StepSolveStepSolve – Privacy Policy
Effective: 15 November 2026
This policy covers the Chrome extension StepSolve – Homework Helper, the StepSolve web app for phones, and the StepSolve server behind them (together "StepSolve"). It explains what personal data we process, why, for how long, who else receives it and what rights you have under the EU General Data Protection Regulation (GDPR).
1. Who is responsible
The controller of your personal data is Ludmila Kopyn, Czech Republic ("we", "us"). Contact for all privacy questions and requests: kopyndaniel@gmail.com.
2. In short
- We use your data only to give you answers, run your account and stop abuse.
- We don't store the homework, pages or photos you send. They go to our AI provider to create your answer and are then discarded by our server.
- Payments happen on Gumroad. We never see your card or bank details.
- No ads, no trackers, no analytics, no cookies, no selling of data.
- You can delete your account yourself at any time in the Account tab.
3. What we process, why, and on what legal basis
| Data | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|
| Email address and password (stored only as a salted one-way hash) | Creating your account, logging in, confirming your email, password reset | Contract (1)(b) |
| Homework content: page text and a screenshot of the visible part of the current tab (extension), photos (web app), text you select or type, follow-up questions | Creating your answers and explanations | Contract (1)(b) |
| Subscription data: the Gumroad license key you link, your plan, its status and end date | Checking your plan and unlocking paid features | Contract (1)(b) |
| Usage counts: number of requests per day | Free-try and fair-use limits | Contract (1)(b) and legitimate interest (1)(f) |
| Device ID: a random code created by the extension or app (not taken from your hardware) and a hashed IP address from sign-up | Stopping one person from creating many free accounts | Legitimate interest (1)(f): preventing abuse |
| Technical logs: IP address, time and type of request, error messages | Keeping the service secure and working, rate limits against password guessing | Legitimate interest (1)(f): security |
Homework content is read only when you ask: the Scan button, the Snip tool, the right-click menu, a keyboard shortcut, taking or choosing a photo, or automatic scanning if you switched it on in Settings. StepSolve doesn't read your browsing history, other tabs, keystrokes or location, and doesn't track you across websites.
Pages you scan may contain other people's names or data (for example a class list). Please scan only what you need for your homework.
We don't make decisions about you based solely on automated processing that have legal or similarly significant effects. AI answers can be wrong, so please check them.
4. Who receives data
- Anthropic PBC (USA), our AI provider, receives the homework content needed to create your answer. Under its commercial terms, it doesn't use this data to train its models, and it keeps it only for a limited period for safety and abuse monitoring.
- Gumroad, Inc. (USA) sells the subscription and processes payments on its own checkout page under its own privacy policy. We send Gumroad your license key to check that it is valid.
- Brevo (Sendinblue SAS) (France, EU) delivers our account emails (email confirmation, password reset).
- Render Services, Inc. (USA) hosts our server and database.
Anthropic, Brevo and Render process data on our behalf as processors. Some of them are outside the EU. Transfers to the USA rely on the EU–US Data Privacy Framework where the recipient is certified, and otherwise on the European Commission's Standard Contractual Clauses. We don't sell or rent your data or share it for advertising. The use of information received from Chrome extension APIs complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.
5. How long we keep it
- Homework content: not stored on our server. It is only held in memory while your answer is created.
- Account data and linked license key: until you delete your account.
- Accounts whose email is never confirmed: deleted automatically after 7 days.
- Daily usage counts: up to 12 months.
- Device ID of a deleted account that used free tries: 12 months, only to stop free tries being claimed again by deleting and re-creating accounts.
- Login-attempt records: up to 1 day. Email-confirmation links: 48 hours. Password-reset links: 1 hour.
- Technical logs at our hosting provider: kept for a short time under its log retention.
- Payment records are kept by Gumroad as tax and accounting laws require.
6. Data stored on your device
The extension and the web app store your login token, your settings, a random device ID and your recent results in your browser's local storage. The web app doesn't keep your photos. If you choose to use your own AI key in the extension's settings, that key is stored only in your browser and sent directly to the AI provider you picked, not to us. You can clear the history in the app, log out, or remove everything by uninstalling the extension or clearing the site's data. We don't use cookies.
7. Your rights
Under the GDPR you have the right to:
- access your data and get a copy of it,
- have it corrected,
- have it erased: tap Account → Delete account, or email us,
- restrict processing,
- get your data in a portable format (portability),
- object to processing based on legitimate interest.
Write to kopyndaniel@gmail.com. We reply within one month. You can cancel a subscription at any time through Gumroad, using the link in your receipt email or your Gumroad library. You also have the right to complain to a data protection authority. In the Czech Republic, that is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.gov.cz).
8. Children
StepSolve is made for students. In the Czech Republic, children under 15 need a parent's or guardian's consent to use online services like this one (other countries set their own age, between 13 and 16). If you're below that age, ask a parent or guardian before creating an account. A parent or guardian should make any purchase. If you believe a child has given us data without the consent the law requires, contact us and we'll delete it.
9. Security
All connections use HTTPS. Passwords are hashed with scrypt, login tokens are signed and stop working when you change your password, and repeated wrong logins are rate-limited. The AI key is kept on our server and can only be used for StepSolve's own homework prompts. If a breach affects your data in a way that risks your rights, we'll notify you and the authority as the law requires.
10. Changes
If we change this policy, we'll post the new version here with a new effective date. If the changes are important, we'll also tell you in the app or by email.