Privacy Policy
In short
Wingit reads your own courses from your school's Canvas after you connect it, keeps them current by reading them again about once an hour while your school sign-in is stored and you have used Wingit in the last 90 days, and shows them to you in one place. We keep what you give us and what your courses contain, so the app can work: your account, an encrypted copy of your school sign-in, an index of your course material and copies of course files, your conversations, attachments and documents with Robin, notifications, your support requests, usage records and your billing records. Your school sign-in is sealed so that only a separate part of Wingit, which is not reachable from the internet, can open it; our main application and our database hold only a sealed copy that they cannot open (section 12). We use one model provider, Sail Research, to power Robin. We do not sell your information, we do not share it for advertising, and we do not use it to train artificial intelligence models. You can delete your account yourself at any time from Settings; section 10 lists what remains. Questions and requests go to privacy@wingit.school, or to Support in Settings.
1. Who we are
Wingit Education LLC ("Wingit", "we", "us"), a Delaware limited liability company, operates the Wingit service at wingit.school. We are the controller of the personal data described in this policy.
Contact for privacy questions and requests: privacy@wingit.school. Our postal address is in section 15.
Wingit is not affiliated with Instructure (the maker of Canvas), with your school, or with any lecture-video provider your school uses. Your school is not a party to this policy. We do not send your school information about you, except the requests your connection makes to it: reading your courses (including the regular background refresh described in section 3.2), opening course tools and quizzes, and signing you out when you ask. Your school sees those requests as activity on your own account, coming from our servers' network addresses.
2. Who Wingit is for
Wingit is for students at colleges and universities who want to read their own coursework in one place. You must be at least 16 years old to use it, and you confirm that you are when you create your account (or, for an account we set up for you, when you first set its password). Wingit also has affiliate-only accounts, which people who promote Wingit create from an invitation and which need no school. The affiliate program, including affiliate-only accounts, is open only to people who are at least 18 and live in the United States, and they confirm both when they join. Wingit is not directed to children under 13 and we do not knowingly collect information from them. If you believe a child under 13 has an account, tell us at privacy@wingit.school and we will delete it.
3. What we collect
3.1 Information you give us
| What | Details | Why |
|---|---|---|
| Account details | Display name, username, email address, your password, which we store only as a one-way hash (Argon2id), and, if you give one, a referral code. When you create your account (or first set the password of an account we set up for you), we record that you confirmed you are 16 or older and agreed to our Terms of Service and this policy, with the time and the version you agreed to. You can change your name and email address in Settings. A new email address takes effect only when you open the confirmation link we send to it, and until then we keep it with that link; once it has changed, we tell your old address, showing the new one partly hidden. | To create and secure your account, to send account email, and to show what you agreed to. |
| Starting a sign-up | We email you a link that carries the details you entered (with your password already hashed) in encrypted form; we keep those details only inside that link, not in your account records. We keep the email record, without the link once it is sent, for ninety days, even if you never finish signing up. | To confirm the email address is yours before we create the account. |
| Two-step sign-in, if you turn it on | A secret for your authenticator app, encrypted with AES-256 under a key kept outside our database, and eight one-time recovery codes, stored only as hashes. | To protect your account. |
| School connections | A name you choose, your school's Canvas address, its sign-in address, and, once you ask for one, a private calendar link for your deadlines, which we store only in hashed and encrypted form (section 12.2). Anyone with that link, including the calendar service you subscribe with, can read the assignment titles, due dates, links and descriptions in it; you can replace it in Settings. | To know which school to read, and to let you subscribe to your deadlines. |
| Questions to Robin, attachments and documents | The text of your conversations; files and images you attach (images are re-saved as JPEG at no more than about 6.5 megapixels and 4096 pixels on the longer side, with embedded metadata such as location removed; PDFs are kept exactly as uploaded, including any details stored inside them such as the author's name, up to 20 MB and 200 pages; up to 100 MB in total per account); the documents you create or edit; and the summaries Robin writes of long conversations. | To answer you and to keep your work where you left it. |
| Feedback on Robin's answers | A thumbs up or down, kept together with the question and the answer you rated, until you take the rating back, delete the conversation or delete your account. The people who maintain Robin may read rated questions and answers. | To find answers that went wrong and improve Robin's instructions. |
| Email preferences | Whether you get email updates (deadline changes, new posts and finished Robin drafts) and product news from Wingit. Both are on when you create your account; you can turn each off in Settings at any time, with the unsubscribe link at the bottom of a product news email (no sign-in needed), or, where your email app offers it, with its unsubscribe button. Email about your account, your plan and billing, and notices about our terms or the service are sent whatever these settings are. | To send the updates you have not turned off. |
| Support requests | What you write when you open a support request in Settings (its topic, subject and messages), our replies, its status, and whether and when you allowed a read-only view of your account for it (section 3.4); and anything you send to our support address. Our support staff can also write to you first, which starts a request in Settings. Staff can add notes to a request for each other, which you do not see. | To help you. |
3.2 Information we read from your school
When you connect a school, you sign in yourself on your school's own sign-in page (section 3.3). Wingit then reads the courses that sign-in can see, and reads them again about once an hour for as long as your school sign-in is stored, so your courses stay current even when you are not using Wingit. This continues until your school ends the session, you sign out of the school or remove it in Settings, your plan stops covering the school (section 9), or you delete your account. It also pauses after 90 days in which you have neither signed in to Wingit nor used it through an assistant you connected, and starts again the next time you do either. We read the same things you would see in Canvas and keep a searchable copy:
- your courses and groups, including past courses you can still see, with terms and current scores;
- assignments, quizzes and discussions, including assignment instructions and rubric criteria (not graders' comments or assessments), your own submission status, scores, grades and late or missing marks, and, for quizzes you have submitted, the questions, your answers and whether each was marked correct;
- pages, files (we keep a copy of each file and the text inside it, including the speaker notes in slide decks), announcements, syllabi and module lists;
- lecture recordings' titles and their transcripts (we stream lecture video to you without storing it);
- discussion posts and replies as they appear in your courses, which include what instructors and classmates wrote. We store the text of posts, not their authors' names; names are shown when you open a discussion, and Robin sees them when it reads a discussion for you;
- your Canvas profile name and time zone, to greet you, to tell Robin who it is talking to and to show dates in your time zone, and your Canvas user id, which we use only to compute the keyed record in section 8. We keep that record, not the id itself, and we remove the ids Canvas attaches to people from the copy of your course list that we keep.
We also read, without storing them, the people in your courses (names, roles, groups and profile pictures, as Canvas shows them to you), when you open a course's People list or when Robin or an assistant you connected asks for them.
This copy is the index. It includes information about other people to the extent it appears in your courses, exactly as your school shows it to you. We do not build profiles of those people. The index is used only to serve you: it is shown to you, read by Robin and our model provider when you ask Robin something (section 5), read by any assistant you connect, and, within our tools, seen by our staff only through a logged, read-only support view (section 3.4). Summaries Robin makes from course text may be reused for other students who have exactly the same text, without anything about you (section 5).
3.3 Your school sign-in session
When you connect a school, you sign in on your school's own sign-in page. It is shown to you from an isolated browser that runs on our servers just for that sign-in (section 12.1). What you type there goes to your school. We do not record, log or store your school password or two-step codes.
