Last revised on 7 September 2026
This Privacy Policy describes how beepy (“beepy”, “we”, “us”, “our”) collects, uses and discloses information about you for the beepy website (the “Website”), the beepy study assistant you talk to by text message and the pages you sign in to, such as your memory, cards and quiz pages (the “App”), and any services, content, tools, features and functionality offered on or through the Website and the App (collectively, the “Services”). For the purposes of this Privacy Policy, “you” and “your” means you as the user of the Services. beepy is operated from British Columbia, Canada.
beepy is a study assistant that lives in your texts. It knows your classes, your tests, and what is due when, and it beeps you before anything is late. It connects to the tools your school already uses, including Canvas, Google Calendar, Gmail, and Microsoft Teams, so due dates land in your memory without you typing them. Send it a photo of the board and it writes you a practice quiz. Tell it what you keep forgetting and it turns that into flashcards, then brings them back right when you are about to forget. Ask about a reading and it finds the sources. There is no app to learn: you text it, and it texts back.
Please read this Privacy Policy carefully. By using any of the Services, you agree to the collection, use, and disclosure of your information as described in this Privacy Policy. If you do not understand or agree to this Privacy Policy, please do not use or access the Services. This Privacy Policy sits alongside the Terms of Service, which govern your use of beepy.
Changes to this privacy policy
We may modify this Privacy Policy from time to time, in which case we will update the “Last revised” date at the top of this Privacy Policy. If we make material changes to how we use or disclose information we collect, we will use reasonable efforts to notify you, ordinarily by text message to the number on your account, since that is where you already are, and will take additional steps as required by applicable law. If you do not agree to any updates to this Privacy Policy, please do not continue using or accessing the Services.
Collection and use of information
When you use or access the Services, we collect certain categories of information about you from a variety of sources. Some of it you provide directly when you text beepy or connect an account, some is collected through your use of the Services, some is collected automatically, and some reaches us from third-party services you choose to connect.
In addition to the specific uses described below, we use the information we collect to provide, maintain, and improve the Services, including to understand your requests, remember what you have told beepy, generate replies, practice questions, and reminders based on the context of your conversation, take the actions you ask for in services you have connected, and improve features across the Services. We also use this information to communicate with you, measure and analyse performance, enhance the safety and security of the Services, comply with applicable legal obligations, and protect our rights and the rights of other individuals.
We do not sell your information or disclose your information to registered data brokers or third parties who resell your information to others. We do not use your information for advertising of any kind, and we do not use it to train AI models.
Information you directly provide us
Some features of the Services require you to directly provide us with certain information about yourself. You may elect not to provide this information, but doing so may prevent you from using or accessing those features. Information that you directly submit through the Services includes:
- Contact details, such as your mobile number and the name you give beepy. Your number is your account: there is no password, and signing in is a code we text you or a link we send you. We use this information to create and maintain your account, provide the Services, and communicate with you about them. We do not use it for marketing.
- Account preferences, such as your time zone, your quiet hours, how many questions a practice quiz should have, whether test-day reminders are on, and the conversation privacy setting described below.
- Family information, on parent accounts only: whether your account is a student’s or a parent’s, and the first names you give beepy for the kids whose schooling you keep track of. Their classes and dates are held entirely within your own account. A kid tracked this way does not get an account, and if they happen to have their own beepy account the two are completely separate: nothing connects them, and neither can see the other’s information.
- Any other information you choose to include in communications with us, for example when you text beepy about a class, send it a photo of your notes, or email us. We use this information to provide the Services and to respond to you.
Your first text to beepy is also the record of your consent to receive messages. We keep the time of it, together with the time you replied STOP if you ever have.
Information collected through your use of the Services
The Services include the beepy assistant, which acts on your behalf when you engage it. It remembers what you tell it, plans and sends reminders, writes to a calendar you connect, and reads school material you point it at.
To do this, and depending on the permissions you grant, the assistant keeps the following:
- Conversation content, being every message between you and beepy, inbound and outbound, with the time it was sent and the line it was sent over, together with a rolling summary of older messages produced by a model so that beepy still has the substance of a conversation weeks later.
- Study information, being what beepy remembers in order to be useful: your classes, including nicknames you use for them and ones you have dropped; tests, quizzes, assignments and projects, with their dates and titles; facts you tell it that are worth keeping, such as that practice runs until eight; and reminders waiting to be sent, including the text of the message.
- Practice data, being the question sets, flashcard decks, and source maps generated for you, the subject and the model that produced them, every answer you give and every card you review, including which option you picked, whether it was correct, the difficulty, and when you answered. Answers are scored on our server against the stored question set rather than against what your browser reports, which is why the set is retained.
