Hamstr Privacy Policy

Last updated: October 7, 2026

This Privacy Policy explains what information Hamstr ("Hamstr," "we," "us") collects when you use the Hamstr Mac app, app.gethamstr.com, and gethamstr.com (the "Service"), how we use it, and your choices. Hamstr is an independent business based in British Columbia, Canada, and is responsible for your personal information. We follow British Columbia's Personal Information Protection Act (PIPA) and Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) where each applies, including PIPEDA for applicable commercial information flows across provincial or national borders.

1. Information we collect

Account information. When you sign in with Google, we receive your email address and a Google-provided account identifier through our authentication provider, Supabase. We don't receive your Google password.

Files you upload. When you generate cards, the PDF you choose is sent to our servers. We pull the text out of it (and, if figures are turned on, render slide images) and send that content to our AI model provider to make your cards. Hamstr's generation process does not retain the original PDF or extracted text after the request finishes. This does not mean that resulting cards and figures, or temporary copies processed by service providers, are immediately erased; see Sections 3 and 4. If figures are turned on, the cropped slide images attached to your cards are stored so they can show up in your decks.

Your study data. Your decks, cards, tags, settings, and review history are stored on your device. When you're signed in, they're also synced to our database so they're available across the Mac app and web app.

Usage and billing records. For each generation we record the date, page count, card count, and similar technical details to enforce plan limits and fix problems. If you subscribe, Stripe collects your payment details; we receive your subscription status, plan, and billing period, but never your full card number.

Technical logs. Our servers keep technical logs (such as request IDs, your account ID, errors, and timing) to keep the Service running and secure.

Phone verification. To keep the free plan fair, we may ask free users to verify a mobile phone number with a one-time text code. Our SMS provider, Twilio, receives the number to send and check the code. We store only a keyed, one-way scrambled copy (a hash) of the number and the date you verified, so we can tell whether a number is already used by another account. We don't store the number itself, and we never use it to text you anything else.

Terms acceptance. We record when you accepted our Terms of Service, which version you accepted, and whether you used the Mac or web app.

Support and complaints. If you contact us, we receive the contact details and information you send, including copyright complaints and responses. Please send only what is needed to handle your request.

Website visits. Our websites use Vercel Web Analytics to count page visits. It uses no cookies and does not identify you; it records the page, referring site, country, and device and browser type.

We don't use advertising trackers, and we don't sell your personal information.

2. How we use information

We use information to: provide the Service and generate your cards; sync your data; enforce plan limits and process payments; keep the Service secure and prevent abuse; respond to support requests and legal requests (including copyright notices); and improve reliability. We don't use your uploads or study data to train AI models.

We explain the purposes of collection and obtain meaningful consent where required. Uploading material requests the processing described here, including sending extracted text and selected images to Together AI. Only upload personal information about others if you have the consent or other lawful authority needed for this processing. Your school allowing an upload does not by itself resolve other people's privacy rights. We collect, use, and disclose information only for reasonable, appropriate purposes and do not make unrelated optional uses a condition of service. We seek new consent when legally required for a new purpose.

3. Service providers

The following providers support the Service. We give them only the information needed for their role, subject to the other disclosures described below:

Together AI's published documentation says inputs and outputs are not stored by default, temporary caching may occur, and model-training sharing is opt-in. Its handling depends on the applicable account settings and service terms; we do not promise that all providers erase every copy as soon as a request finishes. We remain responsible for personal information under our control and use contractual and other safeguards appropriate to each provider's role. Google and Stripe also handle information for their own sign-in, payment, security, and legal purposes under their respective privacy policies.

Copyright and legal matters. As permitted or required by law, we may disclose information to respond to lawful requests, investigate misuse, or protect legal rights and safety. We may forward a copyright complaint to the affected user and share a relevant response with the complainant when legally permitted or required. We limit this to what is necessary and seek consent where required. We do not give a complainant private account or contact details merely because they ask.