When your school confirms you are signed in, we keep your signed-in session: the cookies a browser would send to your Canvas address and to the sign-in address you gave us, and the user-agent string of our sign-in browser (the line that names its browser type and version). Cookies from any other site, and anything else that browser stored, are discarded. The session is sealed with encryption that only a separate Wingit service, the secure transport, can open. Our application, our database and our administrative tools hold only the sealed copy, and no feature of Wingit shows or exports your school session to anyone, including our staff. Section 12.1 explains how this works.
We use the session only to read your courses as described in section 3.2, to open course tools, lecture players and New Quizzes quizzes that need a browser, and to sign you out of your school when you ask. Short-lived access tokens that your school's lecture and quiz tools issue are held by our application in memory only, and are encrypted when briefly handed from one of our application servers to another.
The session stays stored until your school ends it, you sign out of the school or remove it in Settings, it is deleted thirty days after your plan stopped covering the school (section 9), or you delete your account (section 10).
3.4 Information created when you use Wingit
| What | Details |
|---|---|
| A record of which school account you signed in as | A keyed hash of your school's address and your Canvas user id (not the id itself), your school's Canvas address, the account that first linked it, every Wingit account it has been linked to (with when each first and last linked it), when it was first and last seen, and, once it has been on a Wingit account that had a free trial of a paid plan, when and on which account. Removing a school does not erase it. See section 8. |
| Free-trial records | When a free trial starts, and for each card used during one: a keyed hash of the fingerprint Stripe derives from the card (never the card itself), with the account and subscription that first used it and when. For each trial: whether it was granted or ended at once, and why (the card, a school account or the Wingit account had already had one), with the card's keyed hash and the dates. See section 8. |
| Usage records | One record per Robin question and per background Robin task (a conversation summary, a course summary, a practice check, a queued draft), per document export, per tool call by an assistant you connected (with the tool's name), per text-recognition job and per lecture download. Each holds timestamps, the model used, token counts and cost, and, for questions, their length, never their text. |
| Sign-in sessions | A hash of your session cookie, its expiry, and whether two-step sign-in was completed. We do not store your IP address or browser details with it. We also keep when your account was last used (your last sign-in, or the last request from an assistant you connected), to the hour, so that the regular reading of your courses can pause when you stop using Wingit (section 3.2). |
| Your progress through the welcome steps | The furthest welcome step you reached, the plan you picked on the way, and when you finished the welcome steps or put them off. |
| Limits on attempts | To slow down password guessing and abuse, we count sign-ups, password-reset requests, and wrong passwords and codes, by network address, by username and by account, for five to fifteen minutes. These counts are held only in memory, in a cache server that never writes them to disk, and expire on their own. Your network address is never written to our database. |
| Notifications | Deadline changes, new assignments, announcements (up to 500 characters of their text) and notices that a queued Robin draft is ready (with the start of your question), whether you have seen them, and whether they were emailed to you. |
| Email we send | The address, subject and body of each email we send, kept for ninety days for delivery, retries and limits on how often we send. This includes sign-up links sent to addresses that have no account yet, notices to an address's owner that someone tried to sign up with it, confirmation links sent to a new address you give us, notices to your current address that a change of email was asked for and to your old address that it went through, emails about your support requests, notices that your account was suspended or reinstated, emails about your plan (when a trial or plan starts, changes, is kept or is cancelled; when a trial ends early; when an extra school is added, set to end or ends; two days before a trial's first charge; renewal reminders; and notice of a price change), and notices from Wingit (below). Once a sign-up, password-reset, email-change or confirmation email is sent, our copy no longer contains its link. |
| Notices from Wingit | Notices we send to all accounts or to a group of them, by email, in the app or both: essential notices about your account, our terms or the service, and product news. We keep which notices were addressed to you, whether the email went out or why it did not, and when you closed a notice in the app, so it stays closed on every device. Past notices are listed in Settings. |
| What you agreed to | Each version of our Terms of Service, this policy and the Affiliate Terms that you agreed to, with the time, and whether you agreed at sign-up, in the Earn page or through a notice in the app that asked you to. |
| Background work | Records of course syncs, text recognition, lecture downloads, conversation summaries and queued Robin drafts, including the request, the course passages and conversation excerpts it used, and the result. Kept for 14 days. |
| Answers waiting to be saved | A finished Robin answer, held on our servers until it is saved into your conversation, so it is not lost if you close or reload the page. At most 50 at a time. |
| Receipts of Robin's edits to your documents | The document's title, the edit note and short excerpts of the changed text, so a change can be checked and undone. Kept for 30 days. |
| Support views | If you allow it on a support request, a member of our support staff can open a read-only view of your account while that request is open. You can withdraw your permission in Settings at any time, and it ends when the request is resolved. An administrator can also open a view without a request, for example to investigate a problem or abuse. Either way, the staff member sees what you would see (your courses, grades, conversations, documents and attachments), and Wingit may read fresh material from your school for that view. The view ends after thirty minutes and cannot change anything. Its opening is recorded in our audit log with the staff member who opened it and, for a request, when you allowed it. |
| Technical logs | Which school address a request went to and whether it succeeded, which sites the sign-in browser contacted, and errors. They are designed not to record your cookies, your passwords or the contents of the pages you read, although an error message can include details such as an email address. Kept as long as we need them to keep Wingit secure, find and fix problems and prevent abuse, and no longer than 90 days. |
3.5 Billing and affiliate program information
We use Stripe to take payments. Stripe collects your card details directly; Wingit never sees your card number. When we create your Stripe customer record we give Stripe your name, email address and Wingit account number. We keep your Stripe customer id, your subscription status, plan and billing dates, your invoices (amounts, tax, refunds and Stripe's links to them), any top-ups you buy, the records of payment events Stripe sends us (which can include your name, email address, billing address and your card's brand and last four digits), and a fingerprint Stripe derives from your card, which we use to detect self-referrals in the referral program and from which we compute the keyed hash that gives each card only one free trial (section 8); for that rule we keep the keyed hash, not the fingerprint itself.
When you start a paid plan or a free trial, keep a plan that was set to end, or add or keep an extra school, we keep a record of your agreement to automatic renewal, because the law asks us to be able to show it: the exact renewal terms you were shown and their version, whether they were for a plan or an extra school, the plan, price, billing period, any trial and the date of the first charge, the time zone your browser reported (so the dates in the terms and in our emails are in your time), where you agreed (the welcome steps, the pricing page or Settings), when you agreed, and the Stripe checkout and subscription it led to. For each extra school we also keep its subscription's status, price, billing dates and latest invoice, and, once it is set to end, whether you dropped it or it ended because of a change to your plan. We also keep a record of each email we send about your plan (its kind, the plan, price and dates it stated, and, if you cancel and pick a reason, that reason), so we never send one twice; and, when a price change applies to your plan, when we told you and when the new price started. If our staff refund a payment, our audit records keep the amount, the reason and the staff member's note.
