alai Privacy Policy

Last updated: November 4, 2026 · Version: 2026-11-04

Joining the waitlist

When you join the waitlist, we keep your chosen contact (email address or phone number), signup time, and a record that you asked for early access and launch updates in our waitlist database (Convex). Phone signup requires your agreement to launch texts; message and data rates may apply. Joining does not create an alai account. We use a short-lived counter keyed by a hash of your IP address to limit signup abuse; it expires after 20 minutes. Waitlist entries are kept until you ask us to remove them. To leave the waitlist or request deletion, email support@tryalai.app. The waitlist is for people 13 and older.

This policy explains what information alai collects, what we do with it, who helps us process it, how long we keep it, and what you can do about it. "We" and "us" means Aiden Guan and Allen Hsieh, the alai team. alai is a note-taking app with a live handwriting tutor, Ally, at tryalai.app and in our iPad app.

The short version

• We collect what we need to run alai: your email, your notes and handwriting, what you ask Ally, basic usage and error information, and, if you buy a plan, the plan and whether it's paid.
• To read your handwriting and talk with you, Ally sends your work to Anthropic (the AI), your voice to Inworld (speech to text, with ElevenLabs and Deepgram as backups), and the text of Ally's replies to Inworld (Ally's voice). We list every company that handles your data below.
• We don't sell your data, we don't show ads, and we don't use your content to train AI models. Our AI providers don't either, under the terms we use them on. Ally does learn from your own work to help you, with your name and email left out, and that stays with your account.
• We don't store the page snapshots Ally checks, or recordings of your voice. They are processed and then dropped.
• If you buy a plan, Stripe takes the payment. You give your card and billing details to Stripe, not to us: we never see your card number, and we keep only your plan and Stripe's reference numbers for it.
• Your work (handwriting, notes, images, PDFs) is saved on your device. When you're signed in, it's also copied to your account so it follows you between devices.
• You can download or delete your data from the Account page at any time, back it up on the iPad to a folder of your own (such as iCloud Drive, Google Drive, Dropbox or OneDrive), or ask us for a copy, a correction or deletion: support@tryalai.app.
• Anyone 13 or older can use alai. A child under 13 can use it only after a parent or guardian agrees (section 8).

1. What we collect

Information you give us

Information created as you use alai

We don't collect your precise location, contacts, or photos you haven't chosen to add. Your card details go to Stripe, never to us.

2. How we use it

• To run alai: save and sync your work, sign you in, let Ally read your handwriting, answer your questions, speak aloud, find words in your notes, and sort your files.
• To personalise tutoring: Ally uses your learning history and learner model to choose hints that have helped you before.
• To keep alai working and safe: fix bugs, prevent abuse, enforce daily usage limits, and control costs.
• To improve alai: understand which features get used (counts and learning events, not the content of your work), and read feedback you send. When we look at totals across learners, we leave out any group smaller than 10 people, so no one can be picked out.
• To bill you for a plan you buy: to start, renew, change or end it, to show it in the app, to remind you before a yearly plan renews (Stripe sends that email), and to keep the records tax and accounting law requires.
• To contact you about your account and your plan, changes to these policies, or if alai shuts down.
• To follow the law and protect our users and ourselves.

We don't use your information for advertising, we don't build profiles of you for anything other than tutoring you, and we don't sell it or share it for cross-context behavioural advertising.

3. Who processes your data

We use these companies (our "service providers") to run alai. They may use your data only to provide their service to us.

Backups you turn on

On the iPad, you can choose to have alai keep a copy of your work in a folder of your own, in iCloud Drive or another storage app on the iPad, such as Google Drive, Dropbox or OneDrive. It's off until you turn it on. The copy is the same as "Download everything": your notes as PDFs, the pictures and PDFs you added, your homework, your learning history and what Ally knows about you. alai updates it now and then while backups are on.

• The copy goes from your iPad straight into alai's own folder in your iCloud Drive ("Back up to iCloud"), or into a folder you pick in the Files app. alai never sees your password for that service, and can reach only that folder, not your other files. The copy uses your storage with that service, not alai's.
• That service isn't one of our service providers: you choose it, and the account is yours. Once a copy is there, the service's own terms and privacy policy cover it, not this policy.
• Turn backups off in Settings on the iPad at any time. alai then stops adding to the copy. It doesn't delete a copy that's already been made, and neither does deleting your alai account: you can delete it in that service.
• Backups aren't available for children under 13 yet. When they are, a parent will allow them as a separate choice, when they agree to their child using alai (section 8).

We may also share information if the law requires it, to protect someone's safety, to investigate abuse, or as part of a merger or sale of alai (we'd tell you first, and this policy would still apply to your data).

4. Does my data train AI models?

No. We don't use your content to train AI models, and we've set up our providers so they don't either:

• Anthropic: we use Claude through Anthropic's commercial API. Anthropic's Commercial Terms state that "Anthropic may not train models on Customer Content from Services."
• Deepgram: every request we send to Deepgram (speech to text and text to speech) opts out of Deepgram's Model Improvement Program, so Deepgram doesn't keep your audio or text to improve its models.
• ElevenLabs: turns your voice into text during live speech (alongside Inworld), and stands in for Inworld, turning your voice into text and Ally's replies into speech, when it can't. We don't store the audio, but ElevenLabs may keep it for a time under its own privacy policy. Our ElevenLabs account is set so that ElevenLabs doesn't use your audio or text to train or improve its models.
• Inworld: turns your voice into text and Ally's replies into speech. We don't store the audio, but Inworld may keep it, and the text of Ally's replies, for a time under its own privacy policy. Inworld says it never uses the audio it turns into text for training, and its terms of service say it doesn't use the non-public material customers send it to train its models.

