Your notes stay yours

BrevRev answers questions from the study materials you upload. To do that we store your files and your conversations, send the relevant parts to an AI model when you ask something, and keep a record of how much you use. We do not sell your data, we do not show ads, and we do not use your notes to train any model.

You can delete your account and everything in it from the profile menu inside the app. It leaves our live systems immediately and our backups within 30 days.

We process your data on the basis of your consent, given when you sign in and accept these terms, and for the purposes listed below only. You can withdraw that consent at any time by deleting your account; some features cannot work without the data they need.

BrevRev (“we”, “us”) runs the AI study tool at brevrev.com and is the data fiduciary for the personal data described here. For anything about this policy, including a grievance under the Digital Personal Data Protection Act, 2023, write to support@brevrev.com. We acknowledge within 7 days and resolve within 30.

Account. You sign in with Google. We store your name and email address from your Google account. Google also sends a profile picture link with every sign-in; we discard it immediately and never store or show it. We never see your Google password.

Your study materials. The PDFs, images, Word, PowerPoint and Excel files, audio recordings and YouTube links you add to a course, the text we extract from them, and the chapter outlines and search index we build from that text. For a YouTube link we fetch and store the video’s captions, not the video.

What you make with them. Your questions and the answers, Solve problems and their solutions, flashcard decks, quizzes and your answers to them, PYQ analyses, mock papers, summaries and notes. A photo you Solve is read once and not stored; only the transcribed problem is kept. A lecture you record is transcribed and only the transcript is kept; we do not store the audio.

Profile choices. The persona you picked at onboarding, your explanation language and interface language, per-course settings, and your age attestation (18 or over, or under 18 with a guardian’s consent) with the time you gave it.

Usage. For every AI call we log which feature ran, which model, how many tokens went in and out, and when. This is how the daily and session limits on each plan are counted, and how we watch our costs. These records never contain the text of a prompt or an answer.

Payments. When you buy a pass we store the order id, the payment id, the plan, the amount and the date. Card and UPI details are entered on Razorpay’s page and never reach our servers.

Referrals and ambassadors. Your referral code, who joined through it, and when a referral counted. If you apply to be a campus ambassador, your college, city and answers to the application questions.

Feedback. Anything you send through the feedback button, with the page it was sent from.

BrevRev uses Google Sign-In only to identify you. When you sign in, Google shares your name, your email address and a link to your profile picture with us. We store the name and email to create and identify your account and to send account and billing emails. We discard the profile picture link immediately; it is never stored or shown. We request no other Google data: no Gmail, Drive, Calendar, Contacts or YouTube account access.

We do not use data obtained through Google Sign-In for advertising, we do not sell it, we do not share it with anyone except the service providers listed below who need it to run the account (our database and sign-in provider, our payment processor at checkout, and our analytics provider as an internal id only), and no human reads it except to support you or where the law requires.

BrevRev’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke BrevRev’s access at any time from your Google account’s security settings, and deleting your BrevRev account removes the name and email we hold.

To run the product: answer your questions from your own files with page citations, generate decks, quizzes and mocks, transcribe recordings and photos, and remember your settings.

To enforce plan limits and bill correctly, to detect abuse, to fix bugs, and to understand which features are used so we can improve them.

We do not use your materials, questions or answers to train AI models, and under the API terms of our AI providers they do not use data sent through their APIs to train theirs.

When you ask a question, the most relevant passages from your files, your question and the recent turns of the conversation are sent to the AI model to produce an answer. A photo you Solve is sent to the model to be read. A scanned PDF or image is sent page by page to be transcribed. Your recordings are sent to a speech-to-text service.

Answers come from an AI model, not a teacher, and can be wrong. Every answer cites the page it came from so you can check it, especially before an exam.

We run on a small set of service providers. Each one receives only what it needs to do its job, under a contract that limits what it may do with it.

