Privacy Policy

We limit our collection of personal information to what is necessary to provide our services. Here are the types of information WriteSTREAK collects:

• Account Registration Information: When you create an account, we collect your first name, last name, e-mail address, institution, department, academic discipline (e.g., Arts & Humanities or Engineering & Technology), and career stage (e.g., Undergraduate Student or Associate Professor).
• Profile Information: In your Profile settings, you may optionally add a short bio and upload a profile picture. This information is private and visible only to you; it is not shared with your connections, other event participants, or your institution.
• Writing Session Data: When you use the Platform’s timer to log a writing session, we record the session’s start and end times, duration, type (focus session or break), and the project or task it was associated with. This data is used to calculate your streaks, focus percentage, average session length, and other analytics displayed on your dashboard.
• Projects and Tasks: If you create projects or tasks within WriteSTREAK to organize your writing, we store the names, colors, priorities, dates, and durations you assign to them.
• Event Participation Data: If you register for or join a writing event (e.g., a “Writing Circle”), we collect your registration details and track your writing activity for the duration of that event.
• Social Connections Data: If you send or accept a connection request to another user, we store the connection relationship and its status (pending or accepted).
• Communications: If you contact support at support@writestreak.ai, we collect the information you provide (such as your contact details and the content of your message) to assist you.
• Session Tokens: WriteSTREAK uses session tokens to keep you securely logged in. These tokens are essential to the Platform’s operation and are used solely to maintain your authenticated session, not for tracking, advertising, or analytics. WriteSTREAK does not use cookies for tracking or advertising purposes.
• No Automatic Usage Tracking: We do not collect your IP address, browser type, device identifiers, or any other automatic technical or usage data. WriteSTREAK does not use Google Analytics or any other third-party analytics or tracking tools.
• No Sensitive Personal Data: WriteSTREAK does not collect certain sensitive information. We do not ask for or handle any student grades, transcripts, or academic performance records. We do not collect government-issued identifiers (such as Social Security numbers or driver’s license numbers), dates of birth, or any biometric or health data. WriteSTREAK has no payment or subscription system, so we never collect or store any financial information such as credit card numbers or bank details. By avoiding sensitive data collection, we reduce privacy risks and simplify compliance with university privacy regulations.

We use personal information solely for the purposes of operating and enhancing the WriteSTREAK service. This includes:

• Providing the Service: We use your registration information to create and manage your user account, authenticate you when you log in, and personalize your experience. We use your writing session data to calculate and display your streaks, focus percentage, and other analytics.
• Connecting You with Others: If you choose to use the social and event features, we use connection and event data to facilitate those features. For example, we may display your writing time to your connections or to other participants in a writing event you have joined.
• Communicating with You: We may send you service-related communications via e-mail, including account confirmations, password reset e-mails, notifications about Platform features or changes, and reminders about upcoming writing events you have joined.
• Technical Support: If you reach out to support@writestreak.ai, we use your information to investigate and respond to your request.
• Improvement and Analytics: Usage data and feedback help us understand how the Platform is used. We analyze this data (in aggregate, without identifying users) to troubleshoot problems, optimize performance, and develop new features that better serve our users.
• Security and Abuse Prevention: We use account information to enforce our institutional domain controls, monitor for suspicious account activity, and protect against fraud or misuse of the Platform.
• Legal Compliance: If we are required by law to process or disclose certain data (e.g., to comply with a court order), we will use your information to the extent needed to fulfil those legal obligations.
• No Third-Party Marketing: We do not use your data for third-party marketing or advertising.

WriteSTREAK understands that sharing of personal data should be limited and done with care. We only share personal information in the following circumstances:

• Service Providers (Processors): We may share data with third-party companies that help us run WriteSTREAK, such as cloud hosting providers and e-mail service providers. These providers act under our instructions and implement security measures to protect your data. They are not allowed to use your information for anything other than providing services to us.
• Your Institution: If your account was provisioned by a university or other institution, we may share certain information with that institution, such as usage reports or aggregated learning analytics for internal reporting. Any such sharing will be limited to what the institution needs for legitimate educational purposes, and often this data will be aggregated or anonymized.
• HigherEd+ Administrators: Administrative access to WriteSTREAK is held exclusively by HigherEd+ (the Company). Authorized HigherEd+ administrators can view individual user account data, including your name, e-mail address, events joined, and total writing time, in order to operate, support, and maintain the Platform.
• Other Users (Connections and Events): If you connect with another user, that connection will be able to see your name, e-mail address, profile picture, and writing time. Your projects, tasks, and bio are never visible to your connections. If you join a writing event, all other participants registered in that same event will be able to see your name, e-mail address, profile picture, and writing time for that event.
• Legal Requirements and Safety: We may disclose information if we are legally compelled to do so (such as responding to a court order), or when necessary to protect our rights, protect the safety of our users or others, investigate fraud, or enforce our terms and policies. We will only disclose the minimum necessary information.
• Business Transfers: If Publication Academy, Inc. is involved in a merger, acquisition, bankruptcy, or sale of all or part of its assets, your information may be transferred to the successor entity. We will ensure the new owner continues to honor the commitments made in this Privacy Policy.
• Aggregated Data: We may share aggregated, anonymized information publicly or with partners. Such reports will not contain any personal identifiers that could be traced back to any individual user.
• No Sale of Data: We do not sell your personal information to third parties, and we do not share it for behavioural advertising purposes.

