iBacalao Privacy Policy

Who we are

iBacalao is an AI-assisted learning workspace for students across education levels and subjects. Bring school tools into your workflow for homework, studying, writing, exam prep, and projects. Students can add task instructions themselves or optionally use available context from a supported school connection; available context and actions vary by integration. Students use AI assistance, review the resulting work, and decide what to submit. Diploma Programme IA, Extended Essay, and Theory of Knowledge criteria support is a specialist workflow within the broader product. The IA review supports 26 Diploma Programme subject configurations; Extended Essay and Theory of Knowledge use separate review workflows. iBacalao is independent and is not affiliated with, endorsed by, sponsored by, or approved by the International Baccalaureate Organization. The data controller is Wawa Labs, represented by its principal, Constantino Fernandez, with address at Vía Principal, Constantino Fernández, Ambato, Tungurahua, Ecuador, and telephone 098 356 0271.

What we collect

• Your email address — only if you choose to create an account. Providing your email is optional.
• Private account access — if you choose Continue privately, we create a pseudonymous iBacalao account ID without collecting an email address, phone number, or user-created password. A random recovery secret is generated for account recovery; the server stores only a one-way scrypt hash of that secret, while the readable recovery code is stored in secure device storage and can be saved by you for another device or reinstall.
• Your sign-in provider identity — if you sign in with Google, Apple, or Microsoft, we store the display name and email that your provider shares with us.
• Your name, country, and school — only if you choose to provide them during onboarding. These are optional profile fields.
• Your academic setup — when you complete setup, we may store the Diploma Programme year and exam session you select, your subject selections, and the weekdays you choose for planning. Some optional planning flows can also store whether you include CAS, a university target, a target points total, a national-diploma setting, or personal context you choose to provide.
• Your profile photo — only if you choose one in the iOS app. The selected image is cropped and compressed into an avatar and stored with your profile.
• Your Work Setup preferences — if you save them, we store how you prefer tasks to be presented and paced, including smaller steps, focus view, estimate wording, optional break suggestions, text spacing, and reduced-motion preference. These settings change presentation and execution support; they do not change your academic record.
• Your IP address and related network information — may be processed by iBacalao and service providers for rate limits, security, and abuse prevention. For some application controls, we derive a short hash from the client IP and store it in temporary Redis keys that expire according to each control's configured window. Creator Rewards anti-fraud records use a rolling 48-hour window. Hosting and security providers may also process technical request data under their own retention policies.
• Your signed-in review history — we store review results (scores, criteria, AI output) and document-text extracts to power history and annotation features. Older summaries may be pruned as the list is managed; associated detailed review records can remain in iBacalao storage until you delete your account.
• Your chat history and attachments — signed-in chat conversations, messages, and content you attach are stored so you can return to the conversation. You can delete a conversation from chat; deleting your account also deletes its chat data.
• Safety reports — if you report an AI response or a Race profile, we send the report details and the relevant response or profile information to support so a person can review it.
• Safety reports — if you report an AI response or a Race profile, we send the report details and the relevant response or profile information to support so a person can review it.
• Connected school records — if you connect a supported school platform, iBacalao may receive available assignment, message, grade, deadline, or submission records. Depending on the platform and record, fields can include titles, subjects, details, links, dates, status, grades, teacher names, and message thread identifiers.
• CAS and coursework data — if you use the CAS tracker, study planner, or class tools, we store the content you enter (experiences, reflections, plans, assignments) to provide those features.
• Optional feedback — if you submit a suggestion through the feedback form, we store the message you wrote.
• Waitlist signups — if you join our pre-launch waitlist, we store your email, a randomly generated referral code and link, your queue position, and how many people you've referred through your link. This is used only to run the referral program and to notify you when we launch.
• Referral reward redemptions — if you redeem a referral reward tier, we generate and store a one-time activation code linked to your account, the plan and duration it unlocks, and whether it has been used. The code is deleted once activated or after it expires.
• App subscription and purchase status — in the iOS app, RevenueCat receives your iBacalao account ID and App Store subscription, purchase, entitlement, and introductory-offer eligibility information so we can show your plan, unlock paid features, restore purchases, and provide subscription self-service. We do not receive your full payment-card details from the App Store.

