Your data, explained plainly.

Effective date: October 9, 2026

1. Scope

This Privacy Policy explains how El Dorado Ignition LLC, a Wyoming limited liability company that owns and operates Silent Student (“El Dorado Ignition,” “we,” “us,” or “our”), handles information in connection with Silent Student, its desktop application for macOS and Windows, the silentstudent.com website, and the api.silentstudent.com backend. Silent Student connects to a student’s own Canvas or D2L Brightspace account and can complete quizzes, essays, discussions, file uploads, and work in supported external courseware reached through the LMS.

2. Information that stays on your device

The Silent Student desktop app runs locally on your machine. Your LMS credentials are stored locally on your device and are never transmitted to our servers. Those credentials allow the app to sign in to the LMS account you connect. Protecting access to your computer and local account is therefore important.

3. Information processed by our backend

Some information must be processed online for the service to work:

• Account information. The backend stores your account email, the name you give when you sign up, and a hashed version of your Silent Student account password. Every signup form — with or without a promo code, and through a personal invitation from our waitlist — also asks for your phone number. It is optional, leaving it blank does not affect your signup, and we store the number you give with your account. It does not store your LMS password.
• Assignment content. Question text and page content needed to complete work are transmitted to api.silentstudent.com. The backend relays that content to third-party AI model providers — currently Anthropic, Google, OpenAI, Z.ai, DeepSeek, and xAI, reached directly or through OpenRouter, for AI processing.
• Subscription information. We store your subscription and billing state so the app can determine which plan is active.
• Usage records. We store per-request API usage records, including how long each request took, to attribute AI processing costs to the correct account.
• App status. While the desktop app is open, it tells our backend about once a minute that it is online, with its version, your operating system, whether the bot is idle, syncing or working, and the kind of work it is doing (for example, a quiz on Canvas). It never sends assignment names, page content or answers. We keep the latest status for a few minutes, and a content-free operational log of service events (such as this status, request outcomes and costs) for about a day, to keep the service running and to spot outages. Members of our team can see which signed-in users currently have the app open. When your bot starts a stretch of work, our team is also sent a short notice by email naming you (your name and email address), your plan and the kind of work (for example, a quiz on Canvas), so we can watch for problems as they happen; it never includes assignment names, questions, answers or page content. These notices are kept as described in section 9.
• Support conversations. If you use the in-app chat (SilentStudent Help), we store the messages you and our team exchange and when each was sent. A few technical details travel with your messages so we can help faster: your app version, your operating system, and which screen of the app you were on. The conversation is tied to your account, so it appears on every device you sign in on, and members of our team can read it, including in our private admin app. While you are signed in, the app regularly asks our backend for new replies — every few seconds while the chat panel is open, and about every 15 to 45 seconds otherwise — and tells it whether the panel is open and whether you are typing. We keep those two signals for only a few minutes, so each side can see when the other is online or typing, and so we can tell you when we have replied. We also store which messages each side has seen, with the conversation, so you and our team can see when a message has been read. When you open the chat or send a message, our team is notified so we can answer quickly: the notice names you (your name or email address) and includes your plan, app version and the screen you were on, and a notice about a message you sent includes a copy of that message. These notices are sent to our team by email. Copies of them are kept as described in section 9. Please do not send passwords or payment details in the chat. We automatically hide text that looks like a password, card number, or access token before it is stored, but you should not rely on that.
• Run history. After each assignment run, the desktop app reports how it went: the kind of work (for example, a Canvas quiz or a WebAssign homework), when the run started and ended, how it ended (for example, submitted, partly done or stopped), whether the app could confirm the work was saved, and, once your platform or course shows one, the score as points earned out of points possible. It never sends assignment or course names, questions, answers or page content. We link each run to the AI usage records it produced, use this history to see how reliably Silent Student completes work and to fix problems, and keep it until your account is deleted.
• Downloads. Each time the installer is requested from our download link we record which account was signed in (or that none was), when, which platform and version, whether the download was handed over or refused (for example, no active plan), your IP address and the network provider it belongs to, your browser’s User-Agent and platform hints, your language settings, the site you came from, and the website visitor identifier described in section 6.
• App installs, launches and sign-ins. The desktop app keeps a random install identifier in its data folder. From the first time it opens — before you sign in — it reports each launch with that identifier, the app version, your operating system and version, the processor type and number of cores, the amount of memory, the computer’s model name, and your language and time zone; our backend adds your IP address and its network provider. When you sign in or out of the app, that is reported too and the install is linked to your account. Every sign-in also records whether it happened on our website or in the desktop app. We use this to know whether people who download Silent Student install it, open it and sign in. If an install never signs in, we may compare its IP address with recent downloads to estimate that it came from the same place.
• Referral networks. If you sign up with a campus representative’s referral code, that representative can see you in their rep dashboard: your name, email address and phone number if you provided one, when you joined, your plan, your subscription status and renewal date, and the commission your subscription earns them. Representatives higher up the same referral network see you in the same way. We show this so representatives can be paid and can help the people they referred.
• Representative materials. If you are a campus representative, we store the onboarding files we prepare for you, such as your guide and your poster (which carry your name, referral code and school), so you can read and download them from your rep dashboard. Our staff can view a representative’s dashboard read-only to help them. These files are deleted when your account is deleted.
• Customer and outreach records. Our team keeps a contact record for each account and waitlist entry, copying the name, email address, phone number, plan and status described above, with the team’s own notes, tasks, call outcomes and how long each call lasted. These records also hold information about people who are not customers, such as members and officers of student organizations we contact about Silent Student: a name, organization, school and public profile link, and an email address or phone number that we or our tools collected from public web pages (for example a chapter website) or that we imported, together with the page each detail came from. A collected detail is treated as unverified until a team member reviews it. When we message student organizations on social media, we record the profile we messaged, the messages sent and received, whether the tracked link in a message was opened (not your IP address or browser details), and whether you asked us to stop; once you ask, we do not message you again. If our team calls you from our Google Voice account, we import the call history Google provides for that account and attach it to the record holding your number. So that our team recognizes your call or message, we may also copy your name, a phone number a team member has confirmed, and your email address, organization and school from these records into the address book (Google Contacts) of that same Google account. We do not record calls. We use these records only to contact people about Silent Student, and we do not sell them. These records are kept when an account is deleted or a waitlist entry is removed (section 10).