If you join the affiliate program (the Earn page), we keep: when you joined and which version of the Affiliate Terms you agreed to (for members from before the Earn page, when you accepted the referral terms); when you confirmed that you are 18 or older and that you live in the United States, and which version of the Affiliate Terms was on the page then; whether your account is an affiliate-only account and, if it came from an invitation, which one; any terms that differ from the program defaults; your links (their endings, names, where you said you would share them, the page each opens and any campaign tags you add) and your code; counts of visits to each link by hour, and each link's total; the accounts that signed up through your links or code, which link or code they used, and the share and earning period that applied; the commissions earned, adjustments and payouts; whether your membership or a link was paused, and the reason we gave; when you last opened the Earn page; and the status of your Stripe Connect account (country, whether payouts are enabled, what Stripe still requires, and whether we are reviewing it because Stripe reports it outside the United States). We give Stripe your email address, and the United States as the country, to open that account. Your identity documents, bank details and tax forms go to Stripe, not to us. The Earn page shows you counts and amounts only: it never shows who signed up through your links, with times rounded to the hour.
If you open someone's affiliate link, Wingit counts the visit for that link in that hour and leaves the wingit_ref cookie (section 3.6). We do not store your network address, your browser's description or the page you came from with the visit. To count each visitor once a day, we keep, for about two days, a keyed one-way value made from the day, your network address (for an IPv6 address, its first half) and your browser's description, and then delete it; to limit automated traffic we also count visits from each network address for up to an hour. Visits from search engines, link previews and automated tools are counted only as filtered, with no cookie. If you then create an account, your account records the member who referred you, through which link, and whether you typed a code or came from a link. Before you create the account, the sign-up page shows the code that will be applied and lets you remove it. The member never learns your name, username or email address, and your own pages never say who referred you. The member does see, for each account made through their link or code and without naming it: roughly when it was made (to the hour), whether it started a trial, each payment's date and what they earned from it, and any refund; next to the name the member gave the link they shared, which may be one they made for a single person. A page that opens a link without your tapping it does not replace a link you opened in the last three days. To spot unusual referral patterns, we also count, for each member, how many of the accounts made through their links or code added a school or asked Robin something in their first 14 days, and how many pay with the same card as another of those accounts (section 4). Only our staff see these counts, never the member, and they do not name you.
If a Wingit administrator invites you to the affiliate program, we keep the invitation: a label, the name and email address the administrator entered (if any), when it expires, how many times it may be used, its terms, how many times it was emailed, and which accounts used it and when (kept even if that account later takes another invitation or is deleted). An invitation made out to an email address can only be taken by the account with that address. We email it to you only if the administrator asks us to. We remove the name and email address 90 days after the invitation is used up, expires or is withdrawn.
If you apply to the affiliate program from the form on our affiliates page, without a Wingit account, we keep your application as a support request: your name, your email address, the links you give us (one to five), the audience size you choose and the note you write, if any, when you confirmed that you are 18 or older and live in the United States, and our decision, who made it and when, with the invitation we sent you if we accept. We email you a receipt, which repeats only your name, and, if we decline, a notice with any message our staff add. Our support staff read applications. To limit abuse we count applications for a short time by network address and by a one-way value made from your email address; we do not store your network address or browser details with the application. We delete an application, with its messages, 90 days after we decide on it, or after 90 days without activity while it is undecided, or sooner if you ask.
3.6 Cookies
Wingit sets three cookies and no others:
| Cookie | Purpose | Lifetime |
|---|---|---|
wingit_session | Keeps you signed in. Marked HttpOnly and SameSite=Strict, and Secure when the site is served over HTTPS. | Eight hours. |
wingit_theme | Remembers whether you chose the light or dark look. Holds only the word "light" or "dark". | One year. |
wingit_ref | Set only when you open a Wingit affiliate link (an address beginning /r/) in a browser, not for search engines, link previews or pages that load the link in the background. It names the link and the time you opened it, signed so it cannot be altered, and nothing about you. If you sign up for Wingit in that browser while it lasts, the member whose link it was is credited with the referral (Affiliate Terms, section 4), unless you type another code or remove it on the sign-up page. It is deleted once your sign-up form is accepted; when we email you a link to finish signing up, the referral travels sealed inside that link instead. Opening another member's link replaces it. Marked HttpOnly and SameSite=Lax, and Secure when the site is served over HTTPS. | Thirty days. |
Wingit stores nothing else in your browser: no local storage or similar. Apart from wingit_ref, which only records which affiliate link brought a browser to Wingit, we do not use analytics, advertising or tracking cookies, and we do not load third-party scripts, fonts or pixels. wingit_ref is set for anyone who opens an affiliate link, because crediting the person who shared it depends on it, and it holds nothing but which link was opened. Our content delivery and security provider (section 6) adds no cookies or scripts to our pages; if it ever has to check that a visitor is a person rather than automated traffic, it shows its own check page and can set its own cookie recording that the check was passed. Your school's sign-in page runs in our isolated browser, not in yours, so its cookies and scripts never reach your browser through Wingit. Payment pages are Stripe's own and follow Stripe's cookie policy. Because we do not track you across sites, we do not respond to "Do Not Track" signals; there is nothing to turn off.
