Privacy Policy
1. Introduction
Carpeta is designed with privacy and data minimization as core principles. The app allows students to organize their schoolwork, create notes, manage binders, and use optional AI-powered study tools without requiring them to provide personal information to Carpeta.
This Privacy Policy explains what information Carpeta does and does not collect, how student-created content is handled, and how information is processed and temporarily stored when a user chooses to use an AI-powered feature.
2. Account Not Required
Carpeta does not require any student to create an account or profile of any kind. The app has been purposely designed to function without requiring personal information from the user.
Carpeta does not ask a student to provide their name, email address, telephone number, home address, school name, date of birth, or similar personal profile information in order to use the app.
Because Carpeta does not collect this information, there is no student identity profile maintained by Carpeta and no account database that associates a student's notes or schoolwork with their real-world identity.
3. Student-Created Content
Carpeta allows users to create their own educational content, including binders, notes, handwritten notes, drawings, and other free-form content. The app does not require users to include personal information in this content.
Because these areas are free-form, a student may voluntarily type or write personal or identifying information into a note, binder name, or other field. For example, a student may choose to write their own name or the name of their school in a note even though Carpeta does not request that information.
Carpeta does not extract voluntarily entered personal information for the purpose of creating a student profile, identifying the student, advertising to the student, or associating the content with the student's real-world identity.
4. AI-Powered Study Features
Carpeta includes optional AI-powered study features that may be used for purposes such as explaining concepts, summarizing notes, generating practice questions, creating flash cards, providing tutoring assistance, and producing other educational content.
AI processing takes place only when a user chooses to use one of these features. When an AI feature is requested, the note or other content required to complete that request may be securely uploaded to Carpeta's infrastructure hosted on Amazon Web Services (AWS).
Carpeta does not attach a student's name, email address, school name, or student profile to an AI request because the app does not collect those fields.
If a student has voluntarily included personal information in content that they choose to submit to an AI feature, that information may necessarily be included in the content transmitted for processing. Users are therefore encouraged not to include unnecessary personal or sensitive information in content submitted to AI features.
5. Temporary Storage of Content Submitted for AI Processing
When a student chooses to submit a note or other educational content to an AI-powered feature, that content may be temporarily stored within Carpeta's private Amazon S3 storage environment.
Content submitted for AI processing is retained for a maximum of 24 hours. This temporary storage allows Carpeta to process the requested AI operation and may allow additional AI operations involving the same note to be completed without requiring the student's device to upload the same content again.
Temporary AI content is automatically scheduled for deletion using Amazon S3 lifecycle management. It is not retained beyond the temporary processing period as part of Carpeta's normal operation.
Temporary note content is not backed up or replicated into longer-term storage.
Carpeta does not use temporarily stored student content to create student profiles, determine the identity of a student, advertise to students, sell information, or train AI models.
6. Security of Temporarily Stored Notes
Content temporarily stored for AI processing is maintained in private Amazon S3 storage and is not publicly accessible.
Uploads use short-lived, securely generated pre-signed URLs that permit the specific upload required for the requested operation. Access to stored content is otherwise restricted to authorized Carpeta backend services using AWS access controls.
Stored objects use randomized, non-identifying object identifiers. Carpeta does not use a student's binder name, note name, school name, or other student-created descriptive information as the storage identifier for the uploaded object.
The contents of student notes are not included in Carpeta's application logs.
These measures are intended to ensure that temporary storage remains limited to the technical purpose of providing the AI functionality requested by the student.
7. Amazon Bedrock AI Processing
After content is securely uploaded for AI processing, Carpeta may provide the content required for the requested operation to Amazon Bedrock, including Amazon Nova models.
Carpeta's production Amazon Bedrock environment is configured to use Zero Data Retention for AI inference. Under this configuration, AI request and response content processed by Amazon Bedrock is not written to durable storage by AWS or shared with the model provider.
Amazon Bedrock model invocation logging is also disabled in Carpeta's production environment. Carpeta therefore does not configure Amazon Bedrock to copy student prompts, submitted note content, or AI responses into Amazon CloudWatch Logs or Amazon S3 through model invocation logging.
AWS states that inputs and outputs processed through Amazon Bedrock are not used to train Amazon Bedrock models, including Amazon Nova. Carpeta also does not use student notes or AI-generated responses to train its own AI models.
The temporary Amazon S3 storage described in Section 5 is separate from Amazon Bedrock's AI inference data retention. A note may therefore remain temporarily available to Carpeta for up to 24 hours even though Amazon Bedrock itself is configured for Zero Data Retention.
8. AI-Generated Content
AI-generated content is returned to the Carpeta app following processing.
If a student chooses to save an AI-generated summary, explanation, flash card set, practice quiz, or other generated material, that content may become part of the student's locally managed Carpeta content.
Carpeta does not maintain a permanent server-side library of AI-generated study material as part of the AI processing service.
