Privacy Policy

What changed in this update

This update documents and strengthens the Lecture Capture data boundary. It does not create permission to obtain or use lecture material and it does not hide activity recorded independently by a university or learning platform.

• The extension transcript surface is paste-only. It does not extract captions or transcript text from lecture pages.
• The extension does not send the lecture page URL, platform name, cookies or university login. You may explicitly enter a lecture date and module hint; only those bounded optional fields accompany the pasted text.
• Pending transcript text is protected by HTTPS in transit and AES-256-GCM application encryption while waiting in the relay. New transfers fail closed rather than being stored as plaintext if the relay encryption secret is unavailable.
• A browser credential can submit a transcript but cannot list or delete the pending inbox. Only the paired UniTracks app can collect and acknowledge it, and every operation is scoped to the same pseudonymous relay identity.
• Accepting an eligible Pro lecture may automatically prepare Notes, Flashcards and Quiz using the online AI service. Other AI actions and private search are separate requests. Free users have three one-time study generations in any combination of Notes, Flashcards and Quiz; Ask remains Pro-only.
• Apple iCloud provides automatic Smart Sync on supported Apple devices. Online study AI and browser transfers use a separate UniTracks service hosted on Cloudflare; they are not Apple iCloud processing.
• Derived server search copies and cached answers are removed after 90 days without account activity, or earlier on related-content deletion or authenticated erasure. Local/iCloud saved material and purchase/spending records remain under their separate rules.
• The policy distinguishes application storage, provider abuse-monitoring retention, infrastructure records and independent university or platform logs.

1. The short version

UniTracks is designed to keep your academic information under your control.

• No conventional UniTracks account is required. Lecture Capture uses revocable device tokens and a pseudonymous service identity when you choose that feature.
• Core academic information such as modules, marks, deadlines and timetable data is stored locally and, on supported Apple devices with Smart Sync enabled, in your private iCloud account. Lecture Capture can receive a transcript you deliberately submit or create a transcript from a recording you choose to start; its optional online study functions send the text and limited service data described below, not the original recording audio.
• UniTracks does not send general product analytics or advertising identifiers to a UniTracks-operated backend. Capture uses the bounded allowance counters and study-use records described below.
• UniTracks does not sell personal data, serve personalised advertising or track you across other companies' apps or websites.
• Smart Sync is on by default on supported Apple devices and can be switched off. Calendar Sync, notifications, widgets, photo import, microphone recording and Screen Time controls use the relevant platform services and permissions.

2. Scope

Apple, Google, your university, your email provider, your calendar provider and your website browser operate under their own privacy policies.

• The UniTracks app on iOS, iPadOS and Android.
• The UniTracks website and degree calculator.
• The UniTracks Capture browser extension and Lecture Capture service.
• UniTracks Free and UniTracks Pro.
• Support requests you send to us.

3. Information stored and processed on your device

Depending on the features you use, UniTracks may process the following information.

This information is stored locally first. On supported Apple devices, default-on automatic Smart Sync can also transfer saved data to your private iCloud account as described below. Optional online study and transfer functions have separate processing boundaries; Lecture Capture does not upload unrelated marks, deadlines or timetable data to its AI service.

You can remove local app data using the reset controls in Settings or by deleting the app. Deleting the app may not remove data separately stored in your iCloud account or calendar.

• Modules, academic years, credits and degree weightings.
• Assessments, marks, estimates, targets and calculated outcomes.
• Deadlines, locations, timetable entries and calendar-sync preferences.
• Exam Cram choices, confidence information and revision plans.
• Lock In sessions, study history and Screen Time selections.
• Lecture Capture transcripts, lecture/session metadata, generated study material, handwritten Notes, imported PDF backgrounds and highlights when you use those features.
• Lecture recording audio, transcript drafts and timestamp links between recording and handwriting. Completed saved recording audio can sync through your private Apple CloudKit account in a separate background transfer; unfinished recordings and live recovery drafts remain on the recording device.
• Notification, widget, appearance and app preferences.
• Subscription entitlement status used to unlock Pro features.

