Privacy

What this page covers

Sci-AI is UC Merced's research-practice platform. This policy describes the personal data the platform collects about you — when you create an account, when you practice, and when you connect an external AI tool (Claude, ChatGPT, or a custom OpenAI GPT) — how that data is used, which service providers process it, and how you can inspect or delete it.

Account and identity data

When you register or sign in, we store what's needed to run your account:

• Username and display name.
• Email address. Student accounts require a UC Merced (@ucmerced.edu) email address; guest accounts are created without an email.
• Password. Stored only as a bcrypt hash — never in plain text. When you set a password we check it against the Have I Been Pwned breach database using a partial, one-way hash, so your actual password never leaves our server.
• Google sign-in details. If you use "Sign in with Google," we receive and store your Google account identifier, email, name (used as your display name), and your Google Workspace domain — the domain is how we confirm UC Merced membership.
• Account metadata. Your role (student, faculty, admin, or guest), when the account was created, and when you last signed in.

To confirm your email we send a one-time verification link (valid for 24 hours); we store only a hashed form of that link's token, not the link itself.

Practice and learning data

As you use the practice tools and prelab activities, we record your study activity:

• Your answers. The written answers you type, the multiple-choice options you pick, whether each was correct, and how the response was scored: Final (including a Guess promoted at 65% or higher) or Guess. We also record whether you pressed Guess, separately and regardless of how the answer then graded — so an answer promoted to Final is still shown as a guess, to you and to your instructor alike. We also record how long you took and difficulty ratings — kept as a per-class review log so your instructor can see your progress. Each written (short-answer or calculation) answer is kept with the question as it was shown to you, its reference answer, and the feedback you received, including any follow-up question and your reply; you can read these back on your Retrieval progress page.
• How each written answer was entered. For the written answers you give in a class's retrieval practice, and your replies to a follow-up question, the answer box records how many of the characters you submitted were pasted, dropped in, or inserted in one step (as AI writing tools and voice dictation do) rather than typed. We keep only that count: never what you pasted, where it came from, or your keystrokes.
• Activity. Which lab documents and simulations you complete, and files you download.
• Work you turn in. The files you turn in on an assignment, and the link if you turn in a Google Slides or Canva presentation. For a link we keep only the link, never a copy: the presentation stays on Google or Canva, under their sharing settings and privacy policy. Only you, your class's instructors and course administrators can see what you turn in.
• A learning profile derived from your prelab tutoring — topic mastery, a concept "mind map," personalization notes, learning-style notes, and topics you struggled with. When a connected AI tutor saves one of your prelabs, we also record when that prelab chat started and ended (when the tutor opened the prelab and when it saved it). While the prelab runs, the tutor also tells us each time you send a message (only that you sent one, never what you wrote). We use those moments to count the messages you and the tutor sent and to work out how long you were actively chatting, leaving out any gap longer than 10 minutes as a break, and we keep only the totals and the time of your latest message. Only course administrators see these figures.
• Completed retrieval-session assessments. For a class-attributed session, we store a qualitative summary of strengths, growth areas, and next steps, grounded in the questions you answered. It is linked to that session and is deleted when the associated session or practice history is deleted.

AI processing of your practice

When you submit a written (free-response) practice answer, that answer — up to about 4,000 characters — is sent, together with the question and a reference answer, to Anthropic's Claude API, which grades it and returns personalized grading feedback. We store the resulting grade and feedback in your review log. We send only your answer and the question context — not your name, email, or a chat transcript.

A few minutes after you submit a written answer in a class's retrieval practice, or a reply to a follow-up question, Sci-AI sends that text and the question it answered to Anthropic's Claude API a second time and asks for one label: whether it reads as AI-written, as written by you, or can't tell. Answers under 12 words are not sent; they are recorded as "can't tell". We do not send your name, email, user ID, or class. The label is an estimate, not a finding, and it never changes your score, points, or schedule.

When you finish a class-attributed retrieval session, Sci-AI also creates a whole-session assessment automatically. A factual version is produced on our server from the recorded grading. We then send bounded excerpts of the session's questions, your answers, reference answers, recorded outcomes, and feedback to Anthropic's Claude API so it can improve the wording of that assessment. Claude is instructed to summarize the recorded grading, not re-grade your work. We do not send your name, email, user ID, or class identity. If Claude is unavailable, the server-produced assessment remains in use.