9. Subscription Validation and AI Usage
Some Carpeta AI features require an active subscription. To provide those features, Carpeta's backend retains only the minimum technical information necessary to validate access, enforce applicable AI usage limits, prevent abuse, and operate and secure the service.
This technical information is not used to create a student identity profile, determine the student's real-world identity, or advertise to the student.
10. Purchases and Subscriptions
Purchases and subscriptions made through the Apple App Store are processed by Apple. Carpeta does not receive or store a user's full payment card information.
Carpeta may receive or process technical entitlement information necessary to determine whether a purchase or subscription is active and whether the user is entitled to access paid functionality. Apple's handling of Apple ID, payment, purchase, and account information is governed by Apple's own privacy practices.
11. Data Retention
Carpeta follows a data-minimization approach and does not maintain a permanent server-side database or library of student notes.
Student notes and other educational content remain on the student's device during normal use of Carpeta. Content is transmitted to Carpeta's systems only when required to provide a feature requested by the user, such as an AI-powered study feature.
Content uploaded for AI processing may be retained within Carpeta's private AWS infrastructure for up to 24 hours. The content is automatically scheduled for deletion through Amazon S3 lifecycle management and is not backed up or replicated into longer-term storage.
Amazon Bedrock AI inference is separately configured for Zero Data Retention, and Bedrock model invocation logging is disabled.
Carpeta does not collect student names, email addresses, school names, dates of birth, home addresses, telephone numbers, or similar student profile information.
Limited technical information related to subscriptions, entitlement validation, AI usage, security, and abuse prevention may be retained for as long as reasonably necessary to provide and protect the service.
12. Advertising, Tracking, and Sale of Information
Carpeta does not sell student notes or student personal information.
Carpeta does not use student notes for targeted advertising, provide student notes to data brokers, create advertising profiles based on student content, or attempt to determine a student's real-world identity from their educational content.
Temporarily stored content submitted for AI processing is used only as necessary to provide, operate, secure, and support the functionality requested by the user.
13. Children and Students
Carpeta is designed for educational use, including use by secondary-school and post-secondary students. Its privacy model is intentionally designed so that the app does not need to collect a student's identity in order to function.
No student account is required, and the application does not request the student's name, email address, school, date of birth, address, telephone number, or other personal profile information.
A student who chooses to use an AI-powered feature should understand that the content they submit may be securely stored within Carpeta's AWS infrastructure for up to 24 hours for processing before being automatically deleted.
Parents or guardians who have questions about Carpeta's privacy practices may contact us using the information provided below.
14. Security
Carpeta uses reasonable administrative, technical, and organizational safeguards designed to protect information transmitted through its services. Communications between the app and Carpeta's backend services are encrypted in transit using industry-standard secure communication protocols.
Content temporarily uploaded for AI processing is stored in private Amazon S3 storage, uses randomized non-identifying object identifiers, and is accessible only through authorized backend services or appropriately scoped, short-lived pre-signed URLs.
Carpeta does not include student note content in application logs, does not back up temporary AI-processing objects, and does not replicate those objects into longer-term storage.
Temporary content is automatically scheduled for deletion within 24 hours using Amazon S3 lifecycle management.
These safeguards reduce privacy risk, but no electronic transmission, storage system, or processing environment can be guaranteed to be completely secure.
15. Ownership of Student Content
Students retain ownership of the content they create in Carpeta. Uploading content for AI processing or using an AI-powered feature does not transfer ownership of a student's notes, drawings, or educational content to Carpeta.
The student grants Carpeta only the limited permission necessary to temporarily store and process submitted content for the purpose of providing the feature requested by the student, operating and securing the service, and complying with applicable legal obligations.
Temporary storage of content does not give Carpeta any ownership interest in that content.
16. International Processing
AWS may operate infrastructure in different geographic regions. Depending on the infrastructure used to process a request, information may be processed outside the user's province, state, or country and may therefore be subject to the laws applicable in those jurisdictions.
Content stored temporarily by Carpeta for AI processing remains subject to the retention and security practices described in this Privacy Policy. Amazon Bedrock's separate Zero Data Retention configuration governs durable storage of AI inference request and response content within Amazon Bedrock.
17. Legal Requirements
Carpeta may disclose information if required to do so by applicable law, regulation, legal process, or an enforceable governmental request.
Because Carpeta does not maintain student identity profiles and automatically deletes content temporarily uploaded for AI processing within the stated retention period, the information available to Carpeta in response to such a request may be limited.
18. Changes to This Privacy Policy
Carpeta may update this Privacy Policy as the app, its features, technical architecture, service providers, or applicable legal requirements change.
If material changes are made to the way student content or information is collected, stored, processed, or retained, this Privacy Policy will be updated and the "Last Updated" date will be revised. Where appropriate, notice may also be provided within the app.
19. Contact Us
If you have questions or concerns about this Privacy Policy or Carpeta's privacy practices, please contact:
[Developer / Company Name] [Privacy Contact Email] [Website URL]