Privacy

What this page covers

Sci-AI is UC Merced's research-practice platform. This policy describes the personal data the platform collects about you — when you create an account, when you practice, and when you connect an external AI tool (Claude, ChatGPT, or a custom OpenAI GPT) — how that data is used, which service providers process it, and how you can inspect or delete it.

Account and identity data

When you register or sign in, we store what's needed to run your account:

• Username and display name.
• Email address. Student accounts require a UC Merced (@ucmerced.edu) email address; guest accounts are created without an email.
• Password. Stored only as a bcrypt hash — never in plain text. When you set a password we check it against the Have I Been Pwned breach database using a partial, one-way hash, so your actual password never leaves our server.
• Google sign-in details. If you use "Sign in with Google," we receive and store your Google account identifier, email, name (used as your display name), and your Google Workspace domain — the domain is how we confirm UC Merced membership.
• Account metadata. Your role (student, faculty, admin, or guest), when the account was created, and when you last signed in.

To confirm your email we send a one-time verification link (valid for 24 hours); we store only a hashed form of that link's token, not the link itself.

Practice and learning data

As you use the practice tools and prelab activities, we record your study activity:

• Your answers. The written answers you type, the multiple-choice options you pick, whether each was correct, and how the response was scored: Final (including a Guess promoted at 65% or higher) or Guess. We also record whether you pressed Guess, separately and regardless of how the answer then graded — so an answer promoted to Final is still shown as a guess, to you and to your instructor alike. We also record how long you took and difficulty ratings — kept as a per-class review log so your instructor can see your progress.
• Activity. Which lab documents and simulations you complete, and files you download.
• A learning profile derived from your prelab tutoring — topic mastery, a concept "mind map," personalization notes, learning-style notes, and topics you struggled with.
• Completed retrieval-session assessments. For a class-attributed session, we store a qualitative summary of strengths, growth areas, and next steps, grounded in the questions you answered. It is linked to that session and is deleted when the associated session or practice history is deleted.

AI processing of your practice

When you submit a written (free-response) practice answer, that answer — up to about 4,000 characters — is sent, together with the question and a reference answer, to Anthropic's Claude API, which grades it and returns personalized grading feedback. We store the resulting grade and feedback in your review log. We send only your answer and the question context — not your name, email, or a chat transcript.

When you finish a class-attributed retrieval session, Sci-AI also creates a whole-session assessment automatically. A factual version is produced on our server from the recorded grading. We then send bounded excerpts of the session's questions, your answers, reference answers, recorded outcomes, and feedback to Anthropic's Claude API so it can improve the wording of that assessment. Claude is instructed to summarize the recorded grading, not re-grade your work. We do not send your name, email, user ID, or class identity. If Claude is unavailable, the server-produced assessment remains in use.

An authorized instructor or administrator can also deliberately generate a briefing for one lesson from the strictly incorrect answers visible in their Retrieval progress view. For that request, Sci-AI sends Claude the students' display names and usernames, the applicable class, the exact question wording, and the submitted incorrect answers. The briefing may name individual students so staff can identify who needs a particular intervention. It is shown only to the requesting staff member and is not saved by Sci-AI.

Staff may separately generate a briefing from the lesson-specific topics recorded by the prelab tutor. That request contains the topic statements, their categories, and affected- student counts, but no student names, usernames, emails, or IDs. This briefing is also request-time only and is not saved by Sci-AI.

Separately, we may send the extracted text of public course Student Guides to Claude to determine the order in which lab-resource cards should appear. This lesson-flow analysis contains course material only: it does not include student answers, account details, activity, or other student data. The result is cached before students open the lab page.

What a connected AI tool writes to our database

Separately, when you authorize an external AI tool (Claude, ChatGPT, or a custom OpenAI GPT) to connect to Sci-AI, that tool can call a small set of write actions on your behalf. Each call creates a row in one of two tables:

• Session summaries — a 1–3 sentence summary the AI writes at the end of an educational conversation, plus the topics you discussed and an optional structured note (how long you worked, what you struggled with, what you mastered). Also includes which lab and class the session was about, if known.
• Concept signals — short observations the AI flags when it notices you're struggling with a specific topic (e.g. "confusion about the chain rule"). Used by your instructor's dashboard, not for personalization.
• Self-assessments — when you explicitly tell the AI how you feel about what you studied (e.g. "I'd rate my understanding 80 out of 100").

Each row is linked to your user account and to the specific AI app (OAuth grant) that wrote it, so you can revoke one app without affecting others.

Personal information is scrubbed before your notes are stored

Before anything written back by a connected AI tool is saved — a session summary, and also your mind map, personalization notes, learning style and struggles — the server runs a redactor that replaces likely personal information with placeholder markers. It runs on every route that can write those columns, so the four note sections that appear on your shareable profile link are covered no matter which one wrote them. Patterns currently scrubbed:

• Email addresses
• US-shaped phone numbers
• SSN-shaped numbers
• Long contiguous digit runs (likely credit-card numbers or IDs)
• Long random-looking character runs (likely API keys or tokens)

We do not keep a pre-scrub copy. There is also a hard size cap (~4 KB) on the summary text and (~16 KB) on the structured note; anything longer is truncated before storage. Note that the redactor is a best-effort defense, not a guarantee — if you type sensitive information to an AI tool in an unusual format, it may not be recognized. Don't paste secrets into AI chats.