- Safety signals. If a message indicates that someone may be in danger, beepy provides a crisis line and records a single timestamp, with no content, no category, and no note, so that it does not send a routine reminder shortly afterwards. That timestamp ceases to have any effect after twelve hours. The operator is told that the event occurred, with your account identifier and none of your words. beepy does not monitor you, does not escalate automatically, and will not contact a parent, a school, or an emergency service on your behalf.
Some of what you give the assistant is sensitive, and two categories are handled by not keeping them. A slide, a screenshot, or a photograph of the board is passed to the model that reads it and is not written to our database; what is retained is the questions or cards it produced. When beepy reads a document your teacher posted on a connected service, it summarises it for that one answer and discards the summary. We do not retain a copy of your school’s material.
Your conversation privacy setting. During sign-up you choose what happens to your messages and their rolling summary, and you can change your choice at any time from settings on your dashboard. If you select help make beepy better, our team may read your conversation in order to improve the product. If you select just between you and beepy, both are encrypted before they are stored, using a key held outside the database, so that no one reading the database, its backups, or our own administrative tools can read your words, and they are never used for analytics or product development. Three limits apply in either mode, and are stated here so the choice is not oversold. beepy itself reads your messages, because that is how it answers you. Our AI provider processes each exchange. Your mobile carrier and our messaging provider handle every message in transit. What beepy remembers as structured records, meaning classes, dates, facts and reminders, remains readable in both modes, because reminders and practice questions are generated from it, and all of it is visible and deletable on the memory page.
We do not use information collected through your use of the Services to evaluate, fine-tune, or train AI models, in either mode. The AI provider that powers beepy is engaged through an interface that is not used to train that provider’s models. The decisions beepy makes, meaning what to reply, what to remember, when to send a reminder, and what practice questions to generate, do not produce legal effects concerning you or similarly significant effects, and beepy does not evaluate you for eligibility for anything.
Please note that beepy is not a teacher, a tutor, or a professional advisor. Practice scores and any estimated grade are generated by a model from your own answers, can be wrong, and are not shared with your school. You should not rely on the Services for actions requiring medical, legal, or other professional advice or judgment.
Information collected from Google Workspace
If you choose to link your Google account to the Services, we receive access to the Google products you grant, permission by permission. There are three permissions and they are granted separately: connecting your calendar does not enable the other two, and beepy requests the narrowest permission that supports each feature. We use information collected from Google to provide the Services, including so that the assistant can act on your behalf in your calendar, and to personalise your use of the Services. This section states what each permission accesses, what we retain, and what beepy does not do with it.
Google Calendar
- What it accesses. Events on the calendars in your Google account. Events you have declined, or marked as free, are ignored.
- What we retain. The next seven days of events, comprising the title, start, end, and whether you are busy or tentative, so that beepy knows when you are unavailable and can plan around you. This is refreshed from Google on each check and deleted when you disconnect.
- What it writes. The tests, due dates, and study blocks beepy is tracking, added to the calendar you already use. Every event beepy creates is tagged as its own, and beepy only ever edits or deletes events carrying that tag. Events you created are never modified.
- What it does not do. It does not add guests, does not set Google notifications on anything it creates, and does not email anyone. If you delete something beepy added, it is not recreated.
Gmail
- What it accesses. Nothing unless you enable it. Once enabled, your Gmail, on a read-only basis, searched for recent school mail about assignments and tests.
- What we retain. Nothing from the message itself: no body, no subject line, and no sender. What is retained is the date beepy extracted, being a title, a class, and a due date, in the same form as any other entry on your memory page, together with the message identifier so that the same email is not read twice.
- What it does not do. It does not send, reply to, label, archive, or delete mail, and it cannot. The permission is read-only.
Google Drive
- What it accesses. Nothing unless you enable it. Once enabled, only files beepy itself created. This permission cannot see anything else in your Drive, and that limit is enforced by Google rather than by us.
- What we retain. Nothing. The document is written into a folder named “beepy” in your own Drive and belongs to you.
beepy’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use information received from Google Workspace APIs to evaluate, fine-tune, train, or improve AI models, or for serving ads, including retargeting, personalised or interest-based advertising. To the extent that third parties process information collected from Google on our behalf, including our AI model provider, we only permit them to process this information on our behalf and to help us provide the Services, and for certain legally permissible purposes such as maintaining security and complying with law. In particular, we do not disclose raw or derived Google user data to third-party AI services, including third-party AI model providers, for model training or secondary purposes.