Cookies

• Session cookie (ib_session) — a strictly necessary cookie set when you sign in. It keeps you authenticated across page loads. No consent is required for this cookie as it is essential for the service to function.
• OAuth state cookies — two short-lived cookies (oauth_state, oauth_return) set only during a Google, Apple, or Microsoft sign-in flow. They are deleted immediately after the flow completes.
• Optional analytics consent cookie (ib_analytics_consent) — records whether you accepted or declined optional analytics so we can apply your choice on later requests.
• Google Analytics cookies (_ga, _ga_*) — set only if you accept optional analytics. They help us understand how pages are used and are not loaded when you decline or when your browser sends GPC.
• PostHog, Vercel Analytics, and Meta analytics — loaded only if you accept optional analytics. Meta may set _fbp and _fbc cookies; the other services may use their own identifiers or storage.
• Browser local storage — stores your optional analytics choice. You can change it from the Privacy choices control or by clearing site data.

Site analytics

Google Analytics, PostHog, Vercel Analytics, and the Meta Pixel are optional analytics and are not loaded until you accept them. They remain off when you choose Necessary only or when your browser sends the Global Privacy Control signal (GPC). These services may receive technical information such as your browser, pages viewed, approximate location, and analytics identifiers. Page URLs are sent without query strings so tokens in links (for example password-reset URLs) are not sent to analytics providers. After consent, PostHog may link a normal signed-in web account to an analytics profile using its email address and may receive account properties such as role, plan, country, school, whether profile setup is complete, and whether the account is private. Private accounts use the opaque iBacalao account ID instead and their internal compatibility email is not sent to PostHog. Web session replay is disabled. Meta analytics may be used for marketing attribution and ad measurement as described below. We do not sell personal data.

Mobile analytics and diagnostics

• PostHog product analytics in the iOS app is off by default and is used only after you opt in. When enabled, it may receive your iBacalao account ID, plan status, app version, screen names, and basic app-lifecycle or feature-usage events. The mobile integration disables session replay and filters sensitive fields; drafts, document text, and school content are not intentionally sent to PostHog.
• Meta App Events for iOS is separate from PostHog. It is initialized only when you have enabled optional product analytics and Apple has granted App Tracking Transparency permission. When enabled, iBacalao sends a limited conversion allowlist such as onboarding completion, paywall view, checkout start, and a verified subscription purchase, together with limited product metadata such as plan, billing cycle, price, and currency. We do not send your iBacalao account ID, email, private recovery code, school data, or document content to Meta through this integration. If Apple tracking permission is denied, native Meta tracking remains disabled.
• Sentry is used for operational error and performance diagnostics in the iOS app. It may receive a pseudonymous iBacalao account ID and limited technical crash, error, device, and performance information. Default PII collection and session replay are disabled, request data and credentials are filtered, and URL parameters are removed before events are sent.

Optional Meta analytics

On the website, if you accept optional analytics in our cookie notice, we use the Meta Pixel to record basic events such as page visits and marketing conversions. Meta may receive technical information such as your IP address, browser information and the page visited. We do not load the Meta Pixel if you decline or when your browser sends GPC. In the iOS app, Meta App Events is additionally gated by Apple's App Tracking Transparency permission as described above. We use Meta for marketing attribution and ad measurement; we do not send document contents, email addresses, private recovery codes, school data, or iBacalao account IDs to Meta through these integrations.

Your privacy choices

We do not sell personal data. Optional analytics are off until you choose Accept optional analytics. You can choose Necessary only or reopen Privacy choices at any time. We honor the Global Privacy Control signal: when your browser sends GPC, optional analytics remain off even if a previous choice was granted. GPC is an opt-out signal for sale, sharing, or cross-context behavioral advertising; it does not delete your account or stop processing needed to provide the service. California residents can use GPC or contact us to exercise applicable opt-out rights.