An authorized instructor or administrator can also deliberately generate a briefing for one lesson from the strictly incorrect answers visible in their Retrieval progress view. For that request, Sci-AI sends Claude the students' display names and usernames, the applicable class, the exact question wording, and the submitted incorrect answers. The briefing may name individual students so staff can identify who needs a particular intervention. It is shown only to the requesting staff member and is not saved by Sci-AI.

Staff may separately generate a briefing from the lesson-specific topics recorded by the prelab tutor. That request contains the topic statements, their categories, and affected- student counts, but no student names, usernames, emails, or IDs. This briefing is also request-time only and is not saved by Sci-AI.

Separately, we may send the extracted text of public course Student Guides to Claude to determine the order in which lab-resource cards should appear. This lesson-flow analysis contains course material only: it does not include student answers, account details, activity, or other student data. The result is cached before students open the lab page.

What a connected AI tool writes to our database

Separately, when you authorize an external AI tool (Claude, ChatGPT, or a custom OpenAI GPT) to connect to Sci-AI, that tool can call a small set of write actions on your behalf. Each call creates a row in one of two tables:

• Session summaries — a 1–3 sentence summary the AI writes at the end of an educational conversation, plus the topics you discussed and an optional structured note (how long you worked, what you struggled with, what you mastered). Also includes which lab and class the session was about, if known.
• Concept signals — short observations the AI flags when it notices you're struggling with a specific topic (e.g. "confusion about the chain rule"). Used by your instructor's dashboard, not for personalization.
• Self-assessments — when you explicitly tell the AI how you feel about what you studied (e.g. "I'd rate my understanding 80 out of 100").

Each row is linked to your user account and to the specific AI app (OAuth grant) that wrote it, so you can revoke one app without affecting others.

Personal information is scrubbed before your notes are stored

Before anything written back by a connected AI tool is saved — a session summary, and also your mind map, personalization notes, learning style and struggles — the server runs a redactor that replaces likely personal information with placeholder markers. It runs on every route that can write those columns, so the four note sections that appear on your shareable profile link are covered no matter which one wrote them. Patterns currently scrubbed:

• Email addresses
• US-shaped phone numbers
• SSN-shaped numbers
• Long contiguous digit runs (likely credit-card numbers or IDs)
• Long random-looking character runs (likely API keys or tokens)

We do not keep a pre-scrub copy. There is also a hard size cap (~4 KB) on the summary text and (~16 KB) on the structured note; anything longer is truncated before storage. Note that the redactor is a best-effort defense, not a guarantee — if you type sensitive information to an AI tool in an unusual format, it may not be recognized. Don't paste secrets into AI chats.

What a connected AI tool does not store

• Full conversation transcripts. Only the summaries the AI explicitly writes back are stored. Whatever else you discussed with Claude or ChatGPT stays with them, governed by their own privacy policies.
• Raw OAuth tokens. Every access token and refresh token is hashed (SHA-256) before storage. We cannot recover the original token, only verify a presented one. Client secrets (for Custom GPT integrations) are stored as bcrypt hashes for the same reason.
• Third-party tracking. The AI integration does not inject analytics or third-party tracking pixels.

Cookies and sessions

We use only first-party, functional cookies. There are no analytics, advertising, or third-party tracking cookies, and no tracking pixels.

• sciai_session — keeps you signed in. It is HttpOnly, sent only over HTTPS, scoped SameSite=Lax, and expires after 30 days.
• google_nonce — a short-lived value used only to protect the "Sign in with Google" flow from cross-site request forgery.

IP addresses

We never store your raw IP address. To prevent abuse (rate-limiting sign-in attempts) and for the audit trail when you authorize an AI app, your IP is first put through a salted, one-way hash. When you authorize an AI app we also record the browser's user-agent string alongside that hashed IP, as part of the consent record.

Third parties who process your data

We rely on a small set of service providers to run the platform. Each receives only what it needs for its function:

• Anthropic (Claude). Grades your written practice answers, estimates whether each one reads as AI-written (receiving the answer and the question, without your identity), analyzes completed retrieval sessions from bounded question-and-answer excerpts without your identity, creates staff-requested lesson briefings from named incorrect answers and anonymized prelab-topic aggregates, analyzes public course-guide text to order lab cards without receiving student data, and — when you connect Claude — receives the lab and profile context it needs and writes summaries back.
• Neon. Hosts our database.
• Cloudflare R2. Stores uploaded lab files.
• Resend. Sends account emails, such as your verification link (receives your email address).
• Google. Verifies "Sign in with Google."
• Have I Been Pwned. Checks passwords against known breaches — receives only a partial hash, never your password or your identity.
• Vercel. Hosts and runs the site, including turning slide files into PDFs so they can be shown on the page.