Humans do not read it. No one on our team reads your Google data in the ordinary course. A person may access it only where necessary for security purposes, to resolve a problem you have reported to us, or where required by law. The tokens Google issues are stored encrypted at rest with AES-256-GCM, bound to the record they are stored in, using a key held outside the database.
At any time, you may revoke our access to your Google account and request deletion of information collected from it. Select Disconnect on the Google page: this removes beepy’s events from your calendar, deletes the stored tokens and the retained week of events immediately, and returns the permission to Google. Your own events are not affected. You may also revoke access at any time from your Google account at myaccount.google.com, under Data & privacy. Dates beepy extracted from school email remain on your memory page until you delete them there, or delete your account.
Information we collect automatically about your interaction with the Services
We also automatically collect certain information about your interaction with the Services (“Usage Data”). We use Usage Data to keep the Services running, diagnose failures, prevent abuse, and decide what beepy should bring up next.
- Log data, network and device information. Our hosting and database providers log requests as any web service does, including IP address, approximate time, and what was requested. We may review this information for safety and security purposes, including when you report a bug.
- Message delivery information. Our messaging provider records delivery information for each message, including an identifier, a delivery status, and the line it went over.
- Usage information, being which features you use and when: when a quiz was opened, a texted link was tapped, or a card was reviewed.
We do not collect clickstream information, keystrokes, or cursor positions. We do not collect your location, your contacts, your other messages, or anything else from your device beyond the messages you send us.
Information collected from other sources
We may obtain information about you from outside sources, in particular when you choose to provide the Services with access to third-party applications. We receive only what that service’s own interface requires in order to answer us, using the access you granted.
- Canvas. We store your school’s Canvas address, the access token you created, encrypted, the last few characters of that token so you can identify it, the name on the Canvas account, and the time of the last synchronisation. Your courses become classes and your due dates become events.
- Microsoft Teams. We store the tokens Microsoft issues, encrypted, your account identifier, sign-in address and display name, and the permissions granted. The connection is read-only: beepy reads the names of the teams you are in and, when you ask about one, the files your teachers posted there. It cannot post, edit or delete anything, and it cannot read your chats, messages or announcements. Files are read at the moment you ask and are not copied into our systems; what is kept is the note beepy writes about a file for your conversation.
- Google. When you connect, we receive your Google account identifier and email address, together with the permissions you actually granted and the information described under Information collected from Google Workspace above.
You may revoke access at any time from the Canvas, Google, and Teams pages. Disconnecting deletes the stored credential immediately. Please note that disconnecting a third-party integration does not automatically delete information already collected from it: classes and dates that have already synchronised remain on your memory page, where you can delete them yourself.
Any information we receive from outside sources will be treated in accordance with this Privacy Policy. We are not responsible for the accuracy of the information provided to us by third parties and are not responsible for any third party’s policies or practices. For more information, see the section below, Third-party websites and links.
Deidentified information
We may deidentify or aggregate information such that it cannot reasonably be used to infer information about you or otherwise be linked to you (“deidentified information”), for example a count of how many practice sets were finished in a week, and we may use deidentified information for any purpose. To the extent we possess or process any deidentified information, we will maintain and use such information in deidentified form and not attempt to re-identify the information, except for the purpose of determining whether our deidentification process satisfies legal requirements.
Disclosure of your information
We may disclose your information to third parties subject to this Privacy Policy, including the following categories of third parties:
- Vendors and other service providers who help us provide the Services, including hosting, database, messaging, and security providers. They act on our instructions and for no purpose of their own.
- Our AI model provider, which processes each exchange in order to generate beepy’s replies, practice questions, and source searches. It is engaged through an interface that is not used to train its models.
- Third parties with whom the Services interact on your behalf, including autonomously, for example when beepy adds a test date to your Google Calendar or reads a due date from Canvas.
- Third parties to whom you request or direct us to disclose information, such as by connecting a third-party integration or sign-in.
- Third parties in connection with or in anticipation of a business transaction such as a merger or acquisition. You would be told before anything moved, and this Privacy Policy would continue to apply to information collected under it.
- Professional advisors, such as auditors, law firms, or accounting firms.
We may also disclose your information for legal and security reasons and to protect the Services and our business, including to cooperate with law enforcement and regulatory inquiries, to detect and prevent fraudulent or illegal activity, to exercise or defend legal claims, to protect the health and safety of any person, and to ensure the safety and security of our business.
We do not disclose your information to advertising networks, to data brokers, or to business partners for their own purposes, and we do not sell or trade it. We will not provide information collected from Google to any third party for its own purposes.