4. Smart Sync and iCloud

Automatic Smart Sync is available to Free and Pro users on supported Apple devices and is on by default. UniTracks uses Apple's private CloudKit database in your iCloud account, with content-addressed snapshot and asset records, to sync saved modules, assessments, marks, estimates, deadlines, timetable, study history, revision progress, transcripts, generated study material, handwritten Notes and imported PDF assets. It runs in the background; availability depends on iCloud, network access and compatible app versions. Independently edited copies may require a conflict choice; immediate identical copies are not guaranteed.

Completed saved recording audio uses a separate private CloudKit audio-transfer lane. Audio may still be uploading or downloading after other saved data appears; quota, network, device or version limitations can prevent playback on another device. Unfinished recordings, device permissions, local security settings and purchase credentials are not copied. Pro includes separate manual backup and restore controls; those controls are not the same as automatic audio transfer. Backups and sync are not a guarantee against all data loss.

The data is associated with your Apple account and handled by Apple. UniTracks does not operate the iCloud service and cannot inspect your private iCloud container through a UniTracks admin system.

Deleting a local item does not immediately erase older recovery snapshots. Unreferenced snapshot content has a seven-day grace period before cleanup. Previously synced recording audio uses separate storage, and automatic cloud-audio deletion and orphan cleanup are not yet complete in this version; deleting the local recording does not guarantee removal of those cloud audio assets. You can manage UniTracks iCloud app data using Apple's device settings where available.

Automatic sync and the Pro manual Smart Sync/settings controls are separate capabilities. You can disable sync through available in-app controls or Apple's iCloud app settings. You can also manage app data in your device's iCloud settings where Apple makes those controls available.

5. Calendar Sync

If you enable Calendar Sync and grant calendar permission, UniTracks may create, update and remove UniTracks deadline or timetable events in the calendar you select. UniTracks uses identifiers and markers to manage the events it created and prevent duplicates. It does not send your calendar contents to a UniTracks server or use unrelated calendar events for advertising or profiling.

You can disable Calendar Sync at any time and can remove calendar permission in device settings.

6. Photos and timetable import

If you choose to import timetable images, UniTracks accesses only the images you select. On supported Apple devices, text recognition is performed using Apple's on-device Vision technology. Selected images and recognised timetable or module text are not uploaded to a UniTracks server in the current public release.

You can remove photo access in device settings.

7. Screen Time and app locking

On supported Apple devices, Lock In can use Apple's Family Controls, Managed Settings and Device Activity frameworks. You choose the apps, categories or websites to restrict. Those selections are stored using Apple system and shared app-container facilities so the Lock In extensions can work. UniTracks does not receive a list of your selected apps or browsing activity through a UniTracks server.

Apple controls the authorisation prompt and the operation of these frameworks.

8. Notifications, widgets and Live Activities

UniTracks can generate local notifications, widgets and Live Activities from information on your device. These may display academic or study information on your lock screen, Home Screen or other system surfaces. Anyone with access to your device may be able to see that information.

You control notification and Live Activity permissions in device settings. Widget content can be removed by removing the widget. Administrator-sent remote notifications are not active in the current public release.

9. Purchases and StoreKit

On Apple devices, UniTracks Pro purchases are processed by the App Store using StoreKit. UniTracks checks verified StoreKit transaction and subscription information to unlock Pro, restore purchases and keep entitlement status accurate. Apple processes payment and UniTracks does not receive or store your full payment-card details. Apple may provide sales, subscription and diagnostic information through its developer systems under its own policies. On other supported platforms, the relevant app store performs the equivalent purchase processing.

9a. Lecture Capture and the browser extension

Lecture Capture is optional. The extension's transcript surface is a paste box: it does not read lecture pages or extract captions. It sends only transcript text you deliberately paste and submit. You must obtain and use that text in accordance with your university, lecturer and learning-platform rules.

A transcript may itself contain personal information about lecturers, students or other people, including names, statements, questions or opinions. UniTracks receives that material from the user who submits it, not from the university or the people mentioned. Do not submit confidential or personal material unless you have permission or another lawful basis to do so.

Before Lecture Capture can be enabled, the app asks you to confirm that you will import only material you are authorised to use for private study and will follow the applicable university, lecturer and platform rules. UniTracks does not grant ownership of or permission to copy third-party material.

