Privacy Policy

Apalchi is an AI-powered study platform operated by CATALYX SYSTEM PTE. LTD, registered in Singapore. We build AI-powered study tools for students and tuition centres. For privacy enquiries, contact us at hello@apalchi.com.

We collect the following categories of data:

• Account data — name, email address, and password hash when you sign up.
• Content you upload — notes, worksheets, and images you submit to the platform for AI processing.
• Usage data — pages visited, features used, session duration, and in-app actions, collected via PostHog analytics.
• Device data — device type, operating system version, and app version, collected automatically for crash reporting and compatibility.
• Payment data — billing is handled by Stripe (web) or the App Store / Google Play. We do not store card numbers.
• Biometric authentication — if you enable Face ID, Touch ID, or fingerprint login, the biometric check is performed entirely on your device by the operating system. Apalchi does not receive or store your biometric data. We record only a device identifier and session state to manage login security.

We use your data to:

• Provide and personalise the Apalchi learning experience
• Process and respond to your uploaded notes via AI
• Communicate service updates, billing notices, and support replies
• Analyse usage patterns to improve the product
• Detect and prevent fraud or abuse

We do not sell your personal data. We do not use your content to train AI models.

Uploaded notes and typed questions are sent to third-party AI providers (Anthropic Claude, Google Gemini) to generate educational content. These providers process data under their standard API terms of service, which include commitments not to use submitted data to train their models.

We share data only with:

• AI providers — Anthropic, Google — for content generation (see Section 4)
• Analytics — PostHog, for product analytics (pseudonymous)
• Infrastructure — Railway (hosting), AWS (storage)
• Payment processors — Stripe, Apple, Google
• Legal requirement — if required by law or to protect the safety of users

We retain your account data for as long as your account is active. Uploaded content is retained to power your tutor and deleted within 30 days of account closure. Analytics events are retained for 12 months. You may request earlier deletion at any time (see Section 10).

We use essential cookies to keep you logged in. We use PostHog analytics cookies to understand feature usage. We do not use advertising cookies or cross-site tracking. On iOS, we request App Tracking Transparency permission before any device identifier is accessed.

Children under 13 are subject to additional protections under the Singapore Personal Data Protection Act (PDPA) and applicable law.

How consent works:When a user indicates they are under 13 (via their declared birth year), their account is immediately restricted from AI features. To activate full access, the child provides a parent or guardian's email address and Apalchi sends a consent request email directly to that address. The parent clicks a secure link in the email to approve the account. Until that approval is received, the account remains restricted. Consent links expire after 7 days. Parents may request a new link be resent at any time.

What is blocked before consent: Prior to parental approval, under-13 users cannot upload notes or content, use AI chat, submit photo questions, or trigger any AI content generation. Reading pre-generated class content from their tuition centre is not restricted.

Who is responsible:Apalchi — not the teacher — operates and controls the consent mechanism. Centre teachers may facilitate enrolment, but Apalchi is the data controller responsible for sending the consent request and recording parental approval before processing any under-13 user's personal data for AI purposes.

We do not knowingly process personal data from children under 13 for AI purposes prior to verifiable parental consent.

All data in transit is encrypted using TLS 1.2 or higher. Passwords are hashed using bcrypt. We conduct periodic security reviews. In the event of a data breach affecting your personal data, we will notify affected users without undue delay and in accordance with applicable law.

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data (“right to be forgotten”)
• Object to or restrict certain processing
• Data portability (receive your data in a machine-readable format)

To exercise any right, email hello@apalchi.com. We will respond within 30 days.

We will notify users of material changes via email or in-app notice at least 14 days before they take effect. The “Last updated” date at the top of this page reflects the most recent revision.