Privacy

What this page covers

Sci-AI is UC Merced's research-practice platform. This policy describes the personal data the platform collects about you — when you create an account, when you practice, and when you connect an external AI tool (Claude, ChatGPT, or a custom OpenAI GPT) — how that data is used, which service providers process it, and how you can inspect or delete it.

Account and identity data

When you register or sign in, we store what's needed to run your account:

• Username and display name.
• Email address. Student accounts require a UC Merced (@ucmerced.edu) email address; guest accounts are created without an email.
• Password. Stored only as a bcrypt hash — never in plain text. When you set a password we check it against the Have I Been Pwned breach database using a partial, one-way hash, so your actual password never leaves our server.
• Google sign-in details. If you use "Sign in with Google," we receive and store your Google account identifier, email, name (used as your display name), and your Google Workspace domain — the domain is how we confirm UC Merced membership.
• Account metadata. Your role (student, faculty, admin, or guest), when the account was created, and when you last signed in.

To confirm your email we send a one-time verification link (valid for 24 hours); we store only a hashed form of that link's token, not the link itself.

Practice and learning data

As you use the practice tools and prelab activities, we record your study activity:

• Your answers. The written answers you type, the multiple-choice options you pick, whether each was correct, how long you took, and difficulty ratings — kept as a per-class review log so your instructor can see your progress.
• Activity. Which lab documents and simulations you complete, and files you download.
• A learning profile derived from your prelab tutoring — topic mastery, a concept "mind map," personalization notes, learning-style notes, and topics you struggled with.

AI grading of your written answers

When you submit a written (free-response) practice answer, that answer — up to about 4,000 characters — is sent, together with the question and a reference answer, to Anthropic's Claude API, which grades it and returns short feedback. We store the resulting grade and feedback in your review log. We send only your answer and the question context — not your name, email, or a chat transcript.

What a connected AI tool writes to our database

Separately, when you authorize an external AI tool (Claude, ChatGPT, or a custom OpenAI GPT) to connect to Sci-AI, that tool can call a small set of write actions on your behalf. Each call creates a row in one of two tables:

• Session summaries — a 1–3 sentence summary the AI writes at the end of an educational conversation, plus the topics you discussed and an optional structured note (how long you worked, what you struggled with, what you mastered). Also includes which lab and class the session was about, if known.
• Concept signals — short observations the AI flags when it notices you're struggling with a specific topic (e.g. "confusion about the chain rule"). Used by your instructor's dashboard, not for personalization.
• Self-assessments — when you explicitly tell the AI how you feel about what you studied (e.g. "I'd rate my understanding 80 out of 100").

Each row is linked to your user account and to the specific AI app (OAuth grant) that wrote it, so you can revoke one app without affecting others.

Personal information is scrubbed before an AI summary is stored

Before any AI-written summary is saved, the server runs a redactor that replaces likely personal information with placeholder markers. Patterns currently scrubbed:

• Email addresses
• US-shaped phone numbers
• SSN-shaped numbers
• Long contiguous digit runs (likely credit-card numbers or IDs)
• Long random-looking character runs (likely API keys or tokens)

We do not keep a pre-scrub copy. There is also a hard size cap (~4 KB) on the summary text and (~16 KB) on the structured note; anything longer is truncated before storage. Note that the redactor is a best-effort defense, not a guarantee — if you type sensitive information to an AI tool in an unusual format, it may not be recognized. Don't paste secrets into AI chats.

What a connected AI tool does not store

• Full conversation transcripts. Only the summaries the AI explicitly writes back are stored. Whatever else you discussed with Claude or ChatGPT stays with them, governed by their own privacy policies.
• Raw OAuth tokens. Every access token and refresh token is hashed (SHA-256) before storage. We cannot recover the original token, only verify a presented one. Client secrets (for Custom GPT integrations) are stored as bcrypt hashes for the same reason.
• Third-party tracking. The AI integration does not inject analytics or third-party tracking pixels.