A transcript request contains pasted text, a generic label, any optional lecture date or module hint you explicitly enter, an authorisation bearer token and routine network information such as IP address, headers, endpoint and timing. It does not include the lecture page URL, platform name, cookies, university login credentials, audio or video. Ambient page metadata is stripped; the service permits only the bounded date and module fields supplied by you.

Pasted text travels to the UniTracks relay over HTTPS. While it waits in Cloudflare D1, UniTracks additionally encrypts the text using AES-256-GCM with a server-side secret. Cloudflare also provides infrastructure encryption at rest and in transit. The UniTracks encryption layer fails closed: if its key is missing or invalid, no new transcript is stored.

This relay encryption is not end-to-end encryption. The UniTracks Worker must decrypt the text in memory to deliver it to the authenticated app. Authorised UniTracks operators and Cloudflare infrastructure may therefore be technically capable of processing content where necessary to operate, secure, investigate or comply with law, although UniTracks has no routine content-review workflow.

The temporary relay record contains a random transcript ID, pseudonymous relay-user ID, encrypted text, byte count, generic source label, any optional date or module hint entered by you, and creation and expiry times. It does not store ambient university-page metadata.

Browser and app credentials are separate. Only cryptographic hashes of bearer tokens are stored by the service. Pairing codes expire after ten minutes; pairing attempts and transcript uploads are rate-limited. A browser credential may submit text but cannot read or erase the pending inbox. Only the paired iOS credential can collect or acknowledge pending text, and database operations are restricted to its pseudonymous relay identity.

After the app durably saves an accepted transcript, it queues an acknowledgement that removes the pending relay copy. Uncollected transfers become inaccessible after their 24-hour expiry; physical deletion is performed by the scheduled cleanup and may occur later. Response headers instruct browsers and intermediaries not to cache transcript responses. UniTracks application logs do not intentionally record transcript bodies, page URLs, bearer tokens or AI-provider response bodies; infrastructure providers may process ordinary service and security logs under their own terms.

Lecture Recording V1 uses the device microphone with your permission and Apple's on-device speech transcription on supported Apple devices. Live drafts and unfinished recording recovery files remain on the recording device. Completed saved audio can transfer through your private Apple CloudKit account, but UniTracks does not send raw audio to Cloudflare or OpenAI for this version. After finalisation, the saved transcript can be used by the same online study functions as an imported transcript. Record only with the permission required by your lecturer or institution; a live transcript may be inaccurate and is not a verified record.

Handwritten Notes and PDF annotation use local Apple Pencil/PencilKit drawing data on supported iPads. UniTracks stores ink coordinates, note metadata, imported PDF assets and, when used, timestamp links to local recordings. Saved note and PDF assets may be included in Smart Sync or a backup; completed linked recording audio uses its separate private CloudKit transfer. Timestamp links do not guarantee that the audio has finished downloading on another device. Sharing or exporting a note is a separate action you choose.

Confirmed transcripts, session metadata and generated study material are stored locally and may enter automatic Smart Sync when it is enabled, including its default-on state. Apple processes that copy in your private iCloud account under Apple's terms and settings, using your iCloud storage quota. Recovery requires a completed snapshot and compatible app version. Deleting a local item does not immediately erase all historical recovery snapshots: unreferenced content pieces have a seven-day grace period before cleanup. Turning sync off does not itself erase existing iCloud copies.

After you accept an eligible Pro Lecture Capture transcript, UniTracks may automatically send it through its Cloudflare-hosted service to OpenAI to tidy the saved transcript and prepare Notes, Flashcards and Quiz. Tidying applies to recorded and pasted/file-imported lecture transcripts and uses the existing personal Study AI allowance or eligible Extra AI; Free or exhausted accounts skip paid tidying. The first three eligible real lectures prepare all three study tools; later lectures use recent meaningful study use to select a smaller set. Importing does not automatically create embeddings, build a search index or run Ask or Exam Cram. Free trial generation is a separate action you choose; three usable generations are shared across Notes, Flashcards and Quiz for the lifetime of the user identity, not three of each or three per month.

Free transcript imports are limited to ten total, not ten per month. Lifetime acceptance and generation records prevent resets by reinstalling the app or re-pairing the browser. A usable Free generation consumes one trial use even if you have not yet opened or saved it; a failure with no usable result does not. Pro does not include unlimited AI: new generation can stop at the shared allowance, with optional Extra AI products purchased through the App Store. Prices are supplied by the store, not the internal cost ledger.