AI-assisted content and school context

When you use an AI feature, the text, files, or assignment details included in that request are sent to the provider configured for that feature so it can provide the requested assistance, analysis, or feedback. Connecting a school platform can make supported records available to iBacalao; it does not mean every record is sent to an AI provider. Only context used by a selected AI workflow is included in that request. Depending on the feature and configured route, Chat may use Groq, Together AI, or OpenAI; review flows may use OpenAI or Anthropic; Audio to Notes uses OpenAI; AI-content or originality checks may use Sapling, Pangram, GPTZero, ZeroGPT, or Copyleaks; and plagiarism checks use Winston AI. Signed-in review results and a document-text extract may be stored in iBacalao review history; signed-in chat messages and attachments are stored in iBacalao chat history until you delete the conversation or your account. Deleting iBacalao history does not control any provider retention, which follows that provider's terms. iBacalao does not use submissions to train its own AI models. Detector scores are review signals and do not prove authorship.

iOS app permissions and mobile media

• Camera — used only when you choose a camera-based feature, such as capturing schoolwork for feedback or scanning a pairing code. For Camera Feedback, text is extracted on the phone and only the extracted text is sent to iBacalao for review; the captured page image itself is not uploaded by that flow.
• Photo library — used only when you choose an existing image, for example as your profile photo or schoolwork input. iBacalao does not browse your library in the background.
• Microphone — used only when you start Audio to Notes. The recording is uploaded to iBacalao's server and sent to OpenAI's transcription API to create a transcript and notes. The Audio to Notes route processes the recording without intentionally retaining the audio file as long-term iBacalao account content.
• Local network — used for device-pairing features that connect the iOS app to iBacalao on your Mac. It is not used to scan unrelated devices or networks.
• Notifications — local reminders stay on your device. If you separately enable remote school-update notifications, we register an installation identifier, platform, time zone, locale, and Expo push token so notifications can be delivered. Disabling the feature or signing out disables that installation for future sends; deleting your account deletes its registered push devices.

Third-party services

• OpenAI — used for chat and review workflows when configured. Text, attachments, or task context included in a request may be sent to OpenAI's API to provide that feature. OpenAI may process or retain API requests according to its own terms and privacy policy.
• Anthropic — used as a fallback for some review workflows when configured. Submitted material included in those requests may be sent to Anthropic's API. Anthropic may process or retain API requests according to its own terms and privacy policy.
• Groq — may process Chat messages and attachments when the Groq Chat route is configured. Groq may process or retain requests according to its own terms and privacy policy.
• Together AI — may process Chat messages and attachments in the configured strong or economy Chat routes. Together AI may process or retain requests according to its own terms and privacy policy.
• Sapling, Pangram, GPTZero, ZeroGPT, and Copyleaks — may process document text when an AI-content or originality check selects that detector. Only the text needed for the requested check is sent.
• Winston AI (gowinston.ai) — used for plagiarism checking. Document text is sent to Winston AI only when you request a plagiarism check.
• Stripe — used for the optional verified Starter Pack flow. Stripe handles the card details for that flow; we do not store full card numbers.
• RevenueCat — manages App Store subscription entitlements in the iOS app. It receives your iBacalao account ID and subscription or purchase status so the app can unlock the correct plan, restore purchases, and provide subscription self-service.
• Apple App Store — processes iOS in-app purchases and subscriptions. Apple handles your payment method; iBacalao receives the purchase and entitlement information needed to provide the subscription.
• Supabase — our primary database. Stores CAS data, class data, teacher and student records, and other structured content you create on the platform.
• Upstash (Redis) — stores user accounts, sessions, review history, and rate-limit counters.
• Neon — a separate database used only for the Creator Rewards Program (challenges, submitted video URLs, and payout records).
• ScrapeCreators — used to verify TikTok and Instagram video view counts for creators whose submissions need an automated check beyond our own heuristics.
• YouTube Data API — used to verify YouTube video view counts for the Creator Rewards Program.
• PayPal — used for supported web subscription payments, supported hardware pre-orders, and cash rewards under the Creator Rewards Program. PayPal receives the payment or payout information needed for the transaction.
• Cloudflare Turnstile — bot and abuse prevention during account and form flows. Cloudflare may process browser, device, and network information to verify that a request is human.
• Resend — transactional email delivery for sign-in codes, password resets, parent notifications, and other service messages. Resend receives the recipient address and message needed to deliver the email.
• Lemon Squeezy — web student subscription card checkout and selected hardware checkout processing when that payment rail is used.
• NOWPayments — cryptocurrency payment processing for supported subscriptions and hardware pre-orders when that payment rail is used. We receive payment status and references, not your wallet credentials.
• Persona — hosted identity verification for first-time cash payouts in the Creator Rewards Program. Persona receives the identity information required for that verification flow.
• Sentry — error monitoring, crash reporting, and limited performance diagnostics for the web and iOS app. The mobile integration uses a pseudonymous account ID when signed in, disables default PII collection and session replay, and filters sensitive request and content fields.
• Expo — provides the push-notification delivery service used for optional remote school-update notifications. When you enable those notifications, Expo processes the push token and technical delivery information needed to route the notification to your device.
• Vercel — our hosting provider. All web requests pass through Vercel's infrastructure.
• Google Analytics — optional site traffic and page-usage measurement (see Site analytics above).
• PostHog — optional product analytics and feature usage on the site and iOS app. Mobile analytics is off by default until you opt in; session replay is not enabled.
• Meta — optional website Pixel analytics and optional iOS App Events for marketing attribution and ad measurement. Website analytics require your analytics consent; native App Events additionally require Apple App Tracking Transparency permission. iBacalao does not provide Meta with your iBacalao account ID, email, private recovery code, school data, or document content through this integration.

