Privacy
There is no IsotopeAI server. Your data goes from your device to a Supabase project you created and control. Nothing is collected, and nothing passes through us.
Last updated 2026-08-28
What we collect #
Nothing. This is a structural property, not a policy promise: the software has no endpoint belonging to the project, so there is nowhere for data to be sent.
- No analytics or telemetry.
- No crash reporting. Sentry is present in the bundle and its DSN is neutralised at serve time, so it cannot transmit.
- No account on any service of ours — there is no such service.
- No advertising or tracking identifiers.
Verifiable rather than assertedYou can confirm this. Open DevTools, watch the Network panel, and observe that every request goes to 127.0.0.1 or to your own Supabase project. The source is MIT licensed and readable.
Where your data lives #
| Location | Contents | Who can read it |
|---|---|---|
IndexedDB isotope_main | Tasks, sessions, subjects, habits, logs, tests, exams, mock tests | Your browser only |
localStorage isotope_*_v2 | Smaller records and UI state, namespaced per user | Your browser only |
| localStorage auth keys | Access and refresh tokens | Your browser only |
| Your Supabase Postgres | The cloud copy of the above, plus community data | You, filtered by row-level security |
| Your Supabase Storage | Backup JSON and avatars | You |
~/.isotope/logs/ | Server logs on your own machine | You |
Third parties #
| Service | Why | What it receives |
|---|---|---|
| Supabase | Your database, auth and storage | Everything you choose to sync. Governed by your agreement with Supabase. |
| GitHub | Update checks and this documentation site | A version comparison request. No user data. |
| Google Fonts | Two webfonts on this documentation site | Standard request metadata when you view these docs. Not used by the app itself. |
| Gemini or Groq | Only if you supply an API key | The content of AI requests you initiate. Optional and off by default. |
Community features #
Community is opt-in and its visibility is yours to set. Other users in your groups may see, subject to your privacy settings:
- Your display name, handle and avatar.
- Study totals and streaks, where you appear on a leaderboard.
- Presence — whether you are currently studying, and optionally the subject.
- Messages you post in a group.
Content — the tasks themselves, note text, session detail — is never shared. Quiet hours suppress alerts to others during a window you choose.
Deleting your data #
| Scope | How |
|---|---|
| Local only | Clear site data in your browser. The cloud copy is untouched and will restore on next sign-in. |
| Everything | Delete the rows in your Supabase project, or delete the project. You control it directly. |
| Account | POST /__auth/delete-account, or remove the user in the Supabase dashboard. |
Clearing the cache does not delete anythingcaches.delete() removes cached HTTP responses only. It cannot reach localStorage or IndexedDB, so the app’s automatic recovery from a stale bundle never touches your data or signs you out.
Children #
The app is aimed at exam candidates, many of whom are minors. Because it collects nothing centrally and stores data in a database the operator controls, there is no central profile of any user. If a minor uses it, the operator of that install is responsible for the data in their own project.
Changes to this page #
This page is versioned in the repository alongside the code. Its history is the changelog — no separate notice is issued, because there is no mailing list and no account to notify.