4. Why we use your information, and on what legal basis
| Purpose | Information used | Legal basis (for people in the EEA and UK) |
|---|---|---|
| Running Wingit for you: signing you in, reading and indexing your courses (including the automatic refresh about once an hour while your school sign-in is stored), showing your week, notifications, search, lectures, documents. | Account details, school connections, the sealed school session, the index and cached course files. | Performance of our contract with you. |
| Answering your questions with Robin. | Your question and recent conversation (with its editable summary), files and images you attach, your saved Wingit documents when Robin needs them, the page you are looking at, your first name and time zone from your Canvas profile, your courses' names and ids, and the course material Robin reads to answer. | Performance of our contract with you. |
| Keeping your account and Wingit secure. | Password hashes, two-step secrets, session hashes, short-lived counts of sign-in, sign-up and reset attempts by network address and username, rate limits, audit records. | Our legitimate interest in keeping accounts safe and the service working. |
| Telling the owner of an email address when someone tries to sign up with it, and telling your current address when someone asks to change your account's email and your old address when it changes. | That email address, and the new one partly hidden. | Our legitimate interest in protecting accounts. |
| Recording that you confirmed your age and agreed to our terms. | The time and the version you agreed to, and, for the affiliate program, when you confirmed that you are 18 or older and live in the United States. | Our legitimate interest in showing what was agreed, and in keeping Wingit, and its affiliate program, to the people they are open to. |
| Recording your agreement to automatic renewal, and emailing you about your plan: when a trial or plan starts, changes, is kept or is cancelled, when a trial ends early, when an extra school is added, set to end or ends, two days before a trial's first charge, renewal reminders and price changes. | The renewal record and the records of those emails (section 3.5), your email address, and the time zone your browser reported. | Performance of our contract with you, and our legal obligations under automatic-renewal laws. |
| Sending notices about your account, our terms or the service, by email and in the app, and recording when you agree to a new version of a policy. | Your email address, which notices were addressed to you and which you closed, and what you agreed to (section 3.4). | Performance of our contract with you, our legal obligations, and our legitimate interest in showing what was agreed. |
| Emailing you product news from Wingit, unless you turn it off. | Your email address and your product news setting. | Our legitimate interest in telling you about Wingit; you can turn it off in Settings at any time. |
| Reviewing applications to the affiliate program. | What you put in the application (section 3.5) and, for a short time, counts by network address and by a one-way value made from your email address. | Steps you ask us to take before entering into a contract, and our legitimate interest in choosing who promotes Wingit. |
| Preventing abuse of free trials. | The keyed hash of your school account, your school's Canvas address, every Wingit account it has been linked to and which of them had a trial, the keyed hash of the fingerprint Stripe derives from each card used during a trial, the record of whether each trial was granted or ended early and why, and the related dates (section 8). | Our legitimate interest in offering a free trial once per person. |
| Measuring use and cost to apply plan limits, and seeing overall statistics about how Wingit is used. | Usage records, plan and subscription status. | Performance of our contract with you, and our legitimate interest in running and pricing the service. |
| Reusing summaries of course material for other students whose course contains exactly the same text. | The course text and the summary made from it, with nothing about you. | Our legitimate interest in keeping Robin fast and affordable. |
| Billing, taxes and the affiliate program: crediting referrals, paying members, and refusing self-referrals. | Stripe customer and subscription records, invoices, payment events, referral records. Affiliate records (section 3.5). To refuse self-referrals, a new account's email address, its sign-up request's Wingit session, the school account it connects and the card it pays with are compared with the referring member's, and the card also with the cards paying for the member's other referrals. | Performance of our contract with you, and our legal obligations to keep financial records. |
| Spotting unusual referral patterns in the affiliate program, so that our staff look at a member's account before paying them. | Counts for each member: referred sign-ups in a day against their usual day; how many accounts made through their links or code added a school or asked Robin in their first 14 days; how many of those accounts pay with the same card as another of them, or were refused as self-referrals; and how many visits to their links our filters did not count. Only our staff see these counts. They never name a referred person, and the member never sees them. | Our legitimate interest, and our members', in keeping referral rewards to real referrals. |
| Counting visits to affiliate links, crediting sign-ups to the right member, and keeping automated traffic out of the counts. | The wingit_ref cookie; hourly visit counts per link; for about two days, a one-way value made from the day, the network address and the browser's description; for up to an hour, a count of visits per network address. | Our legitimate interest, and the members', in counting referrals accurately. |
| Inviting people to the affiliate program. | The name and email address a Wingit administrator enters on an invitation, and the invitation's use. | Our legitimate interest in inviting the people we choose to promote Wingit. |
| Emailing you about your account (sign-up links, password resets, email confirmation and changes, password changes, replies to your support requests, and notices that your account was suspended or reinstated). | Your email address, and for a support email, the request's subject and our reply. | Performance of our contract with you. |
| Emailing you about deadline changes, new posts and finished Robin drafts, unless you turn it off. | Your email address, notifications (for a finished draft, the start of your question). | Our legitimate interest in keeping you informed about your own courses; you can turn it off in Settings at any time. |
| Improving Robin's instructions. | The thumbs you give answers, with the rated question and answer. We test changes to Robin only on our own and test accounts, and our evaluation tools refuse any other account. | Our legitimate interest in fixing wrong answers. |
| Answering support requests and legal requests, and investigating problems, abuse or breaches of our terms, including through the read-only support view (section 3.4). | What you send us and our staff's notes on it; account records and, through the support view, what you would see in Wingit, as needed. | Our legitimate interest in supporting you and in keeping Wingit safe, and our legal obligations. |
We do not use your information for advertising, we do not sell it, and we do not use it to train artificial intelligence models.
5. Robin and artificial intelligence
Robin is an assistant built on large language models that a third-party provider, Sail Research, runs for us. Robin currently uses open-weight models that Sail hosts: the GLM-5.3 family for answers, and DeepSeek-V4-Flash for checking practice answers. We will update this policy before we send your information to any other model provider.
What Robin sends to Sail. When you ask Robin something, we send Sail what it needs to answer: Robin's instructions; your first name and time zone from your Canvas profile; today's date; the names and ids of your active courses and a short map of what is indexed in them, with brief summaries of those items; a bounded selection of recent turns and the editable summary of earlier ones; your question; the page you are looking at; files, images and documents you attach or ask Robin to open, including your saved Wingit documents when Robin needs them; and the course material Robin reads to answer. That material can include your grades, submission status and quiz answers, the people in your courses (names, roles and groups) when Robin looks them up, and other people's posts as they appear in your courses, with the names of the people who wrote them. We also send a one-way code for the conversation so Sail can reuse work it has already done; it does not contain your account id or any other identifier in readable form. We do not send your Wingit account id, username, email address, school password or school sign-in session. If a request to Sail stalls, Wingit may send the same request again.
Images. Images and PDF pages you attach, or that Robin opens from your courses (including pictures on slides), are sent to Sail so a model can look at them. When the model answering you cannot read images, a separate model at Sail describes the image for it; that model receives only the image, its name and the start of your question, never the rest of the conversation. Files you attach stay in your account until you delete them in Settings or delete your account (section 9).
Your documents. When you ask, Robin can create and edit documents in your Wingit workspace, never at your school. When you ask Robin to revise a draft you have open, it receives the draft and a revision fingerprint so Wingit can apply the change to the right version and let you undo it. Wingit keeps a short receipt of each change Robin makes, including the document's title and short excerpts of the changed text, for 30 days.
Answers that survive a closed page. So an answer is not lost if you close or reload the page, Wingit keeps a finished answer on our servers until it is saved into your conversation. If you queue a longer draft, Wingit saves the background request (including the course material it uses) and its results so work can resume after a restart, and Sail holds the request until we collect the answer. We then notify you that the draft is ready. Background job records are removed after 14 days; the answer stays in your conversation until you delete it. The notice includes the start of your question; it stays in What's new, and is emailed to you if email updates are on, until you remove the school or delete your account.
Conversation summaries. For long conversations, Wingit sends older turns to Sail to write a summary, which we keep in your conversation so Robin can remember earlier decisions. You can edit the summary or delete the conversation. Deleting a conversation also deletes your ratings of its answers. It does not delete files you attached to it or its notices in What's new; you can delete the files in Settings, and both go when you delete your account. Background copies made to summarize or finish it are removed within 14 days.
Summaries shared between students. When you ask Robin to summarize a course page, file, lecture transcript or assignment, Robin sends that source's text to Sail. Wingit may reuse the resulting summary for any other Wingit student whose course contains exactly the same text, such as a classmate in the same course, so the same summary is not made twice. Shared summaries are made only from that source text, never from grades, submissions, discussion posts, conversations or anything else about you, and the titles and links shown with them always come from the student viewing them. A shared summary is removed when no connected account still has that text. One that was never finished is removed after 14 days, unless model work on it was already saved, in which case it stays until no connected account still has that text; until it is finished, it also records which account asked for it. If that account is deleted, an unfinished summary it asked for is removed, and no shared summary records it any longer.
Practice answers. When you check a practice answer, numeric comparisons run in Wingit. Text checks send the question, the reference answer and your response to Sail. Your response is not added to shared summaries or saved in check diagnostics.