We do not sell your data or share it with advertisers. If you connect Claude or ChatGPT, the conversation itself happens on that service under its own privacy policy (see below).

How long we keep it

• Account and study data: kept while your account is active.
• Retrieval-session assessments: kept with their completed practice session and removed when that session, your practice history, or your account is deleted.
• Paste counts and AI-writing labels: kept with the answer they describe and deleted with it, including when your practice history or your account is deleted.
• AI-integration data (session summaries and concept signals): you can download or delete it at any time (see Your rights below). Summaries tied to a specific class are also removed automatically when you leave that class. Session summaries are additionally deleted by a scheduled daily job once they are 12 months old.
• Sign-in session: the session cookie expires after 30 days. The server-side record is deleted by the same daily job once it has expired.
• Email verification links: valid for 24 hours; the stored record is deleted by the daily job once it expires, and immediately once you use it.
• AI-app access: access tokens expire after about an hour and refresh tokens after 30 days; once expired they no longer work, and the daily job deletes the expired records.

Your rights (and how to use them today)

You can exercise all of the following at any time — email the Sci-AI maintainers (see Contact below) and we'll action it:

• See which AI apps are connected. Each connection shows its name, when you authorized it, when it last used the connection, and exactly which permissions you granted.
• Revoke a connection. We cut off that app's access. The very next call it tries to make returns 401 and it must re-authorize from scratch. Existing summaries that app already wrote are kept (under your control) — revocation stops future writes, it doesn't delete past ones.
• Download your AI-integration data. A JSON file with every session summary and concept signal across every AI app you've ever connected. This is the FERPA "right to inspect" for the AI-integration data.
• Delete your AI-integration data. Hard-deletes every summary and signal you own. OAuth grants are kept separately so you can revoke them in the same place; deleting data doesn't accidentally lock connected apps in a half-authorized state.
• Access or delete your account data. For your account, practice history (including the paste counts and AI-writing labels on your written answers), or to delete your account entirely, email the maintainers and we'll action it.

Who can see this data

• You. Via the download described above; also displayed in your own portal views.
• Your completed retrieval assessment is student-only. It is shown only on that session's completion screen; there is no instructor, administrator, or later history view for it.
• Your instructor and course administrators. Your practice progress, concept signals, and session summaries written back by connected AI tools for classes you are enrolled in feed instructor dashboards intended to surface where students are struggling. Instructors see aggregate and per-student views for their own classes only. Those views include each written practice answer you give — the question as it was shown to you, your answer, whether it was correct, the reference answer, and the feedback, including any follow-up exchange — for practice done for a class you are still enrolled in. Course administrators have the same views for every active class. They also see, for each of those written answers and follow-up replies, how much of it was pasted rather than typed and Claude's estimate of whether it reads as AI-written, both per answer and as class, lab and student percentages. For each written answer the AI graded, they also see the grader's score: its estimate, from 0 to 100%, of how much of the reference answer your answer contains. These three figures are not shown to you on the site; you can request yours like the rest of your practice history.
• Sci-AI maintainers. For debugging and incident response. Access is limited to the small number of people responsible for keeping the platform running.

We do not sell this data, share it with advertisers, or pass it to any third party for marketing purposes.

What the external AI service stores

When you use Claude, ChatGPT, or a Custom GPT, that service has its own data-handling policies separate from Sci-AI. The Sci-AI integration only governs what is written back to Sci-AI's database. For what the AI service itself stores about your chat history, see Anthropic's or OpenAI's respective privacy policies.

FERPA

Information Sci-AI keeps about you as a student — including your practice records and the data AI tools you authorize write back — is part of your educational record under FERPA. On request to the Sci-AI maintainers (see Contact below), the download and delete of your data are intended to satisfy the FERPA inspection and amendment rights without requiring a formal request.

Contact

Questions, concerns, or requests about your data: email tle271@ucmerced.edu.