Privacy policy

Effective 2026-09-16. This page is version 2026-09-16 — the version Knowlu writes down beside your name on the day you accept it.

Your vault stays on this machine. Knowlu's servers hold your account, the judgments they make for you, and what you correct; they never hold the text of your notes, and nothing here is ever sold or shared.

That is the whole policy in one line. The rest of this page is the same promise said slowly, so you can check it.

Who we are, and how to reach us

Knowlu is an independent business in Alabama, run by its founder — one person, who also writes the code. There is no support department and no ticket queue: write to [email protected] and a person reads it. Questions about this policy, a request to see or correct or delete what we hold, and anything you think we got wrong all go to that address. Security problems go to [email protected]. If you would rather write on paper, ask and we will send you a postal address.

What stays on your machine

Knowlu is a desktop app first. These four things live on your PC and are yours. We hold no copy of your notes, your logins or your backups — the two calendar links, and the corrections described below, are the only things on this list that also exist on our side.

Your vault — the folder Knowlu makes at %USERPROFILE%\Knowlu\. Plain Markdown files with a short header, one per task, plus a record of every change under state\journal\. You can read all of it in any text editor, and you can walk away with it.
App data — %LOCALAPPDATA%\knowlu\: which profiles exist, your settings, when you last looked, and the last sixty run logs.
Coursework logins — Windows Credential Manager, under knowlu/<profile>/<source>. Never in the vault, never in a backup, never in a log, and never on our servers.
Your backup folder, if you set one — a mirror of the vault and one dated snapshot a day, in a folder you chose and control.

What we collect, and why

By category, with the reason it exists. If a category is not on this list, we are not collecting it.

Your account: The email address you sign up with; your password, which Supabase holds as a hash and which we never see; the fact that you attested you are 18 or older, as a yes and a timestamp; and which version of these two policies you accepted, and when. Without it there is nobody for a subscription or a judgment to belong to.
Your subscription: Stripe takes the payment and holds the card. We never see a card number. Stripe also asks for your billing address, because whether a state charges sales tax on Knowlu depends on where you are; Stripe holds that too. What we keep is a Stripe customer id, which plan you are on, whether it is active, and when the current period ends. We also keep a record of the agreement itself — the price, the version of the terms, the moment, and the IP address it came from — because California requires a subscription seller to be able to show what the customer agreed to.
Your calendar links: The link to your school's assignment feed, and the secret address of your own calendar if you add one. They are what let Knowlu read what is due and what your day already has in it. A calendar link is a password in disguise — anyone holding one can read that calendar — so both are stored encrypted (see Security) and neither is ever written to a log.
Your coursework logins: On your machine only, in Windows Credential Manager, never on our servers. Knowlu signs in to zyBooks and VHL from your PC, with your credentials, and reads the assignment list that comes back; that list — never the password — may be read on our servers so that one parser can serve everyone. The password stays on the machine, and there is no column in our database for one.
What you do in Knowlu: Interaction events: which view you opened, what you ticked, snoozed, approved or declined, and how long a card was on screen. There is no free text in an event and never a course name or a title. The named use is a short list of questions — is the ranking agreed with, where do the judgments go wrong, does anyone actually open Knowlu in the morning — and nothing else.
Your corrections: When you change a field a judgment set — how long something will take, how much it matters, which course it belongs to — we keep the old value, the new value, the item's id and what kind of item it was. A correction to a course keeps the fact that it changed and drops both names; a correction to a title is not recorded at all. This is the one thing that makes next month's judgments better than this month's, and it is why it is collected under the terms rather than behind a switch.
Diagnostic logs: Only when you send an issue report. It carries the last 200 lines of the app's and the engine's logs, the build versions, your Windows build, the profile id, counts of what is in your vault — never the names of things in it — the name of the view you were looking at, and your last three runs. You see the exact text before it is sent, with email addresses, links and anything shaped like a key already replaced, and you can edit it or cancel.
Gmail, if you connect it: Message metadata and text, held in memory for the length of one judgment and then discarded. What survives is the message id, what we decided it was, and the fields that ended up on the card you saw. Its own section is below.