• Supabase — database, file storage and sign-in. Hosted in the Mumbai region (ap-south-1), so your files and data stay in India.
• Anthropic — the AI model that answers questions, writes decks, quizzes, mocks, notes and summaries, and reads photos and scanned pages.
• Voyage AI — turns the text of your files into search vectors so the right passages can be found for a question.
• Deepgram — speech to text for voice input and lecture recordings, and text to speech when you ask to hear an answer. OpenAI’s transcription service may be used as a fallback for recordings.
• Razorpay — payments. Handles your card or UPI details; we never see them.
• Google — sign-in, and Google Analytics for anonymous page-view counts on the public pages.
• PostHog — product analytics. See the next section.
• Upstash — rate limiting, which sees your user id and request counts but no content.
• Hostinger — hosts the application.

The AI, speech, search-vector and analytics providers process data in the United States, and the hosting provider in Europe. Your files and database stay in India. Transfers rely on those providers’ contractual commitments to protect the data, and we will stop using any provider that India restricts.

We use PostHog to understand how the product is used: which features run, where people get stuck, and what each feature costs us. Session replays are recorded with all text inputs and all student content masked: your file names, questions, answers and notes are blanked out before anything leaves your browser. For accounts that told us they are under 18, session replay is switched off entirely. Our AI usage records in PostHog contain model names, token counts and timings, never the text.

The public pages use Google Analytics for anonymous page-view counts, with the page path sanitised so no document or course name is sent.

Cookies and similar storage we use: a first-party referral cookie when you arrive through a classmate’s link, so that if you sign up and later buy a plan your classmate receives their credit; Google’s sign-in session; PostHog’s analytics identifier; Google Analytics cookies on the public pages; and local storage for conveniences like your theme, the sidebar state and the last chat style you chose. None of it is used for advertising, and we never share it with ad networks.

Your account and everything in it stay until you delete them. Your materials remain yours on the free plan after a paid pass ends; we never delete content because a pass expired. When you delete, your data leaves our live database and storage at once and expires from encrypted backups within 30 days. If we close your account for breaking the terms, the same deletion runs 30 days later.

Payment records are kept for as long as Indian tax and accounting law requires, even after an account is deleted.

Analytics data in PostHog and Google Analytics is kept according to those services’ retention settings. It is keyed to an internal id, not your name, and we delete the identifier from PostHog on request.

Delete your account from the profile menu in the app. This removes your account, courses, files, extracted text, conversations, decks, quizzes, solves, analyses, notes, usage records, referral links and profile in one step, and deletes your uploaded files from storage. It cannot be undone. Payment records are kept as tax law requires.

Delete a single file or course at any time from inside the app; its extracted text and search index go with it.

See or export your data, correct it, or ask us a question about it: write to support@brevrev.com. We answer within 30 days.

Shared links. A deck, analysis or note you share with a public link is visible to anyone who has the link until you turn sharing off. You are responsible for what you share, and we may disable a shared link that breaks the terms.

If you are in India, these rights follow the Digital Personal Data Protection Act, 2023, including the right to nominate someone to exercise them for you, and you may raise a grievance with the Data Protection Board of India if we do not resolve yours.

BrevRev is built for college students. When you first sign in we ask you to confirm either that you are 18 or older, or that you are under 18 and using BrevRev with the consent of a parent or guardian. We record that answer and the app does not open until it is given. A guardian may contact us at any time to see or delete a minor’s data.

We do not show advertising or build advertising profiles for anyone, we do not record session replays for accounts that told us they are under 18, and we do not knowingly collect data from children under 13. If you believe a child has created an account, tell us and we will delete it.

Every table is protected by row-level security so an account can only ever read its own rows. Files are stored under your user id and served only to you. Traffic is encrypted in transit, data is encrypted at rest by our database provider, and all state-changing requests are checked against the site origin. Payment webhooks are verified by signature.

If a breach affects your personal data we will tell you and the Data Protection Board of India as the law requires, without undue delay, with what happened and what we are doing about it.

No system is perfectly secure. If you find a weakness, please tell us before telling anyone else: write to support@brevrev.com.

When we change this policy we update the date at the top of this page. For a change that affects what we collect or who processes it, we will also tell you inside the app before it takes effect. See also our Terms of Service.