Chat2L (“Chat2L”, “we”, “us”) is a study tool for students, operated from Kingston, Ontario, Canada. This policy explains what we collect, why, who else handles it, how long we keep it, and what you can ask us to do. It covers the Chat2L website and app, the Chat2L Sync Chrome extension and the Chat2L connector for Claude, ChatGPT and other AI apps.
The short version
- You sync your own course materials so Chat2L can help you study. They stay in your account and are not shared with other users.
- We do not sell your data, show ads, or use your content to train AI models. Our AI providers are set up not to train on it either.
- Some outside companies process your data to run the Service. They are listed below, and some are in the United States.
- You can delete your account and everything in it yourself, in Settings.
Who is responsible
Chat2L is responsible for your personal information. Our privacy contact is the founder of Chat2L, reachable at [email protected].
What we collect
Account information: Your name, email address and profile picture from Google when you sign in. We only ask Google for your basic profile and email. We do not get access to your Gmail, Drive or other Google data. We also save your onboarding progress, such as the school you picked, so you can continue on another device.
Course materials: What you sync from your school’s learning management system: course lists, content outlines, files (PDFs, slides, documents and web pages), announcements, assignment and quiz titles and due dates. Files you upload yourself are included. The extension skips audio and video files. We do not collect your grades or your school password.
What you create: Chat conversations, quizzes, flashcards, class schedules you import, and assignment statuses. Anything you made with a feature Chat2L no longer offers stays in your account and is deleted with it. Chat2L no longer records lectures. If you made recordings earlier, their transcripts and summaries are still in your account, and the audio stays in storage until you delete your account.
Payments: If you buy the Exam Pass, Stripe collects your payment details on its own checkout page. We receive confirmation that the payment went through, its amount and date, and a refund status if there is one. We do not see or store your card number.
Feedback and support: Anything you send us through the feedback button or by email.
Usage and error data: Pages visited, features used and how they went (such as how long a document took to process, which AI model answered a chat and how long it took, or a quiz score), failed requests, crashes and sync problems, linked to your account id so we can fix them, plus basic device and browser details. We may record sessions (clicks, scrolling and page changes) to find bugs. All page text, inputs and element attributes are masked before anything leaves your browser, and the usage data our servers send holds counts, times and scores only, so your course content, course names and chats are not recorded in analytics.
How and why we use it
We use your information only to:
- provide the Service: store and search your materials, answer your questions, make quizzes and flashcards, and show your deadlines
- send emails you need, such as due-date reminders, sign-in links and account notices
- keep the Service secure, prevent abuse and enforce usage limits
- fix bugs and understand which features are used
- meet legal obligations
We do not use it for advertising, we do not build profiles to sell, and we do not send marketing emails. We rely on your consent, given when you create an account and connect the extension, and you can withdraw it at any time by deleting your account. If you are in the European Union or United Kingdom, our legal bases are performing our contract with you, our legitimate interests in keeping the Service secure and working, and legal obligations.
AI providers
Chat2L uses AI services to read and index your files and to write answers, quizzes and flashcards. To do that we send them the relevant parts of your materials and messages. We use paid API accounts and turn off data collection and model training wherever the provider allows it: OpenAI’s API with stored completions turned off, Anthropic’s commercial API, and Voyage AI with training turned off.
Your content is not used to train AI models, by Chat2L or by these providers under their terms. Providers may keep requests for a limited time to detect abuse or meet legal duties, under their own policies. We do not claim they delete data immediately.
Who else handles your data
These service providers process data for us, only to run Chat2L, under contracts or terms that require them to protect it:
- Google: sign-in
- OpenAI: writing quizzes, flashcards and study guides
- Anthropic: the chat assistant and reading your documents
- Voyage AI: search embeddings and reranking of your material
- Vercel: hosting for the Chat2L website
- Railway: hosting for our servers, database and document conversion
- Cloudflare (R2): storage for your files
- PostHog: usage analytics, session recordings and error tracking
- Stripe: payments for the Exam Pass
- Mailgun: sending email
We do not sell your data or give it to anyone else, except where the law requires it (for example, a valid court order), to protect someone’s safety, or as part of a merger, sale or reorganization of the business. In that case this policy would keep applying to your data.
Data outside Canada
Several of these providers store or process data in the United States and possibly other countries. While it is there, it may be accessible to courts, law enforcement and national security authorities under those countries’ laws. We choose providers that protect data with encryption in transit and contractual safeguards.
Chat2L Sync Chrome extension
The Chat2L Sync extension has one purpose: to copy your course content from your school’s Brightspace (D2L), Canvas or Moodle site into your own Chat2L account, and to keep it up to date.
Permissions: It asks Chrome for access to chat2l.com and, only after you click Allow, to your school’s Brightspace, Canvas or Moodle address (for Canvas, also Instructure’s file service, inscloudgate.net, where Canvas serves course files). It uses storage to remember its settings, alarms to check for changes, and scripting to link itself to your Chat2L account.