What a connected AI tool does not store

• Full conversation transcripts. Only the summaries the AI explicitly writes back are stored. Whatever else you discussed with Claude or ChatGPT stays with them, governed by their own privacy policies.
• Raw OAuth tokens. Every access token and refresh token is hashed (SHA-256) before storage. We cannot recover the original token, only verify a presented one. Client secrets (for Custom GPT integrations) are stored as bcrypt hashes for the same reason.
• Third-party tracking. The AI integration does not inject analytics or third-party tracking pixels.

Cookies and sessions

We use only first-party, functional cookies. There are no analytics, advertising, or third-party tracking cookies, and no tracking pixels.

• sciai_session — keeps you signed in. It is HttpOnly, sent only over HTTPS, scoped SameSite=Lax, and expires after 30 days.
• google_nonce — a short-lived value used only to protect the "Sign in with Google" flow from cross-site request forgery.

IP addresses

We never store your raw IP address. To prevent abuse (rate-limiting sign-in attempts) and for the audit trail when you authorize an AI app, your IP is first put through a salted, one-way hash. When you authorize an AI app we also record the browser's user-agent string alongside that hashed IP, as part of the consent record.

Third parties who process your data

We rely on a small set of service providers to run the platform. Each receives only what it needs for its function:

• Anthropic (Claude). Grades your written practice answers, analyzes completed retrieval sessions from bounded question-and-answer excerpts without your identity, creates staff-requested lesson briefings from named incorrect answers and anonymized prelab-topic aggregates, analyzes public course-guide text to order lab cards without receiving student data, and — when you connect Claude — receives the lab and profile context it needs and writes summaries back.
• Neon. Hosts our database.
• Cloudflare R2. Stores uploaded lab files.
• Resend. Sends account emails, such as your verification link (receives your email address).
• Google. Verifies "Sign in with Google."
• Have I Been Pwned. Checks passwords against known breaches — receives only a partial hash, never your password or your identity.
• Vercel. Hosts and runs the site.

We do not sell your data or share it with advertisers. If you connect Claude or ChatGPT, the conversation itself happens on that service under its own privacy policy (see below).

How long we keep it

• Account and study data: kept while your account is active.
• Retrieval-session assessments: kept with their completed practice session and removed when that session, your practice history, or your account is deleted.
• AI-integration data (session summaries and concept signals): you can download or delete it at any time (see Your rights below). Summaries tied to a specific class are also removed automatically when you leave that class. Session summaries are additionally deleted by a scheduled daily job once they are 12 months old.
• Sign-in session: the session cookie expires after 30 days. The server-side record is deleted by the same daily job once it has expired.
• Email verification links: valid for 24 hours; the stored record is deleted by the daily job once it expires, and immediately once you use it.
• AI-app access: access tokens expire after about an hour and refresh tokens after 30 days; once expired they no longer work, and the daily job deletes the expired records.

Your rights (and how to use them today)

You can exercise all of the following at any time — email the Sci-AI maintainers (see Contact below) and we'll action it:

• See which AI apps are connected. Each connection shows its name, when you authorized it, when it last used the connection, and exactly which permissions you granted.
• Revoke a connection. We cut off that app's access. The very next call it tries to make returns 401 and it must re-authorize from scratch. Existing summaries that app already wrote are kept (under your control) — revocation stops future writes, it doesn't delete past ones.
• Download your AI-integration data. A JSON file with every session summary and concept signal across every AI app you've ever connected. This is the FERPA "right to inspect" for the AI-integration data.
• Delete your AI-integration data. Hard-deletes every summary and signal you own. OAuth grants are kept separately so you can revoke them in the same place; deleting data doesn't accidentally lock connected apps in a half-authorized state.
• Access or delete your account data. For your account, practice history, or to delete your account entirely, email the maintainers and we'll action it.

Who can see this data

• You. Via the download described above; also displayed in your own portal views.
• Your completed retrieval assessment is student-only. It is shown only on that session's completion screen; there is no instructor, administrator, or later history view for it.
• Your instructor. Your practice progress, concept signals, and session summaries written back by connected AI tools for classes you are enrolled in feed instructor dashboards intended to surface where students are struggling. Instructors see aggregate and per-student views for their own classes only.
• Sci-AI maintainers. For debugging and incident response. Access is limited to the small number of people responsible for keeping the platform running.

We do not sell this data, share it with advertisers, or pass it to any third party for marketing purposes.

What the external AI service stores

When you use Claude, ChatGPT, or a Custom GPT, that service has its own data-handling policies separate from Sci-AI. The Sci-AI integration only governs what is written back to Sci-AI's database. For what the AI service itself stores about your chat history, see Anthropic's or OpenAI's respective privacy policies.

FERPA

Information Sci-AI keeps about you as a student — including your practice records and the data AI tools you authorize write back — is part of your educational record under FERPA. On request to the Sci-AI maintainers (see Contact below), the download and delete of your data are intended to satisfy the FERPA inspection and amendment rights without requiring a formal request.

Contact

Questions, concerns, or requests about your data: email tle271@ucmerced.edu.