Business transfers. A proposed or completed business sale may involve limited disclosure only where allowed by privacy law and subject to required confidentiality, purpose, and return-or-destruction safeguards. If a transfer completes, we give any required notice and require the successor to respect applicable privacy obligations. We do not sell personal information as a standalone asset.

4. Retention

We keep account and study data while needed to provide the Service. Hamstr's generation process does not retain original PDFs or extracted text after the request finishes; generated cards and stored figures are separate records. Provider processing and temporary caching are described in Section 3.

Deleting a deck does not currently delete its stored figure images. Those images may remain while your account is active. Email us to request removal of those images or deletion of your account.

We keep the scrambled phone number while your account exists, so a number can only unlock one free account. We keep usage, billing, support, terms-acceptance, and security records only as long as reasonably needed for their stated purposes or required by law. This can include accounting obligations, resolving disputes, and legally required copyright records. Where PIPA requires it, information used to make a decision directly affecting you is kept for at least one year so you can seek access.

Request account deletion at officialbreezeadmin@gmail.com. We verify requests proportionately, process them without unnecessary delay, and explain any information we must retain and why. We delete or anonymize information when it is no longer needed for legal or business purposes. We do not promise complete erasure from every provider or backup within a fixed number of days. Any retained copies remain protected and are not available for ordinary account use. Deletion from our systems does not erase your device data or exports; you control those copies. Subscription cancellation and refunds follow Section 7 of the Terms.

5. Your choices and rights

You can view and edit your study data, delete decks, export cards using the Service's export features, and cancel your subscription. You can also email officialbreezeadmin@gmail.com to request access to or correction of personal information, ask for an export or deletion, withdraw consent, or make a privacy complaint.

We may need reasonable information to verify your identity. We respond within the time required by applicable law and explain any lawful extension or refusal and how to challenge it. Access and correction rights have legal exceptions; deletion and export requests are handled subject to applicable law and the retention rules above. You may withdraw consent, subject to legal or contractual restrictions and reasonable notice. We explain the consequences, including if we can no longer provide a feature or your account.

If we cannot resolve your concern, you may complain to the Office of the Information and Privacy Commissioner for British Columbia or the Office of the Privacy Commissioner of Canada, depending on which law applies. Residents of other provinces or U.S. states may have additional rights where their laws apply. Contact us to exercise them; we honour applicable rights and do not penalize you for doing so.

6. Security

We use industry-standard safeguards, including encrypted connections (HTTPS), access controls, and signed, time-limited links for stored images. We choose safeguards appropriate to the sensitivity of the information. No system is perfectly secure, so we can't guarantee absolute security. We assess privacy incidents, take steps to contain and address them, and keep records and notify affected people and regulators when required by applicable law.

7. Children

The Service is not intended for anyone under 16, as also stated in the Terms. Users below the age of majority must have a parent or guardian's permission and supervision. We seek consent from a parent or guardian where the law requires it and use age-appropriate explanations where needed for meaningful consent. A statement in these policies does not replace required consent procedures.

If you believe someone below the minimum age has provided personal information, contact us. We investigate, restrict the account where appropriate, and delete information collected without required consent unless retention is legally required.

8. International users

Hamstr is operated from British Columbia, Canada. Our providers may process and store information outside your province and outside Canada, including in the United States. Location depends on the provider and the service configuration; we do not promise Canadian-only storage. Information processed abroad may be accessible to foreign courts, law enforcement, or other authorities under local law.

We use contracts and other safeguards to protect information transferred to providers and remain accountable as required by applicable Canadian law. We carry out assessments and obtain consent where required by applicable law before a transfer. Contact our privacy officer for information about our cross-border processing practices.

9. Changes

We may update this policy. For material changes, we give notice in the app or by email before they take effect. If a change requires new consent, we obtain that consent before using or disclosing information in the new way. Merely posting an updated policy or your continued use does not replace consent where the law requires it.

10. Contact

Hamstr's privacy officer is responsible for Hamstr's privacy practices and can be reached at:

Privacy Officer, Hamstr · officialbreezeadmin@gmail.com