Diagnostics. We keep diagnostics for answer checks and summary generation for 30 days, and a daily cleanup removes them after that. They contain item ids, validation results and performance counts, not your questions, answers or course passages. Cost records are kept separately (section 9).
How Sail handles your information. Sail Research is a United States company. Robin currently uses Sail without a country restriction, so processing may take place outside the United States. Sail's data processing agreement describes temporary storage with automatic deletion within 48 hours, subject to legal, dispute-resolution and standard-policy exceptions. Sail does not use your content to train models without consent, and we have not given it. We do not train Robin or any other model on your conversations or your course material.
Accuracy and limits. You are interacting with an AI system. Robin's answers can be wrong. Answers drawn from your course material list the items Robin read, so you can check them. Robin cannot submit, post, message or change anything at your school; the only things it can change are documents in your Wingit workspace, when you ask.
Wingit makes no decisions about you by automated means that have legal or similarly significant effects.
6. Who we share information with
We share information only with the following recipients, and only for the reasons given.
| Recipient | What | Why |
|---|---|---|
| Your school's Canvas system and its sign-in provider | Requests made with your sealed session, from our servers, to read your courses (including the automatic refresh about once an hour), to open course tools, lecture players and quizzes, and to sign you out when you ask; the user-agent string of our sign-in browser; and what you type into your school's sign-in page during sign-in. | To read your coursework for you. Your school sees these requests as activity on your account. |
| Services your school's pages and files use (for example Instructure's file storage on Amazon S3, or your school's two-step provider) | The requests your school's pages and files make, as they would from your own browser. | To sign you in and to read your course files. |
| Your school's lecture-video and quiz providers (currently Kaltura and Instructure's New Quizzes) | Requests to fetch lecture transcripts, play or download lecture video, and read quizzes. Some of these tools are opened through your Canvas account, the way you would open them, so they receive what your school's Canvas normally sends them. | To show lectures and quizzes. |
| Sail Research (model provider) | See section 5. | To answer your questions with Robin. |
| Stripe | Your name, email address and Wingit account number when we create your customer record; your email address and country if you set up referral payouts; subscription, invoice, checkout and payout requests. Stripe sends you receipts, failed-payment emails (with a link to confirm a payment your bank asks about) and expiring-card emails. Stripe also acts as an independent controller for fraud prevention and payments regulation; see Stripe's privacy policy. | Payments, subscriptions, refunds and referral payouts. |
| The member whose link or code you signed up with | What section 3.5 lists: roughly when your account was made (to the hour), whether it started a trial, each payment's date and what they earned from it, and any refund, next to the name they gave the link. Never your name, username or email address. | To credit and pay the referral. |
| Our email delivery provider | Your email address and the content of the emails we send you, which can include course updates, the start of a Robin question, messages about your support requests, your plan's price and dates, and notices from Wingit. | To deliver account, billing and notice email and, unless you turn them off, updates and product news. |
| Our hosting and infrastructure providers | Everything Wingit stores, including our backups, on servers and storage in the United States that they run for us, under our control. | To run Wingit and keep backups. |
| Our content delivery and security provider | Every page and request between your browser and Wingit passes through it, except your school's sign-in screen (below), as do the requests that assistants you connect and Stripe's payment notifications send to us. It therefore handles, in readable form, what you send to and receive from Wingit: what you type into Wingit's own pages (including your Wingit password and two-step codes), your sign-in cookie, assistant tokens, calendar links, files you upload, your questions to Robin and its answers, the course material we show you, and your network address. It keeps its own records of requests for a limited time. Your school's sign-in screen, and what you type on it, go directly between your browser and our servers, on an address of their own, and never pass through it; the Wingit page that opens that connection is delivered through it like our other pages. | To deliver Wingit's pages and protect the site from attacks and abuse. |
| An AI assistant you connect yourself (Claude, ChatGPT, Cursor, VS Code or another MCP client) | Whatever that assistant asks Wingit's read-only tools for, using a token you create. Tokens stop working when you revoke them, when you change or reset your password, and after 90 days without use. | Because you connected it. What that assistant does with the data is governed by its provider's terms, not ours. |
| A calendar app you subscribe with | The assignment titles, due dates, links and descriptions in your calendar link. | Because you added the link. |
| Sketchfab | A request from our servers to show a public 3D model named in your course, with no information about you. | When Robin looks at a 3D model for you. |
| Authorities and others when the law requires | Account and usage records. | To respond to valid legal process, to protect the rights and safety of students and the public, or to enforce our terms. |
| A successor | The information described in this policy. | If Wingit is sold or merged, under the same or stronger commitments, with notice to you. |
Wingit does not show your information to other students, except what section 3.5 says the member who referred you sees. The only thing Wingit reuses between students is a summary made from course text that their course contains too (section 5).
We do not share your information with advertisers, data brokers or analytics companies. Anyone who works on Wingit and needs access to systems does so under written confidentiality obligations. Within Wingit's own tools, our support staff see the support requests you send, and our staff can see your course material, conversations, documents and attachments only by opening a logged, read-only support view of your account (sections 3.4 and 12.2). Direct access to our servers and database is limited to the people who operate Wingit.
7. Where your information is processed
We store your information and run Wingit in the United States, and our backups are kept in the United States too. If you use Wingit from another country, your information is transferred to the United States. Some recipients in section 6 may also handle it elsewhere: Sail may process Robin requests outside the United States (section 5); our content delivery and security provider handles each request that passes through it at one of its data centers, usually one near you, which can be outside the United States when you are; and Stripe and our email delivery provider may process information in other countries under their own transfer arrangements. Wingit is offered to students at schools in the United States. If you use it from the European Economic Area, the United Kingdom or anywhere else, you provide your information to us in the United States, whose data protection laws may differ from yours; questions about this go to privacy@wingit.school.
8. Your school account and free trials
There is one free trial of a paid plan per person, school account and card. To keep to that, Wingit remembers which school accounts and cards have already had one.
Your school account. When you sign in to a school, we compute a keyed hash of your school's address and your Canvas user id and keep that hash, your school's Canvas address, the account that first linked it, every Wingit account it has been linked to (with when each first and last linked it), when it was first and last seen, and, once it has been on a Wingit account that had a free trial, when and on which account. Removing the school does not erase this. A school you add beyond what your plan includes is not linked to your account until you pay for it; if you back out or do not pay, a record made only for that sign-in is deleted with the school.
Your card. When a free trial starts, and for each card used during it, we keep a keyed hash of the fingerprint Stripe derives from the card, with the account and subscription that first used it and when. We never keep the card, and these records do not hold Stripe's fingerprint itself. For each trial we also keep whether it was granted or ended at once, and why: the card, a school account or the Wingit account had already had one.
The hashes are made with a key that exists only inside Wingit, so they cannot be used to identify you, your school account or your card outside the service, and they hold no name, email, Canvas id or card number. They are pseudonymous rather than anonymous: only someone holding Wingit's key could link them back to a Canvas account or a card.