What we do not collect

No birthdate. The 18+ gate is an attestation — a yes and a timestamp. There is no date-of-birth column in our database and there is not going to be one.
No card number. Stripe's payment page is Stripe's; the card never touches Knowlu.
No campus password. Knowlu never asks for your university sign-in, and there is nowhere in the app to type one. When you sign in to your school, it happens on your school's own page, in a window Knowlu opens, and Knowlu never sees what you type there. Once you are signed in it uses that window's own session, on your machine, to fetch two things — your calendar link and your course list — and then throws the session away. It keeps neither the password nor the cookies.
No note bodies stored. The text of your tasks and notes lives in the folder on your machine and we keep no copy of it. What travels to the model is what the judgment needs and nothing more: the note's title and up to the first 1,200 characters of its text, your stated preferences and grade weights, and for an email its subject, its sender and up to the first 1,200 characters of the message — for the length of that one call, and written down by neither side. If we ever start keeping them it will be a separate switch, off by default, with its own screen explaining what and why — and no such switch exists today.

Who else touches it

Six companies, each doing one job, and only two of them ever have any content of yours read by a model.

Supabase — hosting, the database and the sign-in system. Your account row, your password hash and every row above live there.
Stripe — payments and the subscription. Stripe sees your card; we do not.
Cloudflare — this website and the downloads.
OpenRouter — the router every judgment request goes through on its way to a model. It carries the text but does not itself run a model on it, sends every request under zero data retention — never as a default it could quietly lose — and trains nothing on what passes through. Each request names the one company allowed to answer it and is refused outright, never sent somewhere else, if that company cannot meet every requirement we set.
CoreWeave — reads your assignments and the events on your calendar to make those judgments, one item at a time, only while a judgment is being made, on a zero-retention endpoint that trains nothing on what it reads.
DeepInfra — reads your email to make those judgments, one item at a time, only while a judgment is being made, on a zero-retention endpoint that trains nothing on what it reads.

CoreWeave and DeepInfra are the only two places your content is ever sent to be read by a model. We hold the text for the length of the call and then let it go; what we write down is the answer.

One more, doing nothing with your data but delivering it: the provider that sends our account and billing email sees the address a message is going to. Nobody else gets anything. There is no advertising network, no data broker and no analytics company anywhere on this list.

We do not sell or share your personal information

We do not sell it, we do not rent it, and we do not share it for anyone's advertising — not for money and not for anything else of value. There is no opt-out link on this site because there is nothing to opt out of, and a Global Privacy Control signal has nothing to switch off. If that ever changed it would be a new version of this policy and a question asked in the app, not a quiet edit to this paragraph.

Gmail

Connecting Gmail is optional, it is off until you turn it on, and you can disconnect it in Settings at any time — which revokes our access at Google and deletes the stored connection. (Gmail is not connected in this version of Knowlu; the app will say when it is.)

Knowlu's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In plain words:

Gmail data is used for one thing: finding the obligations in your own inbox and proposing them as tasks inside Knowlu, where you approve or decline each one.
It is transferred to the companies named above: Gmail text goes to OpenRouter, which carries the request under zero data retention and reads none of it itself, and to DeepInfra, which reads it on a zero-retention endpoint to make that judgment for you. Google Calendar events go to OpenRouter the same way and to CoreWeave, which reads them on a zero-retention endpoint to make that judgment for you — Google's Limited Use terms bind Calendar data the same way they bind Gmail's. Nowhere else, and never for advertising, credit, lending or resale.
No human at Knowlu reads your mail without your explicit consent. There is no support tool that opens an inbox. The one path by which a message could reach a person is the issue-report screen, where you choose to include it, see exactly what will be sent, and send it yourself — message by message, one decision at a time.
It is never used to train or improve a model beyond the rules Knowlu learns for your own account. Rows that came from Gmail are flagged as such and are excluded from anything that would pool them with another person's.
Attachments are never fetched. Knowlu reads the headers and the text of a message and stops there.
Message text is discarded when the judgment is done. What is kept is the message id, so the same email is not proposed to you twice, the decision, and the fields on the card.

Today the Gmail connection is in Google's testing mode, because the review that opens it to everyone takes weeks and has not finished. That has two consequences, and the app says both of them where you would meet them: it works for at most 100 people, each named in advance as a test user, and each of those connections expires after seven days and has to be made again. When Google's review is done, this paragraph changes.

