Student privacy
XYSHIMA explains the account, learning, support and legal-preference data it processes, why it is needed, the providers involved, retention principles and user rights.
TRUST CENTER
Clear safeguards. Honest limits. No borrowed badges.
Students and parents should be able to understand what XYSHIMA does with data, where AI is used, how younger users are protected, and what the platform can—and cannot—promise.
Privacy informationAI disclosureGuardian authorisationHonest marketingHuman support
AT A GLANCE
What XYSHIMA does today.
Age-aware access
Independent accounts are not permitted for users under 14. Users aged 14–17 require parent or legal-guardian authorisation, including for paid subscriptions.
Visible AI use
Students are told when AI is involved. Tutor answers, generated practice and learning estimates are guidance—not official grades or guaranteed academic outcomes.
Safer learning design
Guided tutoring is designed to ask for attempts, provide hints and diagnose misunderstandings before revealing a complete answer.
Security controls
Production access uses authentication, server-side controls and restricted database permissions. AI-provider credentials are kept server-side rather than exposed in browser code.
Correction and reporting
Students can report questionable AI questions, responses and flashcards. Important academic information should still be checked against teachers and official course materials.
Safer Study Groups
Peer chat is invitation-only and group-only for 2–10 people: no private messages, public search or random matching. Under-18 access requires guardian approval; mixed-age classes and teachers require verification and fresh roster approval. AI is absent until every member agrees.
Honest marketing
XYSHIMA does not promise grades, invent student outcomes or present paid endorsements as independent recommendations. Testimonials are published only when they come from real users with appropriate permission.
Trust should be inspectable.
These pages describe the current rules and safeguards behind the service. They are the source of truth—not a decorative badge row.
DATA & AI
What may be processed to provide the service.
Learning context
Subjects, curriculum, uploaded materials, notes, attempts, confidence, timing, review activity, tutor conversations and learning-model outputs may be used to personalise study support.
Specialist providers
XYSHIMA currently identifies Supabase for authentication/database services, Cloudflare for hosting/security, OpenAI for AI functionality and PayPal for payments.
Your choices
Depending on applicable law, users may request access, correction, deletion, restriction, objection or portability, and may withdraw consent where processing relies on consent.
AI limits
AI can hallucinate, miscalculate or misunderstand a syllabus rule. No automated system can guarantee zero errors, and important information deserves independent verification.
Strong marketing should still tell the truth.
Benefits, not guarantees
Marketing may explain how XYSHIMA helps students organise study, diagnose weak areas, practise and review. It must not imply that using the platform guarantees a particular grade, university offer or exam result.
Real social proof
Product feedback is private by default and is not turned into a testimonial without a separate agreement. Published testimonials and outcome claims must be attributable to genuine users and presented with enough context to avoid misleading impressions.
Sponsored content is labelled
If XYSHIMA pays or otherwise compensates a creator, reviewer or partner to promote the platform, that relationship should be disclosed clearly so audiences can judge the recommendation with the right context.
Respect the audience
Campaigns should reflect the students being addressed without relying on cultural, gender or academic stereotypes. Messaging can be adapted to qualifications, exam calendars and local context without exploiting fear or pretending every learner has the same needs.
No third-party certification is claimed yet.
XYSHIMA does not currently claim SOC 2, ISO 27001, COPPA Safe Harbor, Digital Promise certification, or any other independent trust badge. If XYSHIMA earns a credential, this page will identify the awarding organisation, scope and validity clearly. Legal alignment and internal safeguards are not presented as independent certification.
CONTACT & ACCOUNT RIGHTS
Ask a question or exercise a privacy right.
Signed-in users can download account data and submit a tracked privacy request from Settings → Data & privacy. You can also email support@xyshima.com for privacy, safety, billing or security questions.