When you enable those notifications, Expo processes the push token and technical delivery information needed to route the notification to your device.
• Vercel — our hosting provider. All web requests pass through Vercel's infrastructure.
• Google Analytics — optional site traffic and page-usage measurement (see Site analytics above).
• PostHog — optional product analytics and feature usage on the site and iOS app. Mobile analytics is off by default until you opt in; session replay is not enabled.
• Meta — marketing analytics cookies loaded only with your consent (see Cookies section above).

Protection by third parties

We require third parties that receive personal data from iBacalao to protect it to the same or an equivalent standard described in this policy and to use it only for the purposes for which it was shared, subject to their applicable service terms and data-protection obligations.

Referral reward data

• What we collect. Your verified referral count, the highest reward tier you've claimed, and any activation code generated for a redeemed tier (which plan and duration it grants, and whether it has been used).
• Why. This is used only to verify eligibility for referral rewards, prevent a tier from being claimed twice, and grant the correct plan duration when a code is activated.
• Retention. A claimed-tier record is kept for as long as your account exists, so a lower tier can't be re-claimed after a higher one. An activation code is deleted immediately once used, or automatically after 90 days if never activated.

Creator Rewards Program data

• What we collect. If you participate in the Creator Rewards Program, we store the video URLs you submit, the view counts and platform data we retrieve to verify them, your self-reported date of birth and country (used only to determine cash-reward eligibility), and — if you claim a cash reward — your PayPal email address.
• Why. Date of birth and country are collected because U.S. law and our own program rules restrict cash payouts to adults resident in the United States; we do not use this data for any other purpose. View data is collected to verify rewards and prevent fraud.
• Where it lives. Creator Rewards data is stored in a separate database (Neon) from the rest of your account data, access-locked to our application credentials only.
• Retention. Challenge and submission records are kept for as long as needed to resolve a reward claim and to enforce the $500/person/year cash cap across calendar years, and are deleted on request subject to the payment-record retention period below where a payout was actually made.
• First-time cash payouts. Before your first-ever cash payout, we ask you to verify your identity and US residency — for example with a government ID or your PayPal account's registered address. We only do this once per account, not on every payout.

Wearables pre-order data

• What we collect. If you place a wearables hardware pre-order (Iris, Trace), we store your email, name, shipping address, order quantity, and price paid, plus a payment reference from PayPal or our crypto processor (never your full card or wallet details).
• Why. Your shipping address is used only to fulfil and ship your order. Payment references are used to verify payment, process refunds, and prevent duplicate charges.
• Refund and deletion requests. Submitting the refund-request or delete-account-request forms sends your email and message to our order-fulfilment inbox so we can act on it manually — see our Refund Policy and Delete My Data page.
• Retention. Order and shipping records are kept for as long as needed to fulfil, ship, and support your order, and afterward for the payment-record retention period described above.

Security

• All traffic is served over HTTPS with strict transport security (HSTS).
• We apply a Content Security Policy (CSP) that restricts which scripts and connections the browser may load.
• IP addresses used for rate limiting are stored only as irreversible hashes and deleted within 48 hours.
• Session tokens are httpOnly cookies and expire after sign-out or 30 days of inactivity.
• We do not sell personal data. Document text is never used to train AI models.

Desktop experience

The full product — including draft upload, PDF review, and teacher tools — is designed for desktop and laptop screens (768px width or wider). On smaller viewports you may see a message asking you to open the site on a desktop device.

School Bridge browser extension

• The optional iBacalao School Bridge Chrome extension reads your school portal's academic pages (assignments, grades, messages) after you click the extension to grant it access to that specific school website. It never runs on a site until you grant that exact origin.
• It sends only normalized academic records (titles, subjects, due dates, status, grades) to iBacalao's servers through the iBacalao Mac app on your computer, using Chrome's Native Messaging API. It never reads, stores, or transmits your password, session cookies, authorization headers, or your browsing on other sites.
• It never submits, edits, or clicks anything on your behalf on the school portal. It only reads pages you already opened and observes downloads you already started — it never causes additional requests to your school's site beyond your own normal browsing.
• Uninstalling the extension or revoking its site access in Chrome's extension settings stops all data collection immediately.

Legal basis for processing

• Contract (Art. 6(1)(b) GDPR) — feedback generation, account management, and subscription billing are necessary to perform the service you signed up for.
• Legitimate interest (Art. 6(1)(f) GDPR) — we hash and briefly store IP addresses to enforce rate limits and prevent abuse, and use Sentry for limited error and security diagnostics. This is the minimum data needed to operate and protect the platform.
• Consent (Art. 6(1)(a) GDPR) — Google Analytics, PostHog, Vercel Analytics, and Meta analytics are only loaded if you explicitly accept optional analytics. You can withdraw consent at any time using Privacy choices or by contacting us.

International data transfers

Some of the providers listed above process data outside Ecuador, including in the United States and other countries where they operate. When applicable law requires transfer safeguards, we use legally recognized transfer mechanisms and the contractual or organizational safeguards made available by those providers. You can contact us for more information about the safeguards relevant to a particular transfer.

Data retention

• IP address hash — deleted automatically after 48 hours.
• Session tokens — deleted when you sign out, or after 30 days of inactivity.
• Account data (email, name, profile) — kept until you delete your account.
• Work Setup preferences — kept with your account until you change them or delete your account.
• Review history — up to 100 reviews stored per account, deleted when you delete your account.
• CAS and coursework data — kept until you delete individual entries or your account.
• Payment records — retained for 7 years as required by applicable tax and accounting law.
• Creator Rewards data — challenge and submitted-video records are kept until you delete your account; paid cash-reward records are retained for 7 years as required by applicable tax and accounting law, same as other payment records.
• Analytics data — optional usage data in Google Analytics, PostHog, Vercel, and Meta may be retained by those providers according to their own policies. Sentry error data may be retained under its provider policy. Contact us if you want help exercising erasure rights with respect to analytics.

How we use your email

If you give us your email, we may use it to tell you about new features, product updates, and to occasionally ask for your feedback. We will never sell your email or share it with third parties for their marketing. Every email we send includes a way to unsubscribe, and you can opt out at any time.

If you are under 16

If you are under 16 (or the age of digital consent in your country), please get permission from a parent or guardian before submitting your email address or accepting optional analytics. If you are a parent or guardian and believe your child has provided personal data without consent, contact us at the address below and we will delete it.

Your rights

Depending on where you live, you may have rights to access, obtain a copy of, correct or update, delete, object to or restrict processing of, and request portability of your personal data, and to withdraw consent where processing is based on consent. You can exercise these rights by emailing us. You may also submit a complaint to the competent data-protection authority; in Ecuador, this is the Superintendencia de Protección de Datos Personales. We do not use your data to make solely automated decisions that produce legal or similarly significant effects: AI feedback, score estimates, and study recommendations are guidance for you and do not determine official grades, admissions, employment, credit, or other legal rights.

Contact

For any privacy questions or requests, contact us at ibacalao [at] ibacalao [dot] com.

To delete your data, see delete my data. Service terms are in our terms of service.