Privacy Policy

1. Who we are

This service is operated by 茅勤 (Mao Qin), an individual operator. Privacy contact: hello@drforest.ai.

2. Information we process

• Account identifiers, password hashes and consent records.
• Profile, grades, target courses, applications and study plans that you enter.
• Exam answers, timing and interaction telemetry used for marking and difficulty calibration.
• Documents you choose to upload, plus technical logs needed for security and reliability.

3. Why we use it

We use information to provide account access, save progress, personalise study, grade work, secure the service, respond to requests and meet applicable obligations. We use aggregated data to decide which topics need more questions. The editorial table and its exports contain no individual student identifiers or submitted work, and statistics for topics with fewer than five students are hidden. We do not sell personal information.

4. AI processing

AI features are optional. Only when you trigger an AI feature and have separately consented may the submitted content be sent to the AI provider configured by the service, currently DeepSeek when enabled. Do not submit unnecessary identity, passport, health or payment information. You may withdraw this consent from Account & Privacy without losing non-AI features.

5. Sharing and storage

Tencent Cloud hosts the service in Hong Kong Zone 2. The database, answer photographs and local backups are on that server; Hong Kong is outside mainland China. When enabled and separately authorised by you, the official DeepSeek API receives the submitted work, any answer images and necessary question context for feedback. Its operator is Hangzhou DeepSeek Artificial Intelligence Basic Technology Research Co., Ltd. and its affiliates. Provider processing is governed by the applicable API terms and DeepSeek privacy policy; we do not promise provider-side zero retention or exclusion from training without a verified account-specific arrangement. AI is currently disabled on the public production service.

Password-recovery email uses Resend (Plus Five Five, Inc.), which receives the recipient address, sender details and message containing a reset link. Its privacy policy describes transfer to and processing in the United States. Website hosting, optional AI and email may therefore involve different jurisdictions. The verified backup arrangement described here covers local backups; it is not a claim about every copy a cloud provider may hold.

6. Retention and your choices

Question feedback, answer records, uploaded answer photographs and AI feedback enter the daily deletion process at 365 days from creation. Repeated feedback does not restart the period. Account information remains while the account is active; there is no automatic inactivity-based account deletion. You can export your data or request permanent account deletion from Account & Privacy. Reset links expire after 30 minutes and SMS codes after 5 minutes.

Encrypted local backups retain the latest 14 successful backup sets, a count rather than a guaranteed 14-day period. Deleted information may remain in these sets until later successful backups replace them. The production container and access logs currently have no configured time-based automatic expiry; they are separate from the 365-day study-data process. Contact hello@drforest.ai about deletion or retention requests, which we review against applicable security and legal obligations. Provider-side records follow the applicable provider policy and contract; no account-specific retention exception is asserted here.

7. Young users

Users under 18 should review this policy with a parent or guardian and confirm guardian consent during registration. We limit collection to what is needed for study and application support.

8. Security and complaints

We use access controls, password hashing, rate limits, encrypted backups, upload validation and audit logs. No system is risk-free. Contact hello@drforest.ai to exercise your rights or report a concern.