Ally learns from your own work, for you. Ally uses your past work, your conversations with Ally and your learning history to tailor its help to you: the hints that have worked for you, what you've already covered, and where you tend to slip. Your name and email are left out of what Ally uses. This stays with your account: it isn't used to help other students or to train AI models, and you can clear it at any time with Reset Ally's memory on the What Ally knows page.

If we ever want to use real student work to improve Ally (for example, to test how well Ally reads handwriting), we'll ask you first, separately, and only use work you choose to share.

5. How long we keep it

When you delete your account, we delete your data from our database within 30 days. Database backups roll off within 30 days after that. The backup copies of your files are deleted along with your account. Deleting your account also cancels any paid plan straight away and deletes your customer record at Stripe, so no card stays saved; Stripe keeps its invoices and payment records for our books.

6. Security

• Your connection to alai is encrypted (HTTPS), and our database and hosting providers encrypt the data they store.
• Our database uses row-level security: each account can only reach its own rows, enforced by the database itself, not just the app.
• You sign in with Apple or Google, a one-time code sent to your email, or a password. If you choose a password, our sign-in provider keeps only a one-way hash of it, so nobody at alai can read it.
• Server keys are never sent to your browser. Snapshots and voice aren't stored, which means there's less to lose.
• Card details go straight to Stripe, which is certified to the card industry's security standard (PCI DSS). They never reach our servers.
• Our logs and error reports are designed never to include your notes, handwriting, voice or what you said.

No system is perfectly secure. If a breach affects your personal information, we'll tell you without unreasonable delay and as the law requires.

7. Your choices and rights

You can:

• See and get a copy of your data. Save any notes page as a PDF, or download all your files, what Ally knows, your practice queue and your learning history from the Account page on the web or Settings in the iPad app ("Download everything"). For anything else, or if that doesn't work for you, email us.
• Correct your name, age range and settings in the app, or ask us to fix anything else.
• Delete your data. Clear what Ally knows and has learned about you, on every device, from the What Ally knows page ("Reset Ally's memory"). Erase what's on a device from the Account page ("Erase everything on this device"). Delete your account and our server copies from the Account page too ("Delete my account"); in the iPad app, both are in Settings. If that doesn't work for you, email us from your account's address.
• Turn off Ally's voice in Settings. Ally only listens while you hold the talk button, while Just talk is on (it turns itself off after 2 minutes with no words), or when you add a problem by voice.
• Cancel or change a paid plan at any time with Manage plan, and update your billing details there (the Terms, section 10).
• Stop using alai at any time.

Email support@tryalai.app. We'll confirm the request comes from your account's email, and respond within 30 days. We won't treat you differently for using these rights.

California residents

If you live in California, the California Consumer Privacy Act (CCPA) gives you the right to know what personal information we collect, use and disclose; to delete it; to correct it; and to opt out of its sale or sharing; and to not be discriminated against for exercising these rights. We give these rights to every user, wherever you live.

• Categories we collect (CCPA terms): identifiers (email, random IDs, IP address); customer records (name, email, and for a paid plan, the billing address and card details Stripe holds for us); commercial information (the plan you bought and its payment history); characteristics (age range); internet activity (usage counts, logs); audio information (your voice while you talk to Ally, not stored); inferences (learning profile: which topics and hint styles suit you); and the content of your notes and messages to Ally.
• Sources: you, your device, and our service providers.
• Purposes and recipients: sections 2 and 3.
• Sale and sharing: we have not sold or shared (for cross-context advertising) personal information, and we won't. We don't knowingly sell or share the data of anyone under 16.
• Sensitive personal information: we use your account sign-in only to sign you in, and card details (held by Stripe) only to take payment for your plan. We don't use any sensitive information to infer characteristics about you.
• Global Privacy Control: we don't sell or share, so there's nothing to opt out of, but if your browser sends the signal, PostHog analytics stay off for it, on our pages and in the app.
• Authorised agents may make requests for you with your written permission; we may ask you to confirm.

8. Children

A child under 13 can use alai only after a parent or guardian agrees. The child gives us a parent's email address, which we use once to send the parent the notice below. We don't keep it, apart from a scrambled copy for one day so the same address isn't emailed again and again. We collect nothing else from the child until the parent signs in at tryalai.app/parent, agrees, and passes a card check. Parents look after their children's profiles on that page. This is what we tell a parent before they agree:

If a parent buys a plan that covers a child's profile, the parent pays through Stripe, which receives only the parent's details, never the child's.

9. Where your data is processed

alai is run from the United States, and our providers process data mainly in the United States. alai is intended for users in the US.

10. Changes to this policy

We'll update this policy when alai changes. If a change is significant, we'll tell you by email or in the app before it takes effect, and ask again where the law requires it. The date at the top shows the latest version.

11. Contact

Aiden Guan and Allen Hsieh · support@tryalai.app