Privacy policy
1. Who we are
Nooly AI is a study assistant for university students. It is run by Adam Vaughan ("Nooly AI", "we"). We decide how your data is used, so we are the owner of the database under Israel's Privacy Protection Law, and the controller under the EU GDPR where it applies.
Questions or requests about your data: bloomstudy.support@gmail.com. We answer within 30 days.
Nooly AI is an independent product. It is not made, approved or endorsed by your university or by Moodle.
2. What we collect
We collect only what Nooly AI needs to work, plus feedback you choose to send. You are not legally required to give us any of it, but without your account and course material Nooly AI cannot work.
| Data | Where it comes from | Why we use it | How long we keep it |
|---|---|---|---|
| Account: name, email, login details | You, when you sign up | To give you an account and contact you about it | Until you delete your account |
| Waitlist: email, and if you give them your name, school and whether you are a student or staff | You, when you join the waitlist | To email you when Nooly AI is ready for you | Until Nooly AI opens for you, or sooner if you ask us to remove you |
| Course files: slides, PDFs, documents, YouTube links and their transcripts | You upload them, or the Nooly Sync for Moodle extension syncs them from your Moodle | To answer your questions with citations, and to build your study plan | Until you delete the file or your account |
| Course details: course names, weekly sections, assignment titles and due dates, submission status | The Nooly Sync for Moodle extension, from your Moodle | To organise your courses and show deadlines | Until you delete the course or your account |
| Your own grades and teacher feedback | The Nooly Sync for Moodle extension, from your Moodle grade pages | To show your progress and find gaps in your understanding | Until you delete the course or your account |
| Chats, highlights, pinned files, folders | You, while using Nooly AI | To keep your history and show it back to you | Until you delete them or your account |
| Study plans, topic mastery and coaching results | Generated by Nooly AI from your files and activity | To build your roadmap and coach you | Until you delete the course or your account |
| Search text for your files (text extracts and embeddings) | Made by Nooly AI from your files | To find the right passages when you ask a question | Deleted with the file |
| Feedback, bug reports, answer ratings and corrections, optional screenshot | You, when you send them | To find and fix problems and improve answers | Until the end of the beta, then deleted or anonymised |
| Usage analytics (only if you turn it on) | Nooly AI's servers record which features you use | To learn which features help | 12 months |
| Technical logs: IP address, browser type, error messages | Our hosting provider, automatically | To keep Nooly AI running and secure | 30 days |
We never collect your Moodle or university password, other students' grades or files, class lists, or discussion forums other than your courses' announcements.
3. The Nooly Sync for Moodle extension
The Nooly Sync for Moodle browser extension syncs your courses from Moodle using your own logged-in session, only on a Moodle site you choose to allow. It syncs when you start a sync, and also automatically about once an hour while Nooly AI is open in your browser. Automatic sync is on by default, and you can turn it off in the extension's panel.
- Signing in: you sign the extension in to your Nooly AI account from its panel, either as the account already open in Nooly AI or with your Nooly AI email and password. Your password goes straight to Nooly AI to sign you in and is never stored by the extension. The extension keeps a Nooly AI sign-in session in your browser until you sign it out.
- It reads: your course list, each course's sections and files, assignment instructions, attached files, due dates and your submission status, your own grades and teacher feedback, and course announcements.
- It never reads: your password, other students' work or grades, discussion forums other than announcements, class lists, messages, or lecture recordings. It never submits, posts or changes anything in Moodle.
- Moodle records it: when the extension downloads a file, Moodle logs that you viewed it, and may mark it as viewed in your course progress. Your lecturers and university can see these records, as they can for any file you open.
- You stay in control: you can turn off automatic sync, stop syncing, disconnect the extension, or delete synced courses in Nooly AI at any time.
Course materials belong to your lecturers or university. We keep your copy private to your account, for your own study only. We never share it with other students, publish it, or use it to train AI models.
4. AI and other service providers
To answer you, Nooly AI sends parts of your course files and your questions to the providers below. They process it only to provide their service to us, under contracts that limit what they can do with it. We do not sell your data or use it for advertising.
| Provider | What it does for Nooly AI | What it sees | Where |
|---|---|---|---|
| Supabase | Database, file storage and login | Everything in your account | EU (Frankfurt) |
| Vercel | Runs the Nooly AI website and servers | Requests and technical logs | United States |
| OpenRouter, and the AI model providers it routes to (currently Anthropic and Google models) | Writes chat answers, study plans and coaching | Your question and the course passages relevant to it | United States, plus each model host's country |
| OpenAI | Turns course text into search embeddings | Text extracted from your files | United States |
| Cohere | Ranks search results by relevance | Your question and candidate passages | United States and Canada |
| Tavily | Web search, when an answer needs sources beyond your files | The search query | United States |
| Inngest | Runs background jobs such as processing a new file | Job details and IDs | United States |
| PostHog (only if you turn analytics on) | Usage analytics | Feature names, counts and IDs, never message text, file names or grades | EU |
We list changes to these providers on this page before they take effect.
5. Sharing, storage and security
Who sees your data. Only you, the providers above, and the few Nooly AI team members who need it to fix a problem you reported or to keep Nooly AI secure. We do not share your data with your university, your lecturers or other students. We disclose data to authorities only when the law requires it, and we tell you when we are allowed to.
Storage outside Israel. Our providers store and process data outside Israel, including in the United States and the EU. We use providers that commit by contract to protect it at a level the law allows.
Security. Data is encrypted in transit and at rest, each account can only reach its own data, and staff access is limited and logged. No system is fully secure. If a serious breach affects your data, we will tell you and the Privacy Protection Authority as the law requires.
Retention and deletion. We keep your data as long as your account is active. If you do not sign in for 12 months, we email you and then delete the account 30 days later. When you delete a file, course or your account, we delete it from our systems within 30 days, and from backups within another 30 days.
6. Your rights and choices
- See and correct your data. You can see almost everything in Nooly AI itself. You can also ask us for a copy, or to correct anything inaccurate.
- Get a copy. Email bloomstudy.support@gmail.com from your account's address and we send you your files, chats and study plans.
- Delete it. Delete single files, chats or courses at any time, or your whole account in Account settings, Delete account.
- Analytics. Off unless you turn it on, and you can turn it off at any time in Privacy settings. Saying no limits nothing in Nooly AI.
- If you are in the EU, you also have the GDPR rights to restrict or object to processing and to complain to your local data protection authority.
- Complaints. You can complain to Israel's Privacy Protection Authority.
Age. Nooly AI is for people aged 18 and over. We do not knowingly collect data from anyone younger, and we delete it if we find out.
Cookies. Nooly AI uses only the cookies needed to keep you signed in. We do not use advertising or tracking cookies, and analytics is sent from our servers, not from your browser.
Changes. If we change this policy in a way that matters, we tell you in Nooly AI or by email before it takes effect. Last updated: 24 October 2026.