Privacy Policy

1. Who we are

Soma is an independent study-productivity application. For privacy inquiries, visit our Contact page.

2. Information we collect

• Account data — your email address and password (salted and hashed by Supabase Auth, never visible to us), or your Google account identifier if you sign in with Google.
• Profile details — your birth year, used to confirm you are at least 13; your education level; and, only if you choose to add it, the university you attend, picked from a list.
• App data stored on our servers — your courses, reading lists and progress, tasks, planned study sessions, timed study sessions, app settings, saved AI chats, and AI memory. These are linked to your account and stored in Supabase.
• Documents you upload — files you add to Documents are stored in Supabase, together with the text extracted from them so Soma's AI can use them when you ask it to.
• Canvas data — when you connect Canvas, Soma saves your Canvas calendar feed URL to your account and reads your assignments and due dates from it through a Vercel serverless proxy. Your courses are saved to your account; the assignment list itself is cached in your browser rather than stored on our servers.
• Course websites you import — when you paste a course site's schedule page, its text is sent to Anthropic to pick out the dated work. Only the items you choose to add are saved, as tasks.
• Google account data — Soma uses Google in two ways: signing in with Google, and connecting Google Calendar. Connecting a calendar requests read-only access to your calendar (calendar.readonly) and your Google email address (userinfo.email), so Soma can show your events around your study plan and tell connected accounts apart. Soma never creates, edits, or deletes calendar events. Google Calendar access and refresh tokens are stored server-side and are reachable only by our serverless functions. Section 5 explains how Google user data is used and Section 6 explains how it is protected.
• AI chats and memory — when you use AI features, your messages and the relevant context (courses, tasks, schedule, calendar events, Canvas assignments, and the text of documents you have uploaded) are sent to Anthropic to generate a response. Chats in the AI tab are saved to your account so you can come back to them, and you can delete them. Soma also keeps a short memory of lasting facts it learns from your messages, such as when you prefer to study, and a short note of each conversation (what was discussed, decided and planned) so it can recall them in later chats; you can review, edit and delete both in Settings → Memory. For each AI response, Soma records how many tokens it used and what it cost, but not what was said, so we can keep the service affordable.
• Voice input — dictation uses your browser's built-in speech recognition, and Soma receives only the resulting text. Depending on your browser, the audio may be processed by the browser's maker (for example, Google for Chrome) under that company's terms.
• Usage analytics — Soma uses Vercel Web Analytics to count page views. It records the page's path (never the rest of the address), the referring site, and your browser, operating system, device type, and country. It sets no cookies and does not identify you or link visits to your account.
• Payment data — handled by Stripe. Starting a free trial requires a card, entered on Stripe's checkout page. Soma stores your subscription status and plan, never your card number.

3. How we use your information

• To provide, operate, and improve the Soma service.
• To process subscription payments and manage your account.
• To send transactional emails (account confirmation, billing receipts).
• To provide AI-powered features by sending context to Anthropic.
• To respond to support and privacy requests.

We do not sell your personal data to third parties.

4. Third-party services

Each of these providers has their own privacy policy. We encourage you to review them.

5. Google user data and Limited Use

Soma connects to Google only after you explicitly grant permission, and only for the features described below. You can disconnect Google at any time in Settings, or revoke Soma's access from your Google Account permissions page.

Limited Use commitment

Soma's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

Artificial intelligence and machine learning

We do not use, transfer, or sell Google user data, whether raw, aggregated, or derived, to develop, train, improve, or personalize foundational or generalized artificial intelligence or machine learning models. This restriction applies to Soma and to every service provider we work with.

When you ask Soma's AI to plan your time, your calendar events may be included as context so the plan works around them. They are sent to Anthropic's API for the sole purpose of producing the response you asked for. Under Anthropic's commercial terms, inputs and outputs submitted through its API are not used to train Anthropic's models. Soma does not send Google user data to any AI provider except in response to an action you take.

Human access

No Soma employee or contractor reads your Google user data. The only exceptions are the narrow cases permitted by the Limited Use requirements: where we have your explicit consent for a specific issue, where it is necessary for security purposes such as investigating abuse, or where we are required to do so by law.

No sale or advertising

We do not sell Google user data, and we do not use it for advertising, ad targeting, profiling, or credit assessment. We do not transfer it to data brokers, information resellers, or any other third party except the service providers listed in Section 4 that are strictly necessary to operate the features you use.

6. How we protect your data

We apply the following technical and organizational safeguards to all personal data, including sensitive data obtained through Google APIs:

• Encryption in transit. All traffic between your browser, Soma, and every third-party API is encrypted using HTTPS with TLS 1.2 or higher. Soma is served strictly over HTTPS.
• Encryption at rest. Account and application data is stored with our infrastructure providers (Supabase and Vercel), which encrypt stored data and backups at rest using AES-256.
• OAuth token handling. Google Calendar refresh tokens are held server-side only. They are never sent to the browser, never written to local storage, and are accessible only to our serverless functions using a privileged key that is not present in client code.
• Access control. User data tables enforce row-level security, so a signed-in user can read and write only their own rows. Administrative credentials are restricted to server-side functions and are not shared.
• Least privilege on scopes. We request the narrowest Google scopes that support the features you use: read-only calendar access and your email address, nothing else.
• Authentication. Accounts are authenticated through Supabase Auth. Passwords are salted and hashed by the provider and are never stored or visible to us in plain text.
• Segregation and minimization. We collect only the data needed to deliver the feature you requested, and we do not combine Google user data with data from other sources to build profiles.
• Deletion on request. Disconnecting a Google Calendar removes its stored tokens. Deleting your account removes associated server-side data on the timeline described in Section 7.
• Incident response. If we become aware of a breach affecting your personal data, we will investigate promptly and notify affected users and any applicable regulator as required by law.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you believe your account has been compromised, contact us immediately using the details on our Contact page.

7. Data retention

• Account and server-side app data is retained until you delete your account.
• Data cached in your browser (Canvas assignments, calendar events, local preferences) is kept until you clear your browser storage or use Settings → Clear local Soma data.
• After account deletion, server-side data is removed within 30 days. Backups may retain data for up to 90 days.

8. Your rights

Depending on where you live, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Erasure — request deletion of your account and associated data. You can do this directly from Settings → Delete Account, or by contacting us.
• Portability — request your data in a portable format.
• Correction — request that inaccurate data be corrected.
• Opt-out of AI data processing — you can stop using AI features at any time to prevent further data being sent to Anthropic.

California residents have additional rights under the CCPA, including the right to know what personal information is collected and the right to non-discrimination for exercising privacy rights. We do not sell personal information.

To exercise any of these rights, contact us via the Contact page.

9. Children

Soma is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us personal information, please contact us and we will promptly delete it.

10. Cookies and local storage

Soma uses your browser's local storage to keep you signed in (your Supabase session) and to cache your settings, courses, and imported Canvas and Google Calendar data so pages load quickly. Soma uses no advertising or tracking cookies.

11. Changes to this policy

We may update this policy from time to time. If we make material changes, we will update the "Last updated" date and, where appropriate, notify you by email or in-app. Continued use of Soma after changes take effect constitutes acceptance of the revised policy.