We keep your personal information for as long as necessary to fulfil the purposes described in this Privacy Policy. However, you have control over your data as described below:

• Account Duration: Your data is retained for as long as your account remains active. We may periodically deactivate or anonymize accounts that have been inactive for an extended period, in accordance with our data retention policies.
• User Requests: You can delete your account and personal data at any time directly from your Profile settings. Once deleted, your personal information — including your bio, profile picture, profile data, writing session records, projects, tasks, and connections — is permanently removed from our production systems within 30 calendar days and cannot be recovered.
• Backup and Archival Copies: When we delete data from our active database, it might remain in encrypted backups for a short period until those backups are cycled out. We protect any data in backups just as we do live data and purge backups regularly. Data persisting in backups will not be restored except if required for disaster recovery, and even then, deletion processes would be re-run.
• Aggregated/Anonymized Data: We may retain aggregated analytics or anonymized information even after your personal data is deleted. This data cannot be linked back to you or any specific user.
• Legal Retention Requirements: In rare cases, we might need to retain certain information for longer if required by law (e.g., to comply with record-keeping regulations, to resolve disputes, or to enforce our agreements). In such cases, we would retain the necessary data only for the legally required period and then delete it.

We respect your rights to your personal data. Different laws provide rights to individuals (e.g., state laws in the U.S. or GDPR in Europe). WriteSTREAK is designed to facilitate these rights, and we provide a straightforward process to exercise them:

• Access and Correction: You have the right to access the personal information we hold about you and to request that we correct or update any information that is inaccurate or incomplete. Most of your profile information can be updated directly in your “Profile” settings while logged in.
• Deletion: You can request that we delete your personal data (the “right to be forgotten”). If you ask us to delete your information, we will remove your personal data from our systems (aside from any data we are required to retain by law) and confirm to you once it is done.
• Objection/Restriction: If you believe we are processing your data in a way you object to, you have the right to object to certain uses of your data. For example, you can object to receiving any non-essential communications. In certain circumstances, you may also ask us to temporarily restrict processing of your data.
• Data Portability: To the extent required by applicable law, you have the right to obtain a portable copy of the personal data you have provided to us. If you need a copy of your data in a common format (e.g., CSV or JSON), contact us and we will work with you to provide it.
• Consent Withdrawal: If we ever rely on your consent to process any personal data, you have the right to withdraw that consent at any time. Withdrawal of consent will not affect the legality of any processing done prior to withdrawal.
• Non-Discrimination: We will not discriminate against anyone for exercising their privacy rights. If you exercise any of these rights, we will not deny you our services, provide a lesser experience, or do anything punitive as a result.

To exercise any of these rights, contact us at support@writestreak.ai. Please describe your request with sufficient detail so we can process it. For certain requests, we may need to verify your identity to ensure we are protecting your privacy. There is no fee for making these requests, and we will respond within the time required by applicable law.

For our university clients and users in educational settings, we recognize the importance of the Family Educational Rights and Privacy Act (FERPA). FERPA is a U.S. federal law that protects the privacy of student education records. While WriteSTREAK itself does not collect traditional education records like grades or transcripts, we may handle personal information about students (e.g., names and university e-mail addresses used to register for WriteSTREAK, which can be considered “directory information” under FERPA).

“School Official” Exception

Under FERPA, a school can disclose students’ education records to a third-party vendor like WriteSTREAK without student or parent consent if certain conditions are met (the “school official exception”). We affirm that we operate in accordance with those conditions: WriteSTREAK serves as a writing accountability and productivity platform on behalf of the institution, and we are under the direct control of the educational institution with respect to the use and maintenance of any education records we handle. We use student data only for the purposes authorized by the institution and do not re-disclose personally identifiable information from education records to other parties, unless specifically authorized by the institution or otherwise allowed by law. We will also notify the institution in the event of any unauthorized access to student data and assist with any required response.

