Privacy policy

In short

Cramless reads your Google Classroom so it can tell you on WhatsApp when new homework or an exam appears, plan when you could study, answer your questions about your work and mark practice answers. This policy explains exactly what that involves.

• Cramless only collects what it needs to do those things.
• Your data is not sold, not used for advertising and not used to train AI models.
• A few companies outside Egypt run parts of Cramless. They are named below, and your data goes to them only with your consent.
• You can delete everything at any time from Settings.
• If you are 13 or 14, a parent or guardian has to agree in writing before Cramless reads your Google Classroom or messages you.

Who we are

Cramless is run by Ali Abdelaziz, an individual in Giza, Egypt, under the name Cramless. It is not yet a registered company. Under data protection law he is the controller of your personal data: he decides how it is used and is responsible for protecting it. In this policy, "we" and "us" mean him.

For anything about your data, write to privacy@cramless.ai. For help with the app, write to support@cramless.ai. A person reads and answers both. Cramless has no separate data protection officer, so privacy@cramless.ai reaches the person responsible.

What we collect

What Cramless holds about you, and where it comes from:

• From your Google account when you sign in: your Google account identifier, email address, name and profile picture, as Google provides them.
• From Google Classroom: the names of your courses, and the title and due date of the coursework set in them. Cramless also reads each description, to tell homework from exams and to find an exam's topics, and keeps those topics but not the description. Your teachers write all of this. Cramless only reads it and never changes anything in Google Classroom.
• The permission Google gives Cramless to keep reading Classroom while you are away, stored encrypted, with a record of which permissions you granted and when it was last used.
• Your WhatsApp phone number, once you prove it is yours by sending a code from it, and your time zone.
• The messages you send Cramless on WhatsApp and its replies, and copies of the alerts, reminders and weekly summaries it sends you, with whether each one was delivered. Questions you ask in Ask on the website are answered but not stored. If you message Cramless on WhatsApp before your number is connected, your number and message are kept for 30 days.
• What you tell Cramless: your week, the hours you are free, work you add or change, homework that repeats, your settings, and a record of each change made to your work, so the last one can be undone.
• In the Study section: the answers you write to practice questions, and the marks and feedback they were given.
• Your age group and the consents you give when you sign up, with the date and the version of this policy you agreed to. If you are 13 or 14, your parent's or guardian's name and email address, and their written consent: each statement they agreed to, and when.
• Technical records: our hosting providers log each request to the site, including your IP address and browser, and our sign in service records the IP address of each sign in, to keep accounts secure. Cramless also counts the requests from each account and each WhatsApp number, to stop misuse, and keeps a record of each time the AI is used. That record says which feature and model were used, whether it worked and how much it was used, but not what was said.
• Anything you tell us when you write to us.

What we do not collect

Cramless asks Google for two read only permissions: one to see the list of your courses, and one to see the coursework in them. Google describes the second permission as covering your coursework and grades, so it could in principle let an app read your own submissions and grades. Cramless never asks Google for them and never stores them. It asks Google only for the course and coursework details it uses, so your classmates' and teachers' details, attachments, your email, your files and everything else in your Google account never reach Cramless, and it cannot change anything in Google Classroom.

There is no analytics, no advertising, no tracking pixel and no third party script on any page of this site.

Why we use it

Cramless uses your data only to:

• tell you about new homework and exams, remind you before deadlines and send you a weekly summary;
• work out a study plan around the time you say you are free;
• answer the questions you send about your own work;
• mark the practice answers you submit;
• keep your account and the service secure and stop misuse;
• reply when you write to us, and meet our legal obligations.

Our legal basis

Under Egypt's Personal Data Protection Law (Law No. 151 of 2020), we rely on these grounds:

• Your explicit consent, which you give when you sign up, is the basis for everything Cramless does with your data. Data about people under 18 counts as sensitive data under the law, so we ask for this consent explicitly and keep a record of it. If you are 13 or 14, the consent must come from your parent or guardian in writing.
• Your explicit consent to your data being sent to the companies outside Egypt named below.
• Where the law requires us to keep or disclose something.

You can withdraw your consent at any time, as explained under Your rights. That does not make anything done before it unlawful. Cramless cannot work without the consents above, so withdrawing them means your account is deleted.