A generated result can be held temporarily on the service for recovery for up to 23 hours. After the app verifies a complete local saved copy, it acknowledges removal of that temporary result. This is separate from the original transcript and from search records. Saved material remains available without another generation; regenerating can consume allowance again.

If you deliberately request Notes, Flashcards, Quiz, Ask, Exam Cram augmentation, transcript cleanup or captured-lecture search, UniTracks sends the transcript or the excerpts needed for that selected function through its service. Search may split relevant lecture text into traceable chunks and send chunks to OpenAI's embeddings API; UniTracks stores the resulting private search excerpts, metadata and embeddings under the pseudonymous relay identity using account and module filters.

For OpenAI Responses requests, UniTracks sets store to false so it does not request Responses application-state storage. OpenAI states that API inputs and outputs are not used to train its models by default unless the customer opts in. Under OpenAI's standard API controls, prompts, outputs and embeddings may still be included in abuse-monitoring logs for up to 30 days, or longer where legally required. Zero Data Retention is a separate OpenAI control available only to eligible, approved projects; this Policy does not claim it is active unless UniTracks expressly announces that change.

Online AI and allowance checks also send Apple-signed app and purchase proofs to UniTracks to verify eligible access and prevent allowance resets. The service stores a one-way hashed account identity, its relay association, monthly allowance totals and usage-event metadata such as feature, model, token counts, cost estimate and time. It does not intentionally store signed proofs, raw Apple transaction identifiers, prompts or transcript text in the usage ledger.

The Capture service keeps bounded aggregate daily counts of allowance exhaustion, top-up views, purchase attempts and Extra AI use to assess costs and limits. These aggregate counters contain no account, device or transcript identifiers or content. Separately, account-scoped meaningful study-use records help choose which eligible tools to prepare. They are not general product analytics or third-party advertising tracking.

UniTracks does not use transcript content for advertising, behavioural profiling or general product analytics and does not sell it. We do not routinely disclose academic content to universities, advertisers or data brokers. We may process or disclose limited information where reasonably necessary to secure the service, investigate abuse, respond to a valid legal requirement, protect legal rights or handle a data-protection request.

These controls do not conceal or alter activity records kept independently by a university, learning platform, browser, device or network. They do not prevent those organisations from enforcing their terms, and they do not make unauthorised copying or processing lawful.

The current extension recognises supported university assessment tables locally. Passive detection communicates only a readiness signal to the extension; assessment values are sent to UniTracks only when you explicitly choose Send. These values fill only matching blank marks and are not sent to the AI provider or used for analytics. The current extension no longer detects or sends course/module lists. The relay temporarily retains compatibility with already-sent batches from older extensions. Pending transfers are removed after acknowledged local persistence; uncollected transfers become inaccessible after 24 hours and are physically deleted by scheduled cleanup.

10. Support and requests

When you submit a request in UniTracks, the app opens your email application. The draft may include your message and whether you use Free or Pro. Nothing is sent until you choose to send the email.

If you contact us, we receive the information in your email, including your email address and anything you choose to include. We use it to respond, investigate issues, prevent abuse and keep necessary business records. We retain correspondence only for as long as reasonably needed for those purposes or to meet legal obligations.

Please do not send marks or other sensitive information unless it is necessary for your support request.

11. Giveaway form data

The UniTracks £50 Giveaway form may collect your first name, email address, confirmation that you are aged 18 or over, confirmation that you live in the United Kingdom, acceptance of the official rules, campaign ID, UniTracks entry reference, qualification route and submission time.

This information is used only to administer the giveaway: to validate entries, remove duplicates, select and contact the winner, verify eligibility, fulfil the prize and maintain an audit record. Giveaway information is not used for marketing without separate voluntary consent.

Module names, marks, deadline names and timetable contents are not submitted. The app checks qualification locally and sends only the campaign ID, entry reference and qualification route.

Tally processes entry submissions on behalf of UniTracks in European Union under its data-processing terms.

Unsuccessful and invalid entry data is deleted 90 days after prize fulfilment. Cleaned draw evidence and administration records are retained for 12 months after prize fulfilment. Raw bank details held outside the banking provider are deleted within 30 days after successful payment, after which only a minimal payment record is retained.

