Security at Aripsy

PDF, PowerPoint, Word and audio files are read on your device. Aripsy turns them into text in the browser and sends only that text to generate your study materials. The file itself is not uploaded, and we keep no copy of it.

Scanned pages and audio are converted to text on your device too.

One exception: on Pro, up to five images from a document can be sent to an AI provider so that diagrams can be described in words. The images are described and discarded, not stored.

• Every page and request uses HTTPS. Plain http addresses are redirected, and browsers are told to use HTTPS for two years (HSTS, on the preload list).
• Aripsy pages cannot be embedded in other websites, which protects against clickjacking.
• The camera, microphone and location are blocked for the whole site.

• You sign in with a one-time email code or link, or with Google or GitHub. Aripsy does not store passwords.
• Sign-in codes expire and work once.
• Every request that reads or changes your data is checked on the server against your signed-in session.
• Two-factor sign-in is not available yet.

• Study sets, exams, activity and share links live in a Postgres database at Supabase. Row-level security rules mean a signed-in account can only read and change its own rows.
• Internal measurement tables cannot be read from the browser at all.
• Server-side keys never ship to the browser.
• Share links are off by default. A link you create is open to anyone who has it, sends no referrer, is not cached, and expires after up to 7 days on Free or 30 days on Pro.

• Paddle is the merchant of record. Card details are entered in Paddle's checkout, not on Aripsy's servers, and we never see your full card number.
• Payment events that Paddle sends us are signed. We verify the signature and reject anything older than five minutes or already processed.

• Your text is sent to the AI providers named in our privacy policy only to generate your notes, flashcards, questions and feedback.
• Aripsy does not train AI models on your study content.
• Our AI monitoring records tokens, speed and whether a request worked. It does not record your study text.

• Generation, answer checks, exports and the contact form have daily and monthly limits per account and per network address, so one person cannot overload the service or scrape it.
• Input is capped by plan: words per request, file size and file type.
• AI-generated content is cleaned before it is shown in your browser.
• Requests from other websites to your account are refused.

• Analytics cookies stay off until you choose "Accept All". With "Essential Only", analytics runs without cookies and no profile is built.
• Session recordings, when on, mask everything you type.
• Advertising storage is always off.

• Export: download everything we hold about your account as a JSON file from Settings.
• Delete: delete your account from Settings. Your study sets, collections, share links, exams, activity and sign-in are removed from our live systems straight away, any paid subscription is cancelled, and we ask our email and analytics providers to delete their copies within 30 days.
• Billing and usage records are kept without any link to you, as tax law requires. Copies in encrypted backups are overwritten on a rolling basis.

• Dependencies are checked for known vulnerabilities every week and whenever they change, and a security test suite runs before releases.
• If a breach puts you at high risk, we will tell you without undue delay.

Aripsy is not for children under 13. Accounts of students under 18 get no ads, no advertising profiles, analytics off unless they choose otherwise, no precise location, and private study sets unless they create a share link. Parents and carers can contact us about their child's data.

Email support@aripsy.com with "Security" in the subject. Tell us what you found and how to reproduce it. We read every report and aim to reply within three working days.

Please do not access other people's data, run denial-of-service tests or publish the issue before we have fixed it. We do not run a paid bug bounty.

The same contact details are published in machine-readable form at aripsy.com/.well-known/security.txt.