How we use them. A Wingit account is not offered a free trial if it has had one, or if a school account linked to it has already been on an account that had one. We learn your card only when you finish checkout: if that card has had a trial before, or your account or a school account linked to it has had one meanwhile, the trial ends at once, your plan starts that day and Stripe charges your card, and we email you to say why. The same happens if, during a trial, you link a school account that already had a trial on another Wingit account, or change to a card that already had one; until the trial has ended, Robin is off for that school. If that charge does not go through, paid features pause, as for any failed payment. No school is ever refused, and on a paid plan or on the free plan nothing is switched off. A trial started on renewal terms from before this rule is not ended early; instead, Robin stays off during it for a school account that another account's trial already used.
These records outlive your account, because their purpose is to work after an account has been deleted. They contain no name or contact details, but they stay linked to your former account number, which our retained billing records also use.
9. How long we keep information
We keep each kind of information for the period, or by the rule, in the table below. When you delete something in Wingit, or delete your account, we remove it from our live systems promptly, apart from what the table below, section 5 and section 10 say we keep. Copies can remain for a while in temporary caches on our servers, in technical logs and in backups, where nothing uses them to serve you; they go as those caches, logs and backups expire, within 90 days unless the law requires us to keep a backup longer. Copies at our model provider are described in section 5.
| Information | Kept for |
|---|---|
| Account details | Until you delete your account. We do not delete inactive accounts automatically. |
| Sign-in sessions | Eight hours (thirty minutes for a staff support view), or sooner when you sign out, change or reset your password, or turn on two-step sign-in. |
| Password reset, email confirmation, email change and sign-up links | Reset links work for sixty minutes, and confirmation, email-change and sign-up links for twenty-four hours; each works once. We keep only a one-way digest of reset, confirmation and email-change links, for thirty days after the link is used or expires, and nothing of a sign-up link once its email is sent. An email-change link also keeps the new address until the link is used, replaced or canceled, or, at the latest, until the day after it expires. A change still waiting is canceled when you cancel it in Settings, change or reset your password, or when our staff suspend your account or sign it out everywhere. |
| School connections, the sealed school session, the index and cached course files | Until you remove the school or delete your account. Signing out of a school deletes the sealed session at once. A session your school has ended stays sealed and unusable until you sign in again or remove the school. If your plan stops covering a school (for example when a trial ends or you move to a plan with fewer schools), that school is locked, and thirty days later we delete its sealed session, its index, its cached files and its notifications, keeping only its name and address so you can see it was there; if a plan covers it again, you sign in to it again. A school you choose while adding one beyond your plan, and do not pay for, is deleted with everything stored for it when you back out or an hour after you chose it. |
| Your calendar link | Until you replace it in Settings, remove the school or delete your account. |
| Tokens for assistants you connect | Until you revoke them, remove that school, change or reset your password, or delete your account, and no longer than 90 days after an assistant last used one (or after it was made, if it was never used). We keep when each was last used, to the hour, and show it in Settings. |
| Robin conversations and documents | Until you delete them or your account; we keep the newest 500 conversations and the newest 500 documents and remove older ones. |
| Answers waiting to be saved into a conversation | Until they are saved into it, or you delete the conversation or your account; at most 50. |
| Files you attach to Robin | Until you delete them or your account. You can remove a file before you send it, and Settings lists every file you attached, sent or not, so you can delete any of them; deleting a conversation does not delete its files. |
| Feedback on Robin's answers | Until you take the rating back, delete the conversation or delete your account. |
| Background work records (syncs, text recognition, downloads, queued answers, conversation summaries in progress) | 14 days, even if you delete the conversation sooner. |
| Receipts of Robin's edits to your documents | 30 days, even if you delete the document sooner. |
| Robin check and summary diagnostics (no text) | 30 days. |
| Summaries shared between students | While any connected account still has the source text they were made from; one that was never finished and holds no saved model work, 14 days. |
| Usage records | 400 days, or until you delete your account. |
| Notifications | Until you remove the school they came from, thirty days after your plan stopped covering that school, or until you delete your account. Deleting a conversation does not delete the notice that its draft was ready. |
| Email we sent | Ninety days, or until you delete your account. Email to an address that has no account, such as an unused sign-up link, is kept for ninety days. |
| Notices from Wingit addressed to you, and when you closed them in the app | Three years, or until you delete your account. |
| Which versions of our terms and policies you agreed to, and when | Indefinitely, also after you delete your account, linked to the emptied account record, to show what was agreed. For the affiliate program, each Affiliate Terms version you agreed to is recorded at the moment you confirmed that you are 18 or older and live in the United States, which Earn asks with it. They hold nothing else. |
| Your agreement to automatic renewal, and the records of emails about your plan and of price changes | While your account exists and, after you delete it, as long as consumer-protection law requires and, beyond that, as long as we may need them to show what you agreed to and what we told you. For your agreement to automatic renewal, that is at least three years, or a year after the plan it started ends if that is later, as California law requires. They are not removed when you delete your account. |
| Affiliate applications from the public form, and their messages | 90 days after we decide on them, or after 90 days without activity while undecided; sooner if you ask. |
| Support requests, their messages and staff notes | Until a year after the request was resolved and last written to; then the request is deleted with its messages and notes. Open requests stay until they are resolved. Deleting your account deletes your requests at once. |
| Your permission for a support view | Until you withdraw it or the request is resolved. |
| Counts of sign-in and other attempts | Five to fifteen minutes, in memory only. |
| Billing records (Stripe ids, subscriptions, invoices, credits) and referral records | While your account exists and, after you delete it, as long as tax and accounting laws require us to keep them, typically seven years from each record's date; then they are deleted. They hold no name or email, and after you delete your account they point to the emptied account record. Links to Stripe's pages for your invoices, which show your billing details, are removed within a day of deleting your account. A referral that links you to an account that still exists, and that account's own earnings records, stay with that account. |
| Your affiliate links and their total visit counts | Until you delete your account. Archived links are kept. When you delete your account, your links are closed: their names and campaign tags are removed, and each keeps its ending, the kind of place you said you would share it, the page it opened, when it was made and first visited, and its all-time visit total. Your code is kept as a retired ending. Neither is ever given to anyone else; an ending you rename away is kept the same way. If you would rather a name not be kept like this, choose an ending without one. |
| Hourly visit counts per link | Twenty-five months, or until you delete your account. |
| The one-way values used to count each visitor once a day | About two days. |
| Counts of visits per network address | Up to an hour. |
| Your affiliate program membership (terms agreed, 18+ and US confirmations, any custom terms, status) | Until you delete your account. Referrals made through your links keep the share and earning period they were made under, as part of the referral records above. |
| Invitations to the affiliate program | The invitation is kept, by label and terms, as a record of who was invited to the program on what terms. The name and email address entered on it are removed 90 days after it is used up, expires or is withdrawn. |
| Raw payment-event records from Stripe | 180 days after we receive them; one we could not process is kept until we resolve it. They can include your name, email address and billing address, and are not removed when you delete your account. |
| The school-account record, including the Wingit accounts it was linked to | Indefinitely; see section 8. |
| The keyed hash of a card that had a free trial, and the record of each free trial | Indefinitely, like the school-account record (see section 8), also after you delete your account. |
| Records of actions our staff took on accounts | Indefinitely, by account id. When an account is deleted, its username in records about it is replaced by a placeholder. A record of an account search by our staff keeps the words searched for, which can be part of a username or email address; when an account is deleted, searches whose words are part of its username or email lose them. |
| Temporary lecture playback links | 120 minutes. |
| Technical logs | As long as we need them to keep Wingit secure, find and fix problems and prevent abuse, and at most 90 days. |
| Backups | As long as we need them to recover Wingit after a failure or a mistake, and at most 90 days unless the law requires us to keep a backup longer. Information deleted from Wingit leaves our backups as they expire. |
| The theme cookie | One year. |
The wingit_ref cookie | Thirty days, or until your sign-up form in that browser is accepted. |
10. Deleting your account
You can delete your account from Settings at any time; the only confirmation is your password. We can also delete an account at your request or to enforce our terms. Deleting your account:
- cancels any live subscription with Stripe first, and stops if Stripe cannot be reached;
- ends every sign-in session and deletes every assistant token;
- asks each school to end your session there, as signing out in Settings does. If a school does not answer within ten seconds, deletion goes on, and that session ends on your school's own schedule;
- removes every school: the sealed school session, the index, cached files, the calendar link, background jobs and notifications;
- deletes your conversations, documents, answers waiting to be saved, files you attached, feedback, receipts of Robin's edits, usage records, one-time link records, recovery codes, the email we sent you and the record of which notices from Wingit were addressed to you and which you closed, and any summary Robin had started for you but not finished;
- ends your affiliate program membership: closes your links, deletes their hourly visit counts and the values used to count visitors, closes the referrals you made so that they earn nothing more, and cancels earnings that have not been paid out yet;
- marks the account row itself as deleted and removes your name, username, email, password, two-step secret and when you last used Wingit from it, and replaces your username in our staff-action records with a placeholder.