Giveaway questions can be sent to giveaway@unitracks.co.uk. Privacy requests can be sent to privacy@unitracks.co.uk. You may also complain to the UK Information Commissioner's Office at ico.org.uk.

• Bank details are not collected during entry.
• Giveaway entry information is not marketing consent.
• The giveaway data is not sent to the dormant UniTracks business backend as academic profile data.

11a. Android beta tester registration

Android beta registration is optional and uses a separate Tally form, not the giveaway form. It asks for the Google account email connected to Google Play, an optional first name, an optional phone number and acknowledgements about testing and test-related contact. UniTracks uses these details to add or invite you to the closed Google Play test and send testing instructions or follow-up questions by email or text when a phone number is provided. Registration does not provide instant installation or enrol you in unrelated marketing.

The form opens only when you choose to register. Tally receives the information you submit and processes the form under its own service and privacy terms. UniTracks passes allow-listed campaign labels such as source and UTM values to Tally so registrations can be attributed to a campaign. The website does not forward your form answers or email address to its analytics events, or create a tester account or registration database. Your Google account email is used with Google Play to arrange test access. Contact support@unitracks.co.uk about your registration or to ask for deletion of information we hold.

12. Website calculator and setup codes

The website calculator stores your calculator setup in your browser's local storage so it remains available on that browser. Calculator values are not sent to a UniTracks application backend.

If you choose Copy setup code or Open in UniTracks, the website converts the setup into a URL-safe encoded payload. This is encoding, not encryption. Anyone who receives the code or link may be able to decode its contents, so treat it as private.

Like most websites, our hosting provider may process routine request information such as IP address, browser type, requested page, time and security logs to deliver and protect the site. UniTracks does not use that information to build advertising profiles.

When you use a UniTracks business-card QR link, we record the scan time, broad device platform, selected app-store destination, whether the link opened in an embedded browser, broad country and any campaign, location or batch label included in the link. We use this limited first-party information to understand business-card performance. It does not include academic data, an advertising identifier or an UniTracks account identifier.

You can clear website calculator data using the site's privacy controls or your browser's site-data controls.

13. Analytics and service backends

UniTracks does not send general analytics events, advertising identifiers, push tokens or general product-usage data to a UniTracks-operated receiver.

The general UniTracks business analytics backend remains disabled. The separate Lecture Capture service operates only when you choose its pairing, transfer, search or AI features and handles the limited data described in section 9a.

We do not use third-party advertising or analytics SDKs in the current public release.

14. Who receives information

Information may be handled by the following providers when you use the relevant service. They may also process limited account, network, billing, diagnostic, security or legal-compliance information under their applicable terms:

We do not sell or rent personal information. We do not routinely share academic data with universities, advertisers or data brokers. We may disclose information when required by law or reasonably necessary to protect users, UniTracks or the security and legal integrity of the service.

• Apple, for App Store purchases, iCloud, Calendar, notifications, widgets, Live Activities, Screen Time frameworks and platform services.
• Google, for Google Play purchases and Android platform services.
• Cloudflare, which hosts the optional Lecture Capture relay, private search index and supporting service data.
• OpenAI, for requested AI tools, eligible automatic Pro study preparation and requested private search embeddings, using the transcript or relevant excerpts needed for those functions.
• Your email provider, when you send a support request.
• Our website hosting provider, for routine website delivery and security logs.

15. Legal bases

Most academic information is processed only on your device. Optional Lecture Capture data is processed when you choose the relevant transfer, search or AI feature. UniTracks AI outputs are private study aids; they do not make decisions producing legal or similarly significant effects about you.

• Performance of a contract, to provide requested support, transfers, study tools and paid features.
• Your consent, for optional device permissions and services where consent is required.
• Legitimate interests, to secure the website, respond to enquiries, prevent abuse and improve reliability without overriding your rights.
• Legal obligations, where records must be retained or disclosed by law.

16. Retention and deletion

UniTracks has no conventional profile account to delete. Lecture Capture uses revocable device tokens and a pseudonymous service record. You can disconnect a paired browser, delete confirmed transcripts in the app, remove local information using UniTracks reset controls or by deleting the app, clear browser calculator data through Privacy Choices, and manage iCloud or Calendar data through the relevant Apple settings. For help with information we actually hold, email support@unitracks.co.uk.