Protection by third parties

We use third-party service providers to operate the features described in this policy. They process information they receive under their applicable service terms and data-protection obligations. The data, purposes, safeguards, and retention can vary by provider; see the relevant provider's terms and privacy information.

Referral reward data

• What we collect. Your verified referral count, the highest reward tier you've claimed, and any activation code generated for a redeemed tier (which plan and duration it grants, and whether it has been used).
• Why. This is used only to verify eligibility for referral rewards, prevent a tier from being claimed twice, and grant the correct plan duration when a code is activated.
• Retention. A claimed-tier record is kept for as long as your account exists, so a lower tier can't be re-claimed after a higher one. An activation code is deleted immediately once used, or automatically after 90 days if never activated.

Creator Rewards Program data

• What we collect. If you participate in the Creator Rewards Program, we store the video URLs you submit, the view counts and platform data we retrieve to verify them, your self-reported date of birth and country (used only to determine cash-reward eligibility), and — if you claim a cash reward — your PayPal email address.
• Why. Date of birth and country are collected because U.S. law and our own program rules restrict cash payouts to adults resident in the United States; we do not use this data for any other purpose. View data is collected to verify rewards and prevent fraud.
• Where it lives. Creator Rewards data is stored in a separate database (Neon) from the rest of your account data, access-locked to our application credentials only.
• Retention. Challenge and submission records are kept for as long as needed to resolve a reward claim and to enforce the $500/person/year cash cap across calendar years, and are deleted on request subject to the payment-record retention period below where a payout was actually made.
• First-time cash payouts. Before your first-ever cash payout, we ask you to verify your identity and US residency — for example with a government ID or your PayPal account's registered address. We only do this once per account, not on every payout.

Wearables pre-order data

• What we collect. If you place a wearables hardware pre-order (Iris, Trace), we store your email, name, shipping address, order quantity, and price paid, plus a payment reference from PayPal or our crypto processor (never your full card or wallet details).
• Why. Your shipping address is used only to fulfil and ship your order. Payment references are used to verify payment, process refunds, and prevent duplicate charges.
• Refund and deletion requests. Submitting the refund-request or delete-account-request forms sends your email and message to our order-fulfilment inbox so we can act on it manually — see our Refund Policy and Delete My Data page.
• Retention. Order and shipping records are kept for as long as needed to fulfil, ship, and support your order, and afterward for the payment-record retention period described above.

Security

• All traffic is served over HTTPS with strict transport security (HSTS).
• We apply a Content Security Policy (CSP) that restricts which scripts and connections the browser may load.
• Session tokens are httpOnly cookies and expire after sign-out or 30 days of inactivity.
• We do not sell personal data. iBacalao does not use document text to train its own AI models.

Desktop experience

The student-facing web experience for draft upload and PDF review is designed for desktop and laptop screens (768px width or wider). On smaller viewports you may see a message asking you to open the site on a desktop device.