AI in Cramless

Some features use an AI model, Claude, made by Anthropic. When you send Cramless a question that is not one of its fixed commands, on WhatsApp or in Ask, the AI writes the answer. So that the answer is about your actual work, Cramless sends Anthropic your question, your coursework titles, course names, due dates and any exam topics, your homework that repeats, your week, your study plan and your time zone. On WhatsApp it also sends up to your last three messages and its replies from the past 30 minutes, and in Ask, the conversation on the page, up to the last ten messages. On WhatsApp the AI can also work out a change you ask for, such as adding homework. Cramless checks it before saving it, and you can send undo to take it back. When you submit a practice answer, your written answers, the question and AQA's mark scheme are sent to Anthropic so they can be marked.

When Cramless answers a question or marks an answer, you are dealing with an AI, not a person. AI can be wrong, so check anything important in Google Classroom, and treat a mark as an estimate, not an official AQA mark. Cramless does not use AI to make any decision that has legal or similarly serious effects on you.

Under Anthropic's commercial terms, Anthropic does not use what Cramless sends it to train its models, and deletes it within 30 days. If a message is flagged as breaking Anthropic's usage policy, Anthropic can keep it for up to 2 years.

Google user data

Cramless's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

In practice, data from Google Classroom is used only for the features described in this policy, which you can see and use. It is passed only to the services that run Cramless for you: Supabase and Vercel, which store and serve it, Twilio and WhatsApp, which carry the alerts that quote it, and Anthropic, which reads it only to answer your own questions and carry out what you ask. It goes to no one else unless that is needed for security or required by law. It is never sold, never used for advertising and never used to train AI models, including Anthropic's. No person reads it unless you ask us to look into a problem and agree to it, it is needed for security, or the law requires it.

Who handles your data

Cramless is built on a few services. Each one processes your data only to run its part of Cramless, as a processor under its terms with us. Google and WhatsApp also handle it under their own terms with you.

• Supabase stores the database and runs sign in. Its servers for Cramless are in Frankfurt, Germany.
• Vercel hosts the website. It runs Cramless's code in Frankfurt, Germany, and as a company in the United States may also handle request logs in the United States.
• Anthropic runs the AI, in the United States.
• Twilio delivers the WhatsApp messages, so it sees your phone number and the messages. It is in the United States.
• WhatsApp, owned by Meta, carries the messages under its own terms with you, in several countries.
• Google signs you in and is where your Classroom data comes from, under its own terms with you, in the United States and other countries.
• Namecheap hosts the cramless.ai email, so it holds anything you write to us. It is in the United States.
• Resend sends the email that asks a parent or guardian to agree, so it sees their email address, the student's email address and the message. It is in the United States.

Apart from these, your data is not shared with anyone, unless the law requires it, for example under a court order. If a company takes over running Cramless, we will tell you first, and your data moves to it only if you agree.

Data sent outside Egypt

All of the services above are outside Egypt, in Germany, the United States and other countries, and some of those countries do not protect personal data to at least the level Egyptian law requires. Your data is sent to them only with your explicit consent, which you give when you sign up, and each one receives only what it needs for its part.

How long we keep it

Deleting your account removes your data from Cramless's database straight away. Copies can remain for a short time after that: in database backups for up to 7 days, with Anthropic, with WhatsApp and with Resend for up to 30 days, in hosting and sign in logs for up to a day, and in Twilio's records of the messages it delivered until we delete them, which we do if you ask.

• Your account, Classroom data, plan, week, settings and consent records: as long as your account exists.
• Messages you send Cramless and its replies: 30 days.
• Copies of the alerts, reminders and summaries Cramless sends you: as long as your account exists, because they stop the same alert being sent twice.
• Practice answers and marks: until you delete them from your practice history, or delete your account.
• Counts of requests, which name your account or WhatsApp number: about a day. Hosting and sign in logs, which include your IP address: up to a day.
• Records of AI use: when you delete your account, the link to you is removed and only an anonymous record is kept.
• Emails you send us: 12 months after we finish dealing with what you asked.

