In short
- We collect what Navri needs to work: your account, your course material, your study activity, and what you send to Navi.
- We don’t sell your information, show ads, or use advertising trackers.
- To run Navri we use service providers. Some of them process your information outside Canada, mainly in the United States: Supabase, Cloudflare, Anthropic, OpenAI, Google, Stripe (payments) and Resend (account emails).
- Usage statistics are off unless you turn them on.
- You can download, correct and delete your information yourself, and ask us for anything else.
1. Who is responsible
Navri is run by an individual based in Alberta, Canada. Navri is not an incorporated company. The Navri team is responsible for how Navri handles personal information and answers privacy questions.
Contact: support@navriapp.com. You can also use Ask a privacy question.
The privacy laws that apply to Navri include Alberta's Personal Information Protection Act (PIPA) and, where it applies, Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).
2. What we collect and why
| Information | Why we need it | Where it’s kept | How long |
|---|---|---|---|
| Account: email address, name, and a password (stored only in scrambled, hashed form by Supabase). With “Continue with Google”: your Google name, email and profile picture. | To create your account, sign you in and keep it secure. | Supabase | Until you delete your account |
| Course material: files you upload (PDF, Word, PowerPoint, text, audio), pasted text, YouTube links, course names and test dates. | To build your Course Brain, plans, lessons, notes and questions. | Supabase database and Supabase Storage (files) | Until you delete the file, the course or your account |
| What Navri makes for you: notes, lessons, practice questions, flashcards, chat history with Navi (the last 40 messages per course). | So your study tools are there next time. | Supabase, and a copy on your device | Until you delete it or your account |
| Study activity: answers, scores, mastery, mistakes, study sessions, XP and plans. | To work out what you should study next. | Supabase, and a copy on your device | Until you delete it or your account |
| Messages, photos and screenshots you send to Navi. | To answer you. Photos are read by the AI and are not stored by Navri. | Sent to our AI provider to produce the answer (see below) | Messages: in your chat history. Photos: not kept by Navri |
| Pictures in material you upload: photos or screenshots of notes, scanned PDF pages, and pictures inside slides and documents. | So Navri can study from handwriting, scans, diagrams, graphs and tables that have no text. The AI transcribes them; the transcription is labelled “read from the image by AI”. | Each picture or page image is sent to our AI provider to be read (see below) | The transcription is kept with the material until you remove it or delete your account; the uploaded file stays in your private file storage as before |
| AI usage records: which feature, the AI model, how much text was processed, the estimated cost, success or failure, and daily counters. | To apply daily limits fairly and control costs. | Supabase | Daily counters: 400 days. Usage log: until you delete your account (automatic 25-month deletion is being set up) |
| Usage statistics (optional): short event names such as “finished a quiz”, with small details like the screen. | To see where Navri helps and where students get stuck. | Supabase | Only if you turn them on. Until you delete your account (automatic 13-month deletion is being set up). |
| Feedback, reports and requests you send us, including screenshots, your device type, browser, screen size and app version, and the AI answer if you include it. | To fix problems and answer you. | Supabase | Feedback: until you delete your account. Requests: 3 years after they’re resolved, as a record that we answered |
| Billing (if you buy Pro): Stripe customer number, subscription status and dates, and records that the payer confirmed their age or guardian role and the renewal terms. Stripe collects your card and billing address. | To provide Pro, answer billing questions and meet tax and accounting rules. | Supabase (status only) and Stripe (payment details) | As long as tax and accounting law requires (generally 6 years in Canada) |
| Policy acceptances and privacy choices: which version you accepted, when, and changes to your choices. | To show what you agreed to, and to respect your choices. | Supabase | 3 years after your account ends |
| Technical information: IP address, browser and device details, and the pages requested. | To deliver the website, keep it secure and stop abuse. | Our hosting and database providers’ logs | Set by each provider’s log schedule |
We collect this from you, from your use of Navri and, if you choose Google sign-in, from Google. We don't buy information about you from anyone.
3. Signing in with Google
If you choose Continue with Google, Google shares only basic profile information with Navri, through the standard sign-in permissions openid, email and profile:
- Your name, used as your display name in Navri (you can change it).
- Your email address, used as your account login, for account and billing emails, and to reply to you.
- Your Google account ID (a number that identifies your Google account), used only so the same Google account always signs in to the same Navri account.
- Your profile picture link, if your Google account has one. Navri stores it with your account details in Supabase.