The service providers described above operate in the United States and elsewhere, so your information is stored and processed outside Canada, where it may be accessible to courts, law enforcement, and national security authorities under the laws of those countries. We use providers that commit contractually to protecting it, but this is a real difference and you should be aware of it before you sign up.
Third-party websites and links
The Services link to and connect with websites and platforms we do not control, including Canvas, Google, Microsoft, and any page beepy sends you a link to. If you follow links to sites or platforms that we do not control and are not affiliated with us, you should review the applicable privacy policy, policies and other terms. We are not responsible for the privacy or security of, or information found on, these sites or platforms. Our inclusion of such links does not, by itself, imply any endorsement of the content on such platforms or of their owners or operators.
Children’s privacy
beepy is intended for students aged 13 and older, and we do not seek or knowingly collect any personal information from children under 13. If we become aware that we have unknowingly collected information about a child under 13, we will delete it and everything attached to the account. If you are the parent or guardian of a child under 13 who has provided us with their personal information, you may contact us using the information below to request that it be deleted.
Data security
We take reasonable measures to protect your information:
- All traffic travels over encrypted connections, and the database enforces row-level security, so one account’s records are unreachable from another account’s session.
- Canvas, Google, and Microsoft credentials are encrypted with AES-256-GCM and bound to the record they are stored in, so a copy of the database without the key is of no use, and a ciphertext moved to another record will not decrypt.
- The keys that bypass those protections exist only on the server and are never sent to a browser.
- Inbound webhooks are signature-checked, so no one else can send you messages as beepy.
Despite these measures, no security measures are impenetrable, and we cannot guarantee “perfect security.” If a breach affects you, we will notify you and the relevant regulator as the law requires.
Assistant features such as beepy may present additional privacy and security considerations because they can perform tasks or take actions independently on your behalf, based on the permissions you grant. beepy sends you reminders, adds and removes its own events on a calendar you connect, and reads documents and email you point it at. As with any technology that acts on your behalf, there are inherent considerations to be aware of, including the possibility of unintended actions, incorrect or incomplete outputs, and material from third parties that includes misleading instructions intended to influence assistants. beepy’s tools are bound to your single account when they are constructed, so no message or document can induce it to read another account’s information, and it only ever edits or deletes calendar events it created itself. We encourage you to review actions taken by beepy and to remain attentive while using the Services.
Moreover, text messages are not private in the way an end-to-end encrypted conversation is. Your carrier, the platform carrying the message, and our messaging provider each handle it in transit, and it remains in your device’s own message history, where anyone holding your device can read it. Because signing in is a message to or from your number, anyone with your device can also sign in as you. We recommend that you do not use unsecure channels to send us sensitive or confidential information.
Your choices and rights
- Messages. Reply STOP to any beepy message to end the messages. We keep the record that you did, because it is what prevents us from messaging you again. Quiet hours and test-day reminders can be changed from your settings.
- Your information. The memory page shows and deletes classes, facts, and dates individually. Delete my account, at the bottom of the same page, deletes the whole account on the spot, together with everything attached to it: messages, memory, practice history, connections, and your number. If Google Calendar is connected, beepy’s events come off your calendar on the way out. If you would rather ask a person, or you no longer have the account to sign in with, emailing brandon@graderaise.com from, or naming, your number will perform the same deletion within 30 days, and we will confirm when it is done.
- Retention. Until you delete it, we keep your account, memory, messages, and practice history for as long as the account exists, because the Services depend on remembering across a school year. Connected-account credentials are kept until you disconnect or the credential stops working. Technical logs are kept for a short period by our providers under their own retention settings. Backups take longer to age out than live data, and we may retain the minimum necessary to demonstrate that we complied with a request or to meet a legal obligation.
- Access, correction, and withdrawal of consent. Under the Personal Information Protection and Electronic Documents Act, and the Personal Information Protection Act in British Columbia, Canada, you may request access to the personal information we hold about you, request that it be corrected, and withdraw your consent, by writing to brandon@graderaise.com. We must be satisfied that you are the account holder, which ordinarily means a message from the number on the account. Withdrawing consent has a consequence worth stating plainly: an assistant that cannot retain your classes cannot remind you about them. If you are dissatisfied with how we handled a request, you may complain to the Office of the Privacy Commissioner of Canada, or to the Office of the Information and Privacy Commissioner for British Columbia.
How to contact us
Should you have any questions about our privacy practices or this Privacy Policy, or wish to make an access, correction, or deletion request, please email us at brandon@graderaise.com. It is read by a person.