Privacy Policy

Last updated: June 28, 2026

This policy explains what information Prism collects, why we collect it, and the choices you have. It covers both our website and the Prism app. We have tried to write it plainly. Where the law requires specific language, we have kept it precise, and we have been honest about the parts that often go unsaid, such as how analytics tools work and what happens to the photos and text you share with us.

1. Introduction and who we are

Prism is a learning companion. You bring it something you want to understand (a photo you take or upload, a topic, or a goal) and Prism helps you understand it, remember it, and build a personal map of what you are learning. The app is launching on iPhone first, with Android to follow. This website is where you can read about Prism and join early access.

The operator of Prism, and the data controller responsible for your information, is Tundra Gateway Management Ltd., located at [Company Address]. This policy is governed by the laws of [Governing Law Jurisdiction]. You can reach our privacy team at support@learnwithprism.app and our general team at info@learnwithprism.app.

Prism's individual service is for adults aged 18 and over. Prism for Education may be used by students aged 13 and older, but only through their school or educational institution. See Children below.

2. Information we collect

We collect different information depending on whether you are using the website or the app.

On the website

• Waitlist email. When you join early access, you give us your email address.
• Consent choices. When you join, you agree to the Terms (this is required) and you may separately opt in to marketing email (this is optional). We record your choices.
• Consent records. To evidence the consent you gave, we store a record that includes your email, the versions of the Terms and Privacy Policy you agreed to, a timestamp, your IP address, your user agent, your chosen device, and your marketing opt-in choice. These records are written to our backend by a server function. We also send a double opt-in confirmation email to verify your address.
• Device choice. You tell us which device you plan to use Prism on (iPhone, Android, or either).
• Analytics. If you accept in the cookie banner, we use Google Analytics 4 and the Meta Pixel to understand how the site is used and to measure advertising. These tools set cookies and load only after you accept. See Cookies and analytics.

In the app

• Account email. You sign in with a one-time code emailed to you through Supabase Auth. There are no passwords.
• Photos and camera images. The photos you capture or choose are sent to our AI provider so it can identify and explain what you are looking at.
• Optional voice recordings. If you choose to explain a concept out loud, your voice recording is sent to a speech-to-text provider for transcription. This is optional.
• Text you write. The explanations you write and the subjects you type are processed by our AI provider to generate and grade explanations.
• Your concept graph. Your concepts, explorations, mastery, and goals make up your personal knowledge map.
• Embeddings. We compute text embeddings of your concepts to power the knowledge map and connect related ideas.
• Usage metering. We meter usage per account to prevent abuse and to operate the service.
• Subscription status. We track whether you have an active subscription or trial. Billing is handled by the Apple App Store or Google Play and managed through RevenueCat. We never receive your full payment card number.

How your data is stored

Your concept graph (your concepts, explorations, mastery, and goals) is stored in our backend, which is the system of record, and it is isolated to your account. The app keeps a temporary copy on your device as a cache so it stays fast and can show recent content offline. That cache is not your durable copy: clearing it or deleting the app does not remove your data from our backend. See Data retention for how your data is removed.

3. How we use information

We use the information above to:

• Provide and improve the service. Run the app and website, keep them working, and make them better over time.
• Identify and explain what you capture. Send your photos and text to our AI provider so it can recognize the subject and write an explanation.
• Run explain-it-back. Process the explanations you write or speak so the app can grade your understanding and help you reach mastery.
• Sync your map. If you have an account, keep your concept graph synced to your isolated space in our backend.
• Fetch relevant images. Send only a short search phrase to Wikipedia to retrieve a relevant photo. We do not send your own photos to Wikipedia.
• Prevent abuse. Meter per-account usage and protect the service against misuse.
• Measure the site. Understand how the website is used and measure advertising, only after you accept analytics cookies.
• Send waitlist and optional marketing email. Confirm your waitlist signup and, if you opted in, send you marketing email. You can unsubscribe at any time.

4. Legal bases for processing

If you are in the United Kingdom or the European Economic Area, we rely on the following legal bases under the UK GDPR and the GDPR:

• Consent. For marketing email and for non-essential cookies and analytics (Google Analytics 4 and the Meta Pixel). You can withdraw consent at any time.
• Performance of a contract. To provide the service you ask for: creating and authenticating your account, identifying and explaining what you capture, running explain-it-back, syncing your map, and managing your subscription.
• Legitimate interests. For keeping the service secure, preventing abuse, and operating basic analytics where applicable. Where we rely on legitimate interests, we balance them against your rights and freedoms, and you can object as described in Your rights.