Your rights

Under Egyptian law you have the right to:

• know what we hold about you and get a copy of it in a common file format;
• have it corrected if it is wrong;
• have it deleted;
• withdraw your consent;
• object to its processing, or ask us to limit its processing to a specific scope;
• be told about any breach of your personal data.

Most of this you can do yourself. You can change your week, plan and settings in the app. Settings, Delete everything removes your account and everything in it straight away, and asks Google to withdraw Cramless's permission. You can check that at myaccount.google.com/permissions, where you can also remove Cramless yourself at any time, which stops it reading Classroom.

For anything else, including a copy of your data, write to privacy@cramless.ai from the email address you sign in with, so we know the request is yours. We will answer within 30 days.

If you are not happy with how we handle your data, you can complain to Egypt's Personal Data Protection Center (www.pdpc.gov.eg). Please give us the chance to put it right first, at privacy@cramless.ai.

Children and parents

Cramless is for school students aged 13 and over. It is not for anyone under 13, and if we learn that someone under 13 has an account, we delete it.

• 13 or 14: Egypt's data protection regulations need prior, explicit, written consent from your parent or guardian. When you sign up, Cramless asks for their email address and emails them a link, which works for 7 days. Your parent or guardian agrees by ticking each statement and typing their name. Until they agree, Cramless does not read your Google Classroom or send you messages, and it keeps only their email address and what your Google sign in gives it, so that it can ask them. If your account already held more, Cramless gives up its Google permission and leaves the rest unused until they agree or the account is deleted. Their consent lasts until the account is deleted, and they can withdraw it at any time by writing to privacy@cramless.ai, which deletes the account.
• 15 to 17: you give consent yourself when you sign up. It is still a good idea to show this page to a parent or guardian and talk it through.
• Parents and guardians can ask for a copy of their child's data, or ask for the account to be deleted, by writing to privacy@cramless.ai.

WhatsApp messages

Cramless only messages you on WhatsApp after you connect your number by sending it a code, which is how you agree to receive its messages. It sends alerts when new homework or an exam appears or a teacher moves a deadline, reminders before deadlines, a warning when you fall behind your plan, a weekly summary, a message if your Google connection stops working, and replies to what you send.

Alerts, reminders and summaries are scheduled for between 16:00 and 22:00 in your time zone. If WhatsApp made one wait because you had not written for a day, it is delivered when you next write, at whatever time that is. Send stop at any time and Cramless stops messaging you, except to reply when you write. Send start to turn messages back on, and anything held while they were off is then delivered. You can also ask us to stop by writing to support@cramless.ai, which also reaches a person rather than the assistant.

Keeping it secure

Everything is sent over encrypted connections and stored encrypted by our hosting providers. The Google permission is encrypted again by Cramless before it is stored in the database, where no browser can reach it, and it is never kept in your browser. The database itself makes sure each account can reach only its own records, and requests are rate limited to stop misuse.

If there is a breach of your personal data, we will report it to Egypt's Personal Data Protection Center within 72 hours of finding out, and notify you within 3 working days of reporting it, with what happened, what we have done and what you can do.

Cookies

Cramless uses a sign in cookie to keep you signed in. It is renewed while you use Cramless, lasts up to 400 days after your last visit, and is removed when you sign out. A second cookie is used only while Google is signing you in, and is removed when that finishes. When you sign in from the page that asks your age, a third cookie holds your age group and your agreement for up to 30 minutes, so that they can be recorded when Google sends you back, and it is removed as soon as they are read.

If you choose light or dark mode in Settings, a cookie remembers that choice for a year. If you leave the theme on your device's setting, this cookie is not set.

When you delete your account, the page keeps a one-off note in your browser's session storage to show it worked, and removes it as soon as it is shown.

There are no analytics cookies, no advertising cookies and no third party cookies. Every cookie Cramless sets is either needed for the site to work or remembers a choice you made, which is why there is no consent banner.

Changes to this policy

If we change this policy in a way that matters, we will tell you by email to the address you sign in with, and on the website, at least 14 days before the change takes effect, and change the date at the top. If you are 13 or 14, we ask your parent or guardian to consent again. If a change means using your Google data in a new way, we will ask for your consent again first.

Language

This policy is published in Arabic and English. If the two differ or conflict, the Arabic version applies.