Cookies and sessions

We use only first-party, functional cookies. There are no analytics, advertising, or third-party tracking cookies, and no tracking pixels.

• sciai_session — keeps you signed in. It is HttpOnly, sent only over HTTPS, scoped SameSite=Lax, and expires after 30 days.
• google_nonce — a short-lived value used only to protect the "Sign in with Google" flow from cross-site request forgery.

IP addresses

We never store your raw IP address. To prevent abuse (rate-limiting sign-in attempts) and for the audit trail when you authorize an AI app, your IP is first put through a salted, one-way hash. When you authorize an AI app we also record the browser's user-agent string alongside that hashed IP, as part of the consent record.

Third parties who process your data

We rely on a small set of service providers to run the platform. Each receives only what it needs for its function:

• Anthropic (Claude). Grades your written practice answers, and — when you connect Claude — receives the lab and profile context it needs and writes summaries back.
• Neon. Hosts our database.
• Cloudflare R2. Stores uploaded lab files.
• Resend. Sends account emails, such as your verification link (receives your email address).
• Google. Verifies "Sign in with Google."
• Have I Been Pwned. Checks passwords against known breaches — receives only a partial hash, never your password or your identity.
• Vercel. Hosts and runs the site.

We do not sell your data or share it with advertisers. If you connect Claude or ChatGPT, the conversation itself happens on that service under its own privacy policy (see below).

How long we keep it

• Account and study data: kept while your account is active.
• AI-integration data (session summaries and concept signals): you can download or delete it at any time (see Your rights below). Summaries tied to a specific class are also removed automatically when you leave that class.
• Sign-in session: the session cookie expires after 30 days.
• AI-app access: access tokens expire after about an hour and refresh tokens after 30 days; once expired they no longer work.

Your rights (and how to use them today)

You can exercise all of the following at any time — email the Sci-AI maintainers (see Contact below) and we'll action it:

• See which AI apps are connected. Each connection shows its name, when you authorized it, when it last used the connection, and exactly which permissions you granted.
• Revoke a connection. We cut off that app's access. The very next call it tries to make returns 401 and it must re-authorize from scratch. Existing summaries that app already wrote are kept (under your control) — revocation stops future writes, it doesn't delete past ones.
• Download your AI-integration data. A JSON file with every session summary and concept signal across every AI app you've ever connected. This is the FERPA "right to inspect" for the AI-integration data.
• Delete your AI-integration data. Hard-deletes every summary and signal you own. OAuth grants are kept separately so you can revoke them in the same place; deleting data doesn't accidentally lock connected apps in a half-authorized state.
• Access or delete your account data. For your account, practice history, or to delete your account entirely, email the maintainers and we'll action it.

Who can see this data

• You. Via the download described above; also displayed in your own portal views.
• Your instructor. Your practice progress, concept signals, and session summaries for classes you are enrolled in feed instructor dashboards intended to surface where students are struggling. Instructors see aggregate and per-student views for their own classes only.
• Sci-AI maintainers. For debugging and incident response. Access is limited to the small number of people responsible for keeping the platform running.

We do not sell this data, share it with advertisers, or pass it to any third party for marketing purposes.

What the external AI service stores

When you use Claude, ChatGPT, or a Custom GPT, that service has its own data-handling policies separate from Sci-AI. The Sci-AI integration only governs what is written back to Sci-AI's database. For what the AI service itself stores about your chat history, see Anthropic's or OpenAI's respective privacy policies.

FERPA

Information Sci-AI keeps about you as a student — including your practice records and the data AI tools you authorize write back — is part of your educational record under FERPA. On request to the Sci-AI maintainers (see Contact below), the download and delete of your data are intended to satisfy the FERPA inspection and amendment rights without requiring a formal request.

Contact

Questions, concerns, or requests about your data: email tle271@ucmerced.edu.