Data Protection Addendums

If an Institution requests one from support@writestreak.ai, we will provide a Data Protection Addendum (DPA) confirming that both parties understand their responsibilities under FERPA and other student privacy laws.

WriteSTREAK may be used by universities and users around the world, including in the European Union (EU), European Economic Area (EEA), the United Kingdom (UK), and other regions with data protection laws. If you are located outside the U.S., please note the following:

Legal Basis for Processing

If you are in the EU, EEA, or UK, we process your personal data on one or more of the lawful bases under the General Data Protection Regulation (GDPR). In most cases, the primary basis is “performance of a contract” (GDPR Article 6(1)(b)), meaning we process your data to provide the services you (or your institution) have requested. Other bases may include our legitimate interests (GDPR Article 6(1)(f)) or compliance with legal obligations (GDPR Article 6(1)(c)).

Data Subject Rights

Users in the EU, EEA, and UK have specific rights under the GDPR, which we honor fully, including the rights to: be informed; access your data; have inaccuracies rectified; have your personal data erased; restrict processing; data portability; object to certain processing; and not be subject to solely automated decisions with significant legal effects on you.

International Data Transfers

All user data is stored and processed on servers located in the U.S. If you are using WriteSTREAK from outside the U.S., your personal data will be transferred to and maintained in the U.S. If you are in the EU/EEA or UK, we ensure that appropriate safeguards (such as Standard Contractual Clauses under GDPR Article 46) are in place for any transfer of personal data to the U.S.

Right to File a Complaint

If you are covered by GDPR or similar international laws, you also have the right to file a complaint with a supervisory data protection authority in your country. For example, EU users can contact the Data Protection Authority in their respective EU member state, and UK users can contact the UK Information Commissioner’s Office (ICO). We ask that you please try to resolve any concerns with us first, but you do have the option to seek assistance from regulators if you believe your rights have been infringed.

If you are a resident of California, you have specific privacy rights under the California Consumer Privacy Act (CCPA) (as amended by the California Privacy Rights Act [CPRA]). California residents have the right to:

• Know What Data is Collected and Shared: You can request information about the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purpose for collecting it, and the categories of third parties with whom we have shared personal information.
• Access: You can request a copy of the personal information we have about you.
• Deletion: You can request that we delete personal information we collected from you, subject to certain exceptions (e.g., we may retain information required for security, legal compliance, or internal operations as permitted by CCPA).
• Opt-Out of Sale/Sharing: You have the right to opt out of the “sale” of your personal information or the sharing of your personal information for cross-context behavioral advertising. However, we do not sell your personal information to third parties, and we do not share it for behavioural advertising purposes.
• Correct Inaccurate Information: California residents have the right to request that we correct inaccurate personal information we hold about them.
• Non-Discrimination: We will not discriminate against you for exercising any of these rights.

WriteSTREAK employs a variety of technical and organizational security measures to protect your data from unauthorized access, disclosure, alteration, or destruction. Here are some of the security practices we have in place:

• Encryption: We use strong encryption protocols for data in transit (HTTPS/TLS for all web communications) and, as applicable, for data at rest in our databases and storage.
• Access Controls: We limit access to personal data to a small number of authorized Publication Academy, Inc. personnel who need it to operate the service. Internal access is protected by authentication and principles of least privilege. Administrative access is logged and reviewed.
• Secure Infrastructure: We host WriteSTREAK on reputable cloud infrastructure that maintains high security standards, including physical security, network firewalls, and DDoS protection. Our systems are kept up-to-date with security patches.
• Monitoring and Testing: We continuously monitor our Platform for potential security vulnerabilities or unauthorized access attempts and conduct periodic security audits. No passwords are stored in the databases — only one-way hashes — to ensure only users have access to their accounts.
• Incident Response: We have an incident response plan in place. In the unlikely event of a data breach or security incident, we will act quickly to contain and investigate the issue, notify affected users and/or institutions and any relevant authorities as required by law, and take steps to prevent similar incidents in the future.

While we follow industry best practices, we have not yet undergone formal SOC 2 or ISO 27001 certification audits. We are committed to continually reviewing and improving our security measures, and you should also take steps to protect your own account, such as using a strong, unique password and safeguarding your login credentials.

We may update this Privacy Policy from time to time to reflect changes in our practices, to keep up with new legal requirements, or for other operational reasons. If we make material changes to how we handle your personal information, we will provide you with e-mail notice, and the “Last Updated” date at the top of this Privacy Policy will indicate when it was most recently revised. We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information.

If you continue to use WriteSTREAK after an updated Privacy Policy takes effect, that will constitute your acceptance of the changes (to the extent permitted by law). If any changes require separate consent under applicable laws, we will make sure to obtain that consent.

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please do not hesitate to contact us. We will respond within 10 business days.