School Bridge browser extension

• The optional iBacalao School Bridge Chrome extension reads your school portal's academic pages (assignments, grades, messages) after you click the extension to grant it access to that specific school website. It never runs on a site until you grant that exact origin.
• Depending on the connector and records found, it sends normalized academic records to iBacalao's servers through the iBacalao Mac app on your computer, using Chrome's Native Messaging API. A record may include a title, subject, detail, link, due or occurred date, status, grade, teacher name, message thread identifier, or urgency. It never reads, stores, or transmits your password, session cookies, authorization headers, or your browsing on other sites.
• It never submits, edits, or clicks anything on your behalf on the school portal. It only reads pages you already opened and observes downloads you already started — it never causes additional requests to your school's site beyond your own normal browsing.
• Uninstalling the extension or revoking its site access in Chrome's extension settings stops all data collection immediately.

Legal basis for processing

• Contract (Art. 6(1)(b) GDPR) — AI-assisted workflows and feedback, account management, and subscription billing are necessary to perform the service you signed up for.
• Legitimate interest (Art. 6(1)(f) GDPR) — we may process technical request information, including short hashes derived from IP addresses, to enforce usage limits, prevent abuse, and protect the service, and use Sentry for limited error and security diagnostics.
• Consent (Art. 6(1)(a) GDPR) — Google Analytics, PostHog, Vercel Analytics, and Meta analytics are only used after the applicable optional-analytics consent. Native Meta App Events also requires Apple App Tracking Transparency authorization. You can withdraw the in-app analytics choice in Settings, change Apple's tracking permission in iOS Settings, change website Privacy choices, or contact us.

International data transfers

Some of the providers listed above process data outside Ecuador, including in the United States and other countries where they operate. When applicable law requires transfer safeguards, we use legally recognized transfer mechanisms and the contractual or organizational safeguards made available by those providers. You can contact us for more information about the safeguards relevant to a particular transfer.

Data retention

• IP-derived rate-limit and abuse-prevention keys — application keys expire according to their configured windows; a Creator Rewards anti-fraud record uses a rolling 48-hour window. Hosting and security-provider retention follows their policies.
• Session tokens — deleted when you sign out, or after 30 days of inactivity.
• Account data (email, name, profile) — kept until you delete your account.
• Work Setup preferences — kept with your account until you change them or delete your account.
• Review history — older summaries may be pruned as the list is managed; associated detailed records can remain in iBacalao storage until account deletion.
• Chat history — signed-in conversations and attachments are kept until you delete a conversation or your account.
• Connected school records — stored to provide connected school workflows and deleted when you delete your account.
• CAS and coursework data — kept until you delete individual entries or your account.
• Payment records — retained for 7 years as required by applicable tax and accounting law.
• Creator Rewards data — challenge and submitted-video records are kept until you delete your account; paid cash-reward records are retained for 7 years as required by applicable tax and accounting law, same as other payment records.
• Analytics data — optional usage data in Google Analytics, PostHog, Vercel, and Meta may be retained by those providers according to their own policies. Sentry error data may be retained under its provider policy. Contact us if you want help exercising erasure rights with respect to analytics.

How we use your email

If you give us your email, we may use it to tell you about new features, product updates, and to occasionally ask for your feedback. We will never sell your email or share it with third parties for their marketing. Every email we send includes a way to unsubscribe, and you can opt out at any time.

If you are under 16

If you are under 16 (or the age of digital consent in your country), please get permission from a parent or guardian before submitting your email address or accepting optional analytics. If you are a parent or guardian and believe your child has provided personal data without consent, contact us at the address below and we will delete it.

Your rights

Depending on where you live, you may have rights to access, obtain a copy of, correct or update, delete, object to or restrict processing of, and request portability of your personal data, and to withdraw consent where processing is based on consent. You can exercise these rights by emailing us. You may also submit a complaint to the competent data-protection authority; in Ecuador, this is the Superintendencia de Protección de Datos Personales. We do not use your data to make solely automated decisions that produce legal or similarly significant effects: AI feedback, score estimates, and study recommendations are guidance for you and do not determine official grades, admissions, employment, credit, or other legal rights.

Contact

For any privacy questions or requests, contact us at ibacalao [at] ibacalao [dot] com.

To delete your data, see delete my data. Service terms are in our terms of service.