How long we keep it

Account data — until you delete it. Deleting is immediate, and it is a purge rather than a flag.
A tombstone — after an account is deleted, a hash of the email address and the date stay for 90 days, so that we can tell whether an address has deleted an account recently. It cannot be turned back into an address, and after 90 days it is gone too.
Issue reports — 90 days, then deleted automatically.
The subscription consent record — at least three years, because California's subscription law requires a seller to be able to show what the customer agreed to for that long. It is the one record a deletion does not take with it: when you delete your account it loses your account id and the IP address it was taken from, and keeps the hash of your email address, the price, the terms version and the date — enough to answer "what did the seller show that day", and no name, no address and no account to attach it to.
Events and corrections — deleted with the account. While the account exists they stay, because the corrections are what the judgments learn from.

Your rights, wherever you live

Four rights, built for everyone who uses Knowlu. There is no threshold to meet, no state you have to live in, and nothing to prove.

Know and access — this page is the list, and the export below is the contents.
Export — everything our servers hold that is meaningful to you comes back as one file: the account, the subscription, the consent records, which calendar links exist, your events, your corrections and your issue reports. Ask at [email protected] and we will send it. Your notes are not in it because they were never here — they are the plain files in your own folder, which is the best export there is.
Correct — most of what we hold about you is a judgment about your own work, and correcting one is a normal Tuesday: change the field in Knowlu and the correction stands. If something we hold is wrong and you cannot reach it from the app, write to us and we will fix it.
Delete — Settings → Delete my data. It removes the vault, its snapshots in your backup folder, your coursework logins in Credential Manager, the app's data on this machine, and the account and everything under it on our servers. The subscription stops at the end of the period you have already paid for. What is left afterwards is the 90-day tombstone and the consent record described above — and Stripe's own record of the payments it took: your email address, your billing address, the card and the charges. That is a payment record with its own retention rules, and deleting it is not something this button does; Stripe's privacy policy is where to read what Stripe keeps and for how long.

Knowlu is for people 18 or older

An account requires you to attest that you are 18 or older, because a subscription is a contract and at 17 it is not one that binds. If you tell us you are under 18 the sign-up is declined, we say why, and nothing you typed is kept. We do not ask for a birthdate, we do not estimate your age from your face or your files, and Knowlu is neither built for nor sold to anyone in primary or secondary school. If you are 17 and this is the wrong answer for you, write to us — the honest reason it is the answer is that the alternative is collecting a birthdate from everybody.

Security, and what happens if it fails

Everything between the app and our servers goes over HTTPS. What our database stores is encrypted at rest, and your calendar links are encrypted a second time before they are written, with a key the database does not hold and only the code that fetches your feeds can use. Portal passwords are the clearest case of all: they are never sent to us, so there is no server anywhere holding one. Sessions live in Windows Credential Manager, not in a file.

One person is responsible for security at Knowlu — its founder, the same person who answers support — and [email protected] reaches them directly. If you find a way in, that is the address, and you will get an answer from a person.

No system is perfectly safe, and this page is not going to pretend otherwise. If we determine that a breach has reached information about you, we will tell you as fast as we can and in no case later than 45 days after we determine it, with what happened, what was in it, and what to do about it. Alabama's breach law sets that deadline for people who live in Alabama; we are making the same promise to everyone.

Do Not Track

Knowlu is a desktop app, and this is a static website. Neither one follows you across other websites or over time, and no third party collects anything about you through either of them: there are no advertising pixels, no analytics scripts, and no cookies dropped by anyone else. So there is nothing for a Do Not Track signal to switch off, and Knowlu does not change its behaviour when it sees one — its behaviour is already the one that signal asks for.

Changes to this policy

Every version of this page carries a date, and that date is the version Knowlu records when you accept it. If we change something that matters — a new category collected, a new company on the list, a new use for what we already hold — we will email the address on your account, and Knowlu will show you the change and ask, before the new use begins. Carrying on using Knowlu is not how we take consent for a materially different use of your data; a yes is. Smaller changes — a clearer sentence, a corrected address — get a new date on this page and nothing more.