The following remain: billing and referral records, including your agreements to automatic renewal and the records of emails about your plan, for the periods described in section 9 (linked to the emptied account row, not to your name); the record of which versions of our terms and policies you agreed to; your closed affiliate links (their endings, so that nobody else is given them, the kind of place and page each pointed to, and their all-time visit totals); raw payment-event records from Stripe, for up to 180 days; the customer record Stripe keeps under its own policy, which includes your name and email address; the school-account record and the free-trial records (section 8); staff-action records by account id; summaries made from course text that other students also have, which hold nothing about you; temporary copies at Sail, as described in section 5; copies of course files that another of our servers had cached for your schools, until that server's temporary cache is cleared, within 90 days; technical logs that name your school connection's number, for up to 90 days; and copies in our backups, for up to 90 days (section 9).
You can also, from Settings, sign out of or remove a single school, replace your calendar link, revoke assistant tokens, delete files you attached to Robin, turn email updates or product news off, cancel an email change that is waiting for confirmation and withdraw your permission for a support view; and, from Robin, delete individual conversations and documents, take back a rating, and remove an attached file before you send it.
11. Your rights
Wherever you live, you can:
- see and export your information. Your courses, conversations and documents are visible in the app. Documents can be copied on every plan and exported to Word, Markdown and PDF on Plus and Pro. Ask us for a copy of anything else, including a machine-readable copy; this is free on every plan;
- correct it. You can change your name, username, email address and password in Settings; ask us to correct anything else;
- delete it. From Settings, or by asking us;
- object to or restrict how we use it, including turning off email updates and product news at any time in Settings;
- not be discriminated against for exercising any of these rights.
We do not sell your personal information and do not share it for cross-context behavioral advertising, so there is nothing to opt out of. If that ever changes, we will treat a Global Privacy Control signal from your browser as a request to opt out of that sale or sharing, wherever you live.
To exercise a right you cannot complete in Settings, open a privacy request from Support in Settings, or email privacy@wingit.school from the address on your account. We will confirm your identity through your account or that address and answer within one month, or within 45 days for California requests. You can ask an authorized agent to act for you; we will still confirm the request with you.
11.1 If you are in the EEA or the UK
Your rights include access, rectification, erasure, restriction, portability, and objection, as described above; where Settings does not cover a right, we handle it on request. You also have the right to lodge a complaint with your national data protection authority, or in the UK with the Information Commissioner's Office. Where we rely on legitimate interests (section 4), you can object, and we will stop unless we have compelling grounds to continue.
11.2 If you are a California resident
In the last twelve months we collected the categories of information listed in section 3: identifiers; account credentials, including the login credentials for your school account (your sealed school session); education information as it appears in your courses; the content of your conversations and documents, and the images and files you attach; commercial information about your plan; and internet activity limited to the records listed in sections 3.4 and 3.5, including your network address, held briefly to limit sign-in attempts and to count visits to affiliate links. We collected them from you; from your school's Canvas and its lecture-video and quiz providers, using the sign-in you gave us, including the automatic hourly refresh; and from Stripe. We collected them for the purposes in section 4, and disclosed them only to the service providers and recipients in section 6.
We have not sold personal information and have not shared it for cross-context behavioral advertising in the last twelve months, and we do not do so. California treats account credentials as sensitive personal information. We use them only to sign you in, to secure your account and, for your school sign-in, to read your courses for you as described in section 3.2. We do not use sensitive personal information to infer characteristics about you. You have the rights to know, delete, correct, and to non-discrimination, and to use an authorized agent, as described above. Because we do not sell personal information or share it for cross-context behavioral advertising, there is no "Do Not Sell or Share" choice to make; section 11 says how we would treat a Global Privacy Control signal.
12. Security
We use administrative, technical and physical safeguards appropriate to the sensitivity of the information we hold. This section describes the main ones in plain terms.
12.1 How we protect your school sign-in
Your school sign-in is the most sensitive thing Wingit holds, because it lets Wingit read your courses as you. Wingit is designed to keep it apart from everything else.
- A separate service holds it. Your school session is handled by a separate Wingit service, the secure transport, which runs in its own container apart from our main application and is not reachable from the internet. When you finish signing in, the transport seals your session with public-key encryption (X25519 key agreement, HKDF-SHA256 and AES-256-GCM). Only the transport holds the private key that can open it. That key is kept apart from our database and its backups, and is never given to our main application.
- Our application and database hold only a sealed copy. Our main application and its database store the sealed copy and cannot open it. Each sealed copy is bound to one school connection and to the list of school addresses it may be used with; if it is altered or moved to another connection, it no longer opens. A copy of our database alone would therefore not include a usable school session.
- Your cookies stay inside the transport. Every request to your school is made by the transport, which adds your cookies itself and gives our application your school's answer without them. No feature of Wingit shows, exports or returns your school cookies to anyone, including our staff and our administrative tools.
- Only what is needed. We keep only the cookies that a browser would send to your school's Canvas address and to the sign-in address you gave us (these can include cookies your school sets for its whole web domain), and the user-agent string of the sign-in browser, which names its browser type and version. Cookies for every other site, and anything else that browser stored, are discarded.
- Opened only in memory, and only for your school. The transport opens a session only in memory, for as long as it needs it, and is configured not to write its memory to crash dumps. The requests it makes send your cookies only to your school's own Canvas and sign-in sites, over encrypted (HTTPS) connections; in the isolated browser, a cookie your school set for its whole web domain goes to that domain's sites, as it would in your own browser. The transport refuses to send any request to private or internal network addresses. Its logs record which school address a request went to and whether it succeeded, not your cookies or the contents of the pages you read.
