Privacy Policy

1. Introduction

Distilo ("we", "us", "our") operates the Distilo platform at distilo.co. This Privacy Policy explains how we collect, use, and protect your information when you use our service.

By using Distilo, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the service.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Email address and display name
• Authentication data (managed by Firebase Authentication)
• Subscription and billing information (managed by Stripe)

2.2 Study Data

When you use our service, we collect and process:

• Course materials you upload (PDF, DOCX, PPTX) for AI-powered distillation
• AI-generated content: summaries, flashcards, quizzes, and review sheets
• Study progress: quiz scores, flashcard review history, and memory strength data

2.3 Usage Data

We automatically collect technical information including:

• IP address, browser type, and operating system
• Pages visited and features used
• Device information

2.4 How You Found Us

On your first visit, your browser stores where you came from: the campaign tags in the link you clicked ("utm" parameters), the website that sent you (referrer), the first page you opened, the app you opened the link from (for example TikTok or Instagram), and the date. If you create an account, this information is saved with your account. We use it only to know which of our posts and ads bring new students.

3. How We Use Your Information

• Provide and improve the Distilo service
• Generate AI-powered study materials from your uploaded courses
• Track your learning progress and optimize spaced repetition scheduling
• Process payments and manage subscriptions
• Send important service updates and support communications
• Detect and prevent abuse or security issues
• Measure which of our posts and ads lead people to sign up (see section 9)

4. Third-Party Service Providers

We use the following third-party services to operate Distilo. Each processes data according to their own privacy policies:

We do not sell your personal information for money. We share data only with the providers listed above. Most of them help us operate the service. Meta and TikTok are different: the pixels share which pages you view and what you do on Distilo with them for advertising. Under California law this counts as "sharing" personal information, and you can opt out at any time (see section 10). The pixels are never used for visitors in Europe (see section 9).

5. AI Processing & Your Content

When you upload course materials, the text content is sent to AI providers (currently Anthropic Claude and OpenAI) to generate summaries, flashcards, quizzes, and other study materials. Important details:

• We use API access with data processing agreements — your content is not used to train AI models
• Only the text content of your documents is sent; metadata and personal info are stripped
• Generated content is stored on our servers and associated with your account
• You can delete your courses and all associated AI-generated content at any time

6. Data Storage & Security

Your data is hosted on Google Cloud infrastructure with industry-standard protections:

• Encryption in transit (TLS) and at rest
• Access controls and authentication mechanisms
• Regular security updates and monitoring

No system is 100% secure. While we implement reasonable measures to protect your data, we cannot guarantee absolute security.

7. Your Rights

You have the right to:

• Access your personal data by viewing your account and study data within the app
• Correct inaccurate information through your account settings
• Delete your account and all associated data through your account settings or by contacting us
• Export your data — contact us to request a copy of your data

If you are located in the European Economic Area (EEA), you may have additional rights under GDPR, including the right to restrict processing and to object to certain uses of your data. Contact us to exercise these rights.

8. Data Retention

We retain your data for as long as your account is active. When you delete your account:

• Your personal information is deleted within 30 days
• Your uploaded courses, generated content, and study history are permanently removed
• Some data may be retained longer if required by law (e.g., billing records)

9. Cookies & Ad Measurement

Distilo uses essential browser storage required for the service to function (authentication and session management), and stores how you found us (section 2.4) in your browser.

We also use the Meta Pixel and the TikTok Pixel. These are small scripts from Meta and TikTok that load on our pages and tell them:

• that a page of Distilo was viewed, and which one
• that an account was created (sent once, when you sign up)
• that a course was uploaded

Meta and TikTok receive this together with your IP address, browser and device information, and their own cookies. If you have an account with them, they can link these events to it. We use the results to see how many sign-ups each ad brings and to show our ads to people likely to find Distilo useful. We do not send your name, your email address, or your course content to Meta or TikTok.

The pixels are not loaded on pages whose address contains a private link (account deletion, payment links) or on internal admin pages.

Visitors in Europe: the pixels are not used at all for visitors in the European Union, the European Economic Area (Iceland, Liechtenstein, Norway), the United Kingdom and Switzerland, including EU regions outside mainland Europe (such as the Canary Islands, Madeira, the Azores, Guadeloupe, Martinique, French Guiana, Réunion and Mayotte). We tell where you are from your device's time zone setting, which stays in your browser. If the time zone is missing or unclear, the pixels are not loaded.

The pixels are also not loaded if your browser sends a Global Privacy Control signal, or if you opted out in section 10.

You can block these pixels with your browser's tracking protection or an ad blocker; Distilo keeps working normally. You can also manage how Meta and TikTok use this information in your ad settings on those platforms.

Session recordings (Microsoft Clarity)

We use Microsoft Clarity to see how visitors use our pages, so we can fix what is confusing. Clarity records clicks, scrolls, mouse movements and the pages you view, and builds heatmaps from them. Text you type into forms is never recorded. Once you are signed in, the text and images of the app (your courses, flashcards, quizzes, review sheets, your name and your email) are masked in your browser before anything is sent: we only see the layout and where you click. We do not send your identity to Clarity, and we tell Clarity not to use advertising cookies. Learn more in Microsoft's privacy statement.

Clarity follows the same rules as the pixels: it is never used for visitors in Europe (same list and same time zone check as above), nor on pages whose address contains a private link, nor if your browser sends a Global Privacy Control signal or you opted out in section 10.

11. Age Requirements

Distilo is designed for students aged 16 and older. If you are between 16 and 18, you confirm that you have parental or guardian consent to use the service. We do not knowingly collect data from children under 16. If you believe a child under 16 has created an account, please contact us so we can remove it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice within the app or sending an email. Continued use of the service after changes constitutes acceptance of the updated policy.

13. Contact

For any questions about this Privacy Policy or to exercise your data rights:

Email: support@distilo.co