• On-device data: retained until you delete it, reset the app or uninstall UniTracks.
• Pending Lecture Capture transfers: deleted after acknowledged local collection; inaccessible after 24 hours, with physical deletion by subsequent scheduled cleanup.
• Temporary generated AI results: recoverable for up to 23 hours, or removed after acknowledged complete local saving. The original local transcript, saved study tools and search index have separate retention rules.
• Private Lecture Capture search excerpts, embeddings and cached answers: removed when the related transcript or module is deleted, on authenticated search-data erasure, or after 90 days without account activity. Activity is checked across paired devices linked to the same verified account. Scheduled cleanup and vector-service outages can delay physical removal; durable erasure requests are retried. This does not remove local or private iCloud saved material or reset purchase and spending records. Returning users may need their search index rebuilt using the existing AI allowance. Contact support@unitracks.co.uk for help with erasure.
• Lecture Capture device records, token hashes, pseudonymous account links and allowance records: retained while reasonably needed to provide pairing, prevent allowance resets, investigate abuse, resolve billing or security issues, respond to deletion requests and meet legal obligations. Credentials older than 90 days are rejected by the service even if a limited historical record is retained for those purposes.
• OpenAI processing initiated by an AI or embedding action: subject to OpenAI's standard abuse-monitoring retention of up to 30 days, or longer where legally required, unless an approved Zero Data Retention configuration applies. Setting store to false avoids requested Responses application-state storage but does not itself switch off abuse-monitoring logs.
• iCloud data: retained within your Apple account according to your settings and Apple's policies.
• Calendar events: remain in your calendar until removed by UniTracks, by you or by your calendar provider.
• Website local storage: retained in that browser until you clear it.
• Support correspondence: retained only while reasonably necessary to deal with the request, protect the service or comply with legal obligations.
• Store records: retained by Apple or Google under their policies and legal duties.

17. Security

We minimise the information sent away from your device. Lecture Capture uses TLS in transit, AES-256-GCM application encryption for pending transcript text at rest, user-scoped database and vector operations, hashed credentials, short-lived pairing codes, rate limits, no-store response directives and content-minimised application logging. Cloudflare also encrypts D1 data at rest and in transit.

Relay encryption is not end-to-end encryption because the service must decrypt pending text to deliver it to the paired app. Private search and AI requests also require server and provider processing. No security measure, storage system or transmission method is completely secure, and this Policy is not a promise that a breach can never happen.

Keep your device, Apple or Google account, browser profile, email, setup codes and extension pairing private. Disconnect browsers you no longer use and maintain any backups you require. If UniTracks becomes aware of a personal-data breach, we will assess it and notify affected people and the relevant regulator where applicable law requires.

18. International processing

Apple, Google, Cloudflare, OpenAI, email and website hosting providers may process information outside the United Kingdom, including in the United States. Their privacy notices explain their locations and safeguards. Where UniTracks is responsible for a restricted transfer, applicable processor terms and transfer safeguards may include the UK International Data Transfer Addendum and incorporated Standard Contractual Clauses. International processing can remain subject to lawful access in the destination country.

19. Your rights

Depending on the circumstances, UK data-protection law may give you rights to access, correct, erase or restrict personal information, object to processing, and receive portable information. You may also withdraw consent where processing relies on consent.

These rights apply to information we actually hold. We cannot retrieve academic data that exists only on your device, private iCloud account or browser.

To exercise a right, request deletion of information we hold or ask a privacy question, email support@unitracks.co.uk. You may also complain to the UK Information Commissioner's Office at ico.org.uk.

20. Children

UniTracks is designed for university students and is not directed to children under 13. We do not knowingly collect personal information from children through a UniTracks account or analytics service. If you believe a child has sent us personal information, contact us so we can address it.

21. Changes to this Policy

We may update this Policy when UniTracks, the law or our providers change. We will change the date above and provide additional notice in the app where a change materially affects how we handle information.

22. Contact

Data controller: Benjamin Cossey, a sole trader trading as UniTracks. Privacy and rights requests: support@unitracks.co.uk. Service address: 11 Douglas Grove, Lower Bourne, Farnham, Surrey, GU10 3HP, United Kingdom.