- Sign-in happens in a throwaway browser. The sign-in page you see runs in a browser that exists only for your sign-in, inside its own locked-down container: its system files are read-only, it keeps data only in memory, it runs without administrative privileges, and it reaches the internet only through a gateway the transport controls, which blocks our internal network. Password saving, password-leak checking and browser-vendor sign-in and sync are switched off. The container is deleted, with everything it held, when sign-in ends, or, at the latest, about fifteen minutes after it started. The same kind of isolated browser, loaded with your session, is used when you open a course tool, lecture player or New Quizzes quiz that needs a browser.
- Your school password is not kept. What you type on your school's sign-in page passes through our servers only as a relayed stream of keystrokes to that browser, encrypted between your device and our servers. We do not record, log or store your school password or two-step codes.
- Read-only by design. Wingit's software contains no feature that submits, posts, edits or deletes anything at your school. The only requests it makes that are not reads are a sign-out request when you sign out of a school, and the token request Canvas requires before it shows a New Quizzes quiz. When you yourself use a course tool or quiz in the isolated browser, you control it, as you would your own browser.
- You can end it. Signing out of a school or removing it in Settings asks your school to end the session and deletes our sealed copy at once, whether or not your school confirms.
These measures are designed so that a copy of our database, or anything our main application or our staff tools can see, would not reveal your school cookies. You can end a stored session at any time by signing out of the school in Settings.
12.2 How we protect everything else
- Passwords and sign-in secrets are never stored in readable form. Your Wingit password is stored only as an Argon2id hash. Your sign-in cookie, password-reset and email-confirmation links, two-step recovery codes and connected-assistant tokens are stored only as SHA-256 digests. A copy of our database would not contain your password, a working sign-in cookie or an assistant token, and our copy of a sign-up, reset or confirmation email loses its link as soon as the email is sent.
- Small secrets are encrypted. Your two-step secret, the details carried in a sign-up link, your calendar link, lecture playback links, and the short-lived handovers between our application servers are encrypted with AES-256-GCM, under keys kept outside our database.
- Your school-account record is a keyed hash (section 8), not your Canvas id, and a card that had a free trial is recorded only as a keyed hash of the fingerprint Stripe derives from it.
- Accounts are kept apart. Every request is limited to the signed-in account's own information and to the school connection it belongs to, and a connected-assistant token reaches only the one school it was made for.
- Our database is not on the internet. Our database and cache server cannot be reached from the internet, only by Wingit's own services. The cache server never writes to disk. Cached course files are stored with file permissions that limit them to the service that keeps them; like the rest of our stored data, they are not separately encrypted (see below).
- Staff access is limited and logged. Our staff have one of two roles. Moderators answer students' support requests: they see those requests, and, to find the account behind one, its name, username, email address, plan, sign-up date, whether it is suspended and when it was last used. They can sign an account out, suspend it with a reason that we email to you, or reinstate it; they cannot change plans, see billing records or delete accounts, and they cannot act on other staff accounts. Administrators can also manage plans, billing, roles and accounts. Neither role's tools show your course material, conversations, documents, attachments, feedback, passwords, two-step secrets or school sessions. To see your course material, conversations, documents or attachments within our tools, a staff member must open a read-only support view (section 3.4); a moderator can open one only on a support request where you allowed it, while that request is open. A view ends after thirty minutes. Opening one is recorded in our audit log, as are the changes our staff make to an account, their replies and notes on support requests, and the account searches, lookups and support requests opened in our support tools. Staff accounts must use two-step sign-in. Direct access to our servers and database is limited to the people who operate Wingit.
- Encrypted in transit. Wingit is served only over HTTPS, and your browser is told to keep using HTTPS for it. Information is also encrypted (TLS) between Wingit and your school, our model provider and Stripe, and between our main application and our database. Some traffic between Wingit's own services, such as between our main application, our cache server and the transport, is not encrypted, including the relayed keystrokes of a school sign-in; it never leaves the servers that run Wingit.
- Browser protections. Our pages load no third-party scripts, fonts or trackers, and use a content security policy that blocks scripts from other sites and a referrer policy that sends no referrer to other sites. Our sign-in cookie cannot be read by scripts or sent from other sites, and changes must come from Wingit's own pages.
- Limits on guessing. Wrong passwords, codes and links, sign-ups and reset requests are counted and slowed down (section 3.4), and a sign-up does not reveal whether an email address already has an account.
- No access logs. Wingit's software keeps no web access logs. Our service logs are designed to record operational events and errors, not the contents of your courses or conversations.
- What is not separately encrypted. Your course index, cached course files, conversations, documents, attachments, feedback, notifications and the emails we send are stored in our database and file storage so that we can search and show them to you. They are not separately encrypted inside the database.
- Your calendar link works without signing in. Anyone who has it can read your assignment titles, due dates and descriptions. We store it only as a keyed hash, which recognizes the link, and an encrypted copy, which lets Settings show it to you again, so a copy of our database alone would not include working calendar links. Treat it like a password, and replace it in Settings if you think someone else has it.
You help too: use a password you do not use anywhere else, and turn on two-step sign-in.
12.3 If something goes wrong
No method of storage or transmission is completely secure, and we cannot guarantee absolute security. If we learn of a breach that affects your information, we will notify you and regulators as required by applicable law.
13. Your school and FERPA
Wingit is a tool you use, under your own school login, to read records your school already lets you see. Your school does not send us anything and has no agreement with us; we are not your school's contractor or "school official" under the Family Educational Rights and Privacy Act. Your school's own policies on account use, including any rules on letting another application use your login, apply to you when you use Wingit.
We do not share what you ask Robin, what it writes, or what you read in Wingit with your school, your instructors or anyone else, except as this policy describes. If a school, an authority or anyone else asks us for your information, we give it only when the law requires us to, such as under a valid subpoena or court order, and only what that requires; unless the law or the order forbids it, we tell you first, so you have a chance to object.
While your school sign-in remains valid, Wingit checks your courses about once an hour, even when you are not using it, and this can keep your school session active. After 90 days in which you have not used Wingit, it stops checking until you next do. Your school can end your Canvas session at any time, which stops Wingit from reading until you sign in again; material Wingit already copied stays in your account until you remove the school. To stop the reading yourself, sign out of the school in Settings.
14. Changes to this policy
When we change this policy we update the effective date and version at the top and add a summary of what changed to the change log at the end of this policy. For a material change, we will tell you by email and with a notice in the app at least 14 days before it takes effect. If the app asks you to agree to the new version, we record when you agreed and to which version (section 3.4). We will not start using information we already hold for a new purpose without telling you first.
15. Contact
Privacy questions and requests: privacy@wingit.school, or Support in Settings.
Post: Wingit Education LLC, 1207 Delaware Ave #3637, Wilmington, DE 19806.
Wingit is offered to students at schools in the United States and is not directed at people in the European Union or the United Kingdom, so we have not appointed a representative there.
Change log
| Version | Date | Change |
|---|---|---|
| 1.0 | October 23, 2026 | First policy. |