Privacy policy

The short version

• Preparing materials never needs a student's name. Class profiles hold counts (for example “3 EAL learners”), not people.
• Grading uses pseudonymous labels you choose, such as “S07”. Please don't paste names into student work.
• Your material is sent to AI providers only to produce what you asked for. We do not use it to train models.
• We never sell your data or show you ads. With your permission, our website uses ad-measurement cookies to see which of our own ads bring teachers in; they never see what you make.
• Deleting your account deletes your data.

What we store

• Account: your email address, a password hash (handled by our authentication provider), display name, and optional school and country.
• Preferences: default paper size and export font.
• Classes: the profile you write — name, subject, grade, curriculum, language, reading-level range, support-need counts, notes. You control what goes in the notes field; please keep it free of student names.
• Your material: text you paste and files you upload (PDF, Word, PowerPoint, text) or web pages you import, plus the text we extract from them.
• Resources: the quizzes, worksheets and other documents you create and edit, and their answer-key check reports.
• Grading: rubrics, the pseudonymous label for each submission, the response text you paste, AI-drafted scores and the scores you approve.
• Usage: a log of AI actions (what kind, when, token counts and cost) so we can apply plan limits and keep costs fair.
• Billing: your plan, subscription status and a Stripe customer reference. We never see or store card numbers.

Free tools without an account

The free tools at /tools process the text you paste and return the result to your browser; we do not save that text or the result. To prevent abuse we store a one-way hash of your IP address (salted with a server secret, so it can't be reversed into your address), the tool name and a timestamp, for rate limiting.

How AI processing works

When you create, check, refine or grade, the relevant text (your material, your class profile and your instructions) is sent to a large language model through OpenRouter, which routes requests to model providers such as OpenAI, Anthropic and Google. These providers process the text to return a result. We select providers and settings that do not use API inputs to train their models, and we do not use your content to train any model.

AI output can be wrong. That is why every answer key is re-checked by a second, independent model and why grading is always a draft that you approve.

Who processes your data

• Supabase — database, file storage and sign-in.
• OpenRouter and the model providers it routes to — AI processing, as described above.
• Stripe — payments, invoices and subscription management.
• Our hosting provider — serves the website and runs the application.
• PostHog — product analytics (which pages and features are used). Page text and anything you type are masked; session recording is off.
• Resend — account emails such as the reminder before a free trial ends.
• Meta, Google and Pinterest — only if you allow ad cookies (see below), to measure our own ads.

Each processes data only to provide its service to us.

Cookies and ad measurement

• Essential: cookies that keep you signed in. Always on.
• Analytics: PostHog counts visits and feature use so we can improve TwoTick. Until you allow cookies (or outside the EEA, UK and Switzerland, unless you say no) it runs in memory only and stores nothing on your device.
• Ad measurement: when we advertise on Meta (Facebook and Instagram), Google or Pinterest, their pixels tell us which ad led to a sign-up or a trial. We also send them that event from our server with a one-way hash of your email and account id, so they can match it without seeing the address. We remember the ad link you arrived from (its campaign tags) for 90 days. These platforms never receive your material, classes, resources or anything you type in TwoTick.
• In the EEA, UK and Switzerland, ad cookies stay off until you choose “Allow”. Everywhere, you can change your choice at any time from Cookie settings (also in the footer).

Students and schools

TwoTick is used by teachers, not students. Students do not have accounts. If you work under a school or district data agreement (for example under FERPA, COPPA, UK GDPR or similar), the safest practice is the one the product is built around: keep student names and identifiers out of everything you paste.

Keeping and deleting data

We keep your data while your account is open. Downgrading never deletes your work. You can delete your account at any time from Settings → Danger zone: this cancels any subscription, deletes your uploaded files, and permanently deletes your account and everything in it. Backups roll off within 30 days.

Your rights

You can access, correct, export or delete your data. Most of this you can do yourself in the app. For anything else, email privacy@twotick.app and we'll reply within 30 days.

Changes

If we change this policy in a way that matters, we'll tell you by email before it takes effect.