What it reads: While you are signed in to your school’s site in Chrome, the extension uses that existing session to read your course list, course content and the files in it, announcements, assignment folders and due dates, and quiz titles and dates. It only reads the courses you chose to sync. It does not read, store or send your school password or your school site cookies, and it does not read your browsing history or any other website.
What it sends: That content is sent over HTTPS to your Chat2L account and nowhere else. The extension also stores on your device a Chat2L sync token, your school site address, your course choices and the status of the last sync.
How often: It checks for changes about every 30 minutes while Chrome is open and uploads only what is new or changed.
Diagnostics: If a sync fails, the extension sends an error report with the technical error, your school site address, and numeric course and file ids. It does not include course names, file names or file contents. The extension itself sends no analytics, advertising or tracking data.
Limited Use: The use of information received from the Chat2L Sync extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. We use it only to provide the Chat2L features you asked for: chat, quizzes, flashcards and assignment tracking for your own courses. We do not sell it. We do not transfer it except to the service providers in this policy, to comply with the law, or as part of a merger or sale of the business. We do not use it for advertising, to determine creditworthiness or lending eligibility, or for anything unrelated to the extension’s single purpose. People at Chat2L do not read it unless you ask for support and agree, it is needed to investigate abuse or security issues, or the law requires it.
Stopping: Use Disconnect in the extension’s Options, or remove the extension in Chrome, to stop all syncing. Disconnecting does not delete data already sent. To delete it, use Delete account in Chat2L Settings.
Claude, ChatGPT and other AI apps
You can connect Chat2L to an AI app such as Claude or ChatGPT. When you approve the connection, the app can use Chat2L’s read-only tools to list your courses, search and read your synced files, and see your announcements, deadlines, class schedule and Chat2L quiz results. It cannot change, delete or create anything in your account.
What the app receives: only the answer to each tool call it makes, such as a search result or the pages of a document, and only from your own account. Once the app has that answer, it handles it under its own privacy policy, such as Anthropic’s or OpenAI’s.
What we receive and keep: the name of the app you connected, and for each tool call the tool name, what the app asked for (for example a search phrase or a page range), the answer we sent, and whether it worked. We use this to fix problems and improve the tools, and delete it after 30 days. We never receive your conversations with the app, your other chats, or anything else in your account with that app.
Stopping:Disconnect the app in Chat2L Settings to end its access right away, or remove Chat2L in the app’s own settings.
Course materials and copyright
What you sync is stored in your own account, is visible only to you, and is never put in a shared library or shown to other users. We do not publish or redistribute it. Copyright holders and instructors can contact us as described in our Copyright Policy.
How long we keep it
- Your account and content: while your account is active. Removing a course or file in the app only hides it from you; it is not erased until you delete your account.
- Delete account: Delete account in Settings permanently deletes your account, synced courses, documents, chats, everything you created, and every file and recording we stored for you. Copies may remain in database backups and provider logs for a short time afterward, and are then overwritten.
- Analytics and error data: kept in PostHog under a random account id, not your name or email, for up to 12 months. Deleting your account does not erase these records right away; email us if you want them removed sooner.
- AI app tool calls: deleted after 30 days.
- Sign-in links: expire after 24 hours and can only be used once.
- Emails to support: kept as long as needed to help you, then deleted.
If you cannot sign in, email [email protected] and we will delete your account for you.
Your rights
Under Canadian privacy law (PIPEDA), and similar laws such as Quebec’s Law 25, the GDPR and US state privacy laws where they apply to you, you can:
- Access your data. Most of it is visible in the app, and you can ask us for a copy of the rest
- Correct information that is wrong
- Delete your account and data in Settings, or by asking us
- Withdraw consent by disconnecting the extension or deleting your account
- Complain to us, or to the Office of the Privacy Commissioner of Canada (priv.gc.ca), the Commission d’accès à l’information in Quebec, or your local regulator
Email requests to [email protected]. We may need to confirm your identity first, and we reply within 30 days.
Age
Chat2L is for students aged 16 and older. We do not knowingly collect data from anyone younger. If you believe a child under 16 has an account, email us and we will delete it.
Cookies and similar storage
We use cookies to keep you signed in, and PostHog uses cookies or local storage to count visits, record masked sessions and diagnose errors. We do not use advertising or cross-site tracking cookies.
Security
Data is sent over HTTPS, file storage is encrypted at rest by our storage provider, access to production systems is limited to Chat2L administrators, and each account’s data is kept separate from every other account. No system is perfectly secure, and we cannot promise that nothing will go wrong.
If a breach of your personal information creates a real risk of significant harm, we will tell you and report it to the Privacy Commissioner of Canada as the law requires, as soon as we can.
Changes to this policy
We may update this policy. We will post the new effective date here and, for significant changes, tell you in the app or by email before they take effect.
Contact
Privacy questions and data requests: [email protected]