Privacy Policy
This draft describes what the current Android app actually does. It is not a claim that data never leaves your device, and it is not a training-policy guarantee.
Who this is for
ExamDNA is an Android exam-preparation app. This website and the app are published under the name ExamDNA. No incorporated legal entity name is claimed on this page.
What stays on your device
Original source files (notes, slides, PDFs, photos, and similar course materials) are stored locally. Optical character recognition runs on the device. Student DNA records and Exam Replay logs are kept in on-device storage. PDF, PNG, and DOCX exports are rendered on the device.
What is sent for analysis
When you run Exam DNA, question generation, verification, or related AI tasks, compact evidence excerpts are sent through ExamDNA’s Cloud Functions for Firebase to Google Cloud Vertex AI. Excerpt size is capped in configuration. Those excerpts are course content, not “anonymized summaries” in the marketing sense.
Handwritten answers may be transcribed with an on-device pass first; a cloud transcription path exists when on-device confidence is insufficient.
Accounts and control-plane data
Sign-in uses Firebase Authentication (anonymous-first, with optional email link). Firestore holds account, usage counters, and a subscription plan mirror. App Check may be used to attest requests. RevenueCat is used for subscription entitlement when billing is configured.
Usage logs
Server-side AI usage logs record operation type, model, token counts, cost units, and success or failure. They are written so that clients cannot forge them. They are not a dump of your notes. The current Android Gradle configuration does not include Firebase Analytics or Crashlytics.
What this policy does not claim
- We do not claim that “everything stays on device.”
- We do not claim that we never collect telemetry. Usage and control-plane records exist.
- We do not claim that Google, Firebase, or Vertex never use data for model training. ExamDNA does not sell your files, and we do not control Google’s service terms.
Still needs final verification
- Production data-retention periods for Firebase and Vertex logs.
- A public support inbox and data-request process.
- Counsel review before presenting this as a binding privacy policy.