Navri does not ask for or access your Gmail, Google Drive, Google Calendar, Contacts, Photos, YouTube account or any other Google service, and never sees your Google password. Sign-in itself is handled by Supabase (our sign-in provider) using Google’s standard OAuth process.
Google account information is used only to create your account, sign you in, keep the account secure and contact you about your account. It is not sold, not used for advertising, not shared with anyone except the providers needed to run Navri (listed below), and not used to train AI models. Navri’s use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.
Removing it: deleting your Navri account (Settings → Privacy) deletes your Google-provided name, email, Google account ID and picture link from Navri’s active systems, as described in the retention section. You can also disconnect Navri from your Google account at any time at myaccount.google.com/permissions; that stops future Google sign-ins but doesn’t delete your Navri account by itself.
4. What we don’t do
- We don’t sell or rent personal information.
- We don’t show ads, and we don’t use advertising or cross-site tracking cookies.
- We don’t build profiles of students for advertising.
- We don’t train our own AI models on your material. Our AI providers’ rules are explained below.
- We don’t make automated decisions about you that have legal or similarly important effects. Readiness scores and plans are study guides only.
6. AI providers and your material
When you use an AI feature, Navri’s server sends what that feature needs to our AI provider and sends the answer back to you. We don’t send your name or email address with it.
- Anthropic (Navi’s default AI). Anthropic’s commercial terms say it may not train its models on content sent through its business services. Its published retention rules for business API use say inputs and outputs are deleted within 30 days, except where a request is flagged for breaking its usage policy (then kept up to 2 years) or the law requires longer.
- OpenAI (voices and transcription). OpenAI says data sent through its API isn’t used to train its models unless the customer opts in, which Navri hasn’t. Text sent for AI voices may be kept up to 30 days for abuse monitoring.
These are the providers’ current published rules (checked October 2026), not promises Navri can make for them. If we change AI providers or settings, we’ll update this policy first. More in the AI Usage and Accuracy Policy.
7. Processing outside Canada
Several providers above process information in the United States, and some in other countries where they operate. Information stored or processed outside Canada is subject to the laws of those countries, and their courts, police or national-security authorities may be able to get it under those laws.
We use providers outside Canada because they run the services Navri depends on (AI, hosting, sign-in and payments). If you’d like more detail about these providers, how we chose them, or our written policies about them, contact us at support@navriapp.com.
8. How long we keep information
We keep information only as long as we need it for the reasons above, or as long as the law requires. The full schedule is in the Data Retention and Account Deletion Policy.
9. Your choices and rights
You can, at any time:
- Download your study data straight away: Settings → Privacy → Export my data.
- Ask for a copy of all the personal information we hold about you, including records the export doesn’t include (usage records, requests, billing records): Request my information.
- Correct information that’s wrong: most of it you can edit in Navri; for anything else, ask for a correction.
- Delete a file, a course, all your study data, or your whole account yourself (Settings → Privacy). See the Data Retention and Account Deletion Policy for what happens.
- Change your choices about usage statistics and email: Privacy choices (in Navri). Withdrawing a choice doesn’t affect what was done before, and may mean a feature that depends on it stops working.
- Complain: tell us first and we’ll try to fix it (how complaints work). You can also contact the Office of the Information and Privacy Commissioner of Alberta or the Office of the Privacy Commissioner of Canada.
We answer requests within 30 days. If we need longer, or can’t give you something (for example, because it would reveal someone else’s information), we’ll tell you why. We may need to confirm it’s really you before we act.
10. How we protect information
Information travels between your device and Navri over encrypted HTTPS connections. Database rules make each account’s information available only to that account; Navri’s staff tools show only what people chose to send us (like feedback). AI and payment keys stay on the server and are never sent to your browser. Sign-in and stored data are handled by Supabase’s security programme.
No system is perfectly secure. Please use a strong password and never share your sign-in codes.
If a breach creates a real risk of significant harm to anyone, we’ll report it to Alberta’s Information and Privacy Commissioner and notify the people affected as the law requires.
11. Students under 18
Navri is for students 13 and older, and students under 18 need a parent or guardian’s agreement. Read the Child and Teen Privacy Policy for the details, written for students and for parents.
12. Changes to this policy
If we make a change that matters (a new kind of information, a new purpose, or a new kind of provider), we’ll tell you in Navri before it takes effect and ask you to accept it. If you don’t accept, your study data is not deleted: you can still export it or delete your account. Small fixes (like wording) are listed with a new date.