5. AI processing and your content

Some of what Prism does depends on AI providers. We want to be clear about where your content goes.

• Images and text go to Anthropic. The photos you capture and the text you write are sent to Anthropic, which identifies images and writes and grades explanations.
• Voice goes to OpenAI. If you record a spoken explanation, the audio is sent to OpenAI for transcription. OpenAI also generates the text embeddings that power your knowledge map.

These providers process your content on our behalf to deliver the feature you requested, and they do so under their own terms and data processing commitments. We send the minimum needed to perform the task. We do not use your photos, voice, or written explanations to train our own models. We do not retain your raw audio after transcription is complete, beyond what is needed to return the result to you. The content you choose to keep, such as your concept graph and the explanations stored in your account, is retained as described in Data retention. For image lookups, only a short search phrase is sent to Wikipedia, never your own photo.

AI explanations can be incomplete or wrong. They are for general learning and are not professional, medical, legal, or financial advice. Please verify anything important.

6. Sharing and subprocessors

We do not sell your personal information for money. We share information with the service providers (subprocessors) listed below, each of which helps us run a specific part of Prism. We may also share information where required by law, to protect rights and safety, or as part of a business transfer such as a merger or acquisition, in which case we will tell you.

7. Cookies and analytics

The website uses Google Analytics 4 and the Meta Pixel for analytics and advertising measurement. These tools set cookies and load only after you accept in the cookie banner. If you decline, they do not load. You can change your choice at any time through the cookie settings link in the footer.

For the full details of what cookies we use and how to manage them, see our Cookie Policy.

8. Your rights

If you are in the UK or the European Economic Area

Under the UK GDPR and the GDPR, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data.
• Restrict how we process your data.
• Receive your data in a portable format.
• Object to processing based on legitimate interests.
• Withdraw consent at any time, without affecting processing that already happened.
• Complain to your data protection supervisory authority.

If you are in California

Under the CCPA and CPRA, you have the right to:

• Know what personal information we collect and how we use it.
• Delete personal information we hold about you.
• Correct inaccurate personal information.
• Opt out of the sale or sharing of personal information.

Being honest about advertising: the Meta Pixel may be considered "sharing" for cross-context behavioral advertising under California law. We honor the Global Privacy Control signal, and we treat declining cookies in our banner as an opt out of that sharing. We do not sell your personal information for money.

You can exercise any of these rights using the contact details in How to contact us. We will not discriminate against you for exercising your rights.

9. Data retention

• Account data. We keep your account data while your account is active. When you delete your account, we anonymize the personal data associated with it: we remove or irreversibly de-identify the information that links it to you (such as your email), so that any remaining records can no longer be tied back to you. We may keep anonymized or aggregated data that can no longer identify you.
• On-device cache. The temporary copy cached on your device is cleared when you delete the app. Your durable data stays in our backend and is handled as described above.
• Waitlist and marketing. You can unsubscribe from marketing email at any time, and you can request that we delete your waitlist record.
• Consent records. We retain consent records as needed to evidence the consent you gave and to meet our legal obligations, for [retention period].

10. Security

We protect your information with encryption in transit (HTTPS/TLS) and per-user row isolation in our database, so your synced data is kept separate from other users. No method of storage or transmission is perfectly secure, and we cannot guarantee absolute security, but we work to protect your information and to limit access to it.

11. International transfers

Prism relies on service providers that may process data in the United States and other countries. This means your information may be transferred outside your home country. Where required, we rely on Standard Contractual Clauses or equivalent safeguards to protect your data when it is transferred internationally.

12. Children

Prism's individual service is for adults aged 18 and over, and is not directed to anyone under 18. Prism for Education may be used by students aged 13 and older, but only when it is provided through their school or educational institution and under that institution's authorization, together with any parental consent the law requires. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal data, please contact us at support@learnwithprism.app and we will delete it.

13. Changes to this policy

We may update this policy as Prism evolves or as the law changes. When we make material changes, we will update the date at the top and, where appropriate, let you know in the app or by email. Your continued use of Prism after an update means you accept the revised policy.

14. How to contact us and exercise your rights

To ask a question, exercise any of your rights, or make a privacy request, email us at support@learnwithprism.app. For general questions, you can reach us at info@learnwithprism.app.

You can also write to us at Tundra Gateway Management Ltd., [Company Address]. We will respond within the timeframes required by applicable law. We may need to verify your identity before acting on a request.