4. Payments

Stripe processes subscription payments for Silent Student. Card details are entered and handled by Stripe and never touch our servers. We receive and store the subscription and billing state needed to provide access, but not your full card number.

5. App diagnostics and error reports

Advanced app diagnostics are required. Advanced diagnostics are a condition of using the Silent Student desktop app (section 8 of the Terms of Service). Before you can continue, the app asks you to accept the Terms, including this section, and we record which version you accepted and when. There is no setting that turns diagnostics off. If you do not want diagnostics collected, do not use the app; you can delete your account at any time (section 10). App versions released before this requirement keep the diagnostics choice you made in them until they update.

With Advanced diagnostics, the app reports assignment and course sync outcomes, errors and crashes, app/build and software version information, code locations, recent feature actions, technical vision-agent steps and breaks, and notification delivery failures. Technical reports exclude typed input and coursework content and are retained for up to 365 days; pending offline technical reports are retained on your device for up to 14 days. Advanced diagnostics also record every page the bot works on during a Vision session — not only pages where it gets stuck — including screenshots, stripped page HTML, step observations, the answers the bot typed or selected, and whether each action worked. Those pages may show your name, classmates’ names, grades, and coursework. We exclude passwords typed into password fields, cookies, and attached files. Sign-in, SSO, account, and roster pages the bot passes through are recorded like any other page, including screenshots and stripped page HTML. Full Vision screenshots, page HTML, and step observations are kept for 14 days, then reduced to key moments and deleted after 90 days. A record of what the bot did, without pictures, HTML, or typed answers, is kept until you delete your account or ask us to delete it. Reports and traces are linked to your account and may be reviewed by our team and its AI debugging tools to improve prompts, tools, and models. We do not send this Vision corpus to a third-party vendor for training. Reports and traces already received can be deleted by contacting support, and account deletion removes them.

Operational records needed to authenticate accounts, enforce security, bill for the service, and process requested AI operations are separate from diagnostics and are described elsewhere in this policy.

Error reports you submit yourself from an assignment or from Settings are sent only when you choose to send one. Messages you send in the support chat (section 3) are likewise sent only when you send them; they are separate from Advanced diagnostics.

6. Website analytics

We use Google Analytics for Firebase on silentstudent.com to understand how visitors find and use the website. This service may collect page views, referring pages, interactions, browser and device information, approximate location derived from an IP address, and online identifiers such as cookies or app-instance identifiers. Google processes this analytics information on our behalf. We use it to measure website performance, understand which content is useful, and improve the site and our marketing. We do not use this data to identify assignment content or LMS credentials.

We also collect first-party website activity on our own servers. For each visit we record the pages you open (the page address on our site, never anything after a “?” or “#”, and only the page’s own published address — an address typed by hand that is not one of our pages is recorded only as a page category), every link or button you click (which element it was, its visible label and, for a link, the page it points to, without any query string), how long each page was in view and how far down it you scrolled, a per-tab visit identifier, and a fixed set of actions such as opening pricing, choosing a plan, starting or completing signup, continuing to Checkout and clicking Download. Each record also includes when it happened and when it reached us, a random event identifier used to avoid counting a retry twice, a random visitor identifier, recognized campaign/source/medium categories, the referring site's hostname, browser-reported automation, your time zone, language and screen size, your browser’s User-Agent and operating system and browser versions where available, and your IP address. We never record what you type into a form, and never passwords.

The visitor identifier is stored in your browser and is random; it is not derived from you or your device. Clearing your browser storage resets it. A bounded campaign context can remain in the same browser tab for up to 24 hours so it survives a link to the signup page. To retry an interrupted send, the browser can keep up to 100 of these events for up to seven days. Successful sends are removed from that queue. Browser storage limits, blocking tools, and offline periods can prevent some events from reaching us.

Our backend receives an IP address with each request and stores it with these website records. It also uses the address to look up a network name and broad category, such as a university, company, cloud or home internet provider. The network lookup uses GeoLite2 data created by MaxMind, available from https://www.maxmind.com, entirely on our server; we do not send information about your visit to MaxMind.

Separately from those analytics records, our website host keeps ordinary web server logs. silentstudent.com is served by Firebase Hosting, operated by Google, which records each request it handles: the date and time, the page requested, the response it returned, the referring page, the user-agent string your browser sends, and the IP address the request came from. Unlike the analytics above, these logs do contain your IP address. We use them for security and to tell automated traffic apart from real visitors — a task the analytics above cannot do, because automated clients generally do not run the code that produces those records. The logs are retained for 14 days and then deleted automatically.

Who a visit belongs to. When you are signed in on our website, your browser sends your sign-in session with these records and we link them, and every earlier visit recorded with the same visitor identifier, to your account. The same link is made when you create an account through ordinary or promo signup (your browser submits its visitor identifier and campaign context with that request), and when you download the installer while signed in. This is a browser-reported connection: a shared browser does not prove that the account holder performed every action. Signup and waitlist contact details remain in their account or entry records; they are not sent as website activity properties.

We keep website activity records for up to 90 days, and download records, app install and launch records, sign-in records, links between a browser and an account, and signup attribution for up to 365 days. Existing unversioned website records remain subject to the earlier account and waitlist deletion process. Account deletion removes the account’s download, install, sign-in and website activity records and its browser links, and a visitor trail that is no longer referenced by another account or entry; waitlist deletion removes the entry’s attribution the same way. For up to 90 days after that deletion, we keep a SHA-256 hash of the random visitor identifier to reject delayed retries from an old browser queue. This suppression value is derived from the random identifier, not from an email address, IP address or device information.

If you join our waitlist, the form submits the same kind of browser-reported acquisition context — the random visitor identifier, the referring site's hostname, the campaign and the page you joined from — and we store it alongside your email address, so we know how people who joined found the site. The waitlist form also asks for your name, a phone number, and which plan you were reading about. Only your email address is required; the others are your choice, and leaving them blank does not affect your place on the list. You can ask us to delete your waitlist entry and the associated records at any time by contacting support.

We do not send text messages unless you have specifically asked us to. If you give us a phone number, we store it, but a number on its own is never used to contact you. The form carries a separate, unticked checkbox asking whether we may text you when signups reopen. If — and only if — you tick it, we also record the date and time you agreed and the exact wording you agreed to, so that both of us have a record of what was asked and answered. If you leave it unticked, we hold your number and do not message it. We do not use it for marketing and we do not share it. You can withdraw that permission at any time by contacting support, and you can reply STOP to any message we send.

7. How we use information

We use the information described above to authenticate Silent Student accounts, provide AI processing, maintain subscription access, attribute API costs, measure how reliably Silent Student completes work, understand how visitors find and use the website, respond to support requests (including conversations in the in-app chat, which our team may read to answer them and to keep the service safe), investigate errors, and improve Silent Student’s AI using the diagnostics described in section 5. We do not sell personal information and do not share it with advertisers.

8. Services involved in processing

Assignment content is relayed to third-party AI model providers — currently Anthropic, Google, OpenAI, Z.ai, DeepSeek, and xAI, reached directly or through OpenRouter, for AI processing; OpenRouter routes requests to several of those providers. Stripe processes payments. Google provides Firebase and website analytics, and Google Workspace runs our Google Voice line and its address book. Cloud hosting and storage providers run our backend and hold the data it stores, including diagnostics. Resend sends our account emails, including a short notice, with no message text in it, when our team has replied in the support chat and you are not in the app. Resend also delivers the notices to our team described in section 3, including the copy of each support chat message you send. The support chat does not use a third-party chat service: conversations are stored in our own database. These services handle information as part of the functions described in this policy. Silent Student can also interact, at your direction, with Canvas, D2L Brightspace, WebAssign, Apex Learning, Cengage, McGraw Hill, Packback, and myBusinessCourse through your LMS session. Your use of those services remains subject to their own policies.

9. Data retention and security

We keep account email, hashed password, subscription and billing state, and per-request API usage records as needed to operate accounts, provide the service, and maintain relevant business records. Support chat conversations are kept while your account is open. Once a conversation has been marked resolved, we delete it 12 months after its last message. Most emails we send, including the notices to our team described in section 3 (which name you, and for a support chat message include a copy of it), are also kept in our support mailbox and email archive. We no longer copy password-reset links or account-deletion codes to that archive. Copies sent under the earlier archive practice may still exist. Our team's private admin app keeps a content-free activity list (for example, that an account signed up, a payment was received, a run failed or a support message arrived) for up to 90 days; it stores identifiers only, never message text, and shows a name or email address from the account record only while a team member is viewing it. Archived copies are not removed by the 12-month conversation deletion or by the account deletion described below; you can ask support to delete them. No method of storage or transmission is completely secure, but the local credential design limits LMS credentials to the user’s device.

We retain content-free account activity records, such as signup, sign-in and sign-out times and the authentication method, for up to 365 days. We also retain email delivery metadata for up to 365 days: a message category and account or waitlist reference where applicable, provider message identifiers, send-attempt outcomes, and delivery, bounce, complaint, open or click events when our email provider supplies them. This metadata does not contain the email body, subject, recipient address or credential links. Open and click signals can be generated by mail privacy features or security scanners and do not prove that someone read a message. Account or waitlist deletion removes the associated collection metadata; mailbox copies and provider-held records follow the processes described elsewhere in this policy.

If we terminate an account under section 6 of the Terms of Service, we delete the personal data held for it — the email address, name, sessions, support reports, support chat conversations, any stored diagnostic screenshots, any stored vision-session traces (screenshots, stripped page HTML, step observations, and step records), any representative onboarding files, and your run history — and replace the address on the account record with a placeholder that cannot receive mail. Purging or erasing an account also deletes the admin activity records about it and any admin push-notification devices. Our customer and outreach records are kept, as section 10 describes. Two things deliberately survive that deletion. The first is a limited termination record, which includes a one-way cryptographic hash of the email address; a hash is not the address and cannot be reversed to recover it, and we keep it so a permanent termination can actually be enforced against a new signup and so the decision can be reviewed or lifted later. The second is our billing and API cost records, which no longer identify you and which we retain for tax, accounting, and payment-dispute purposes. Personal data is normally deleted 30 days after termination, so that a disputed or mistaken termination can still be reversed; we may delete sooner at your request. If a termination is lifted and you open a new account on the same address, deletion and billing status are tracked for that new account; the limited audit record of the earlier termination and deletion is retained.

10. Your choices and account deletion

You decide whether to submit error reports yourself. Advanced diagnostics are required while you use the desktop app (section 5); to stop them, stop using the app and delete your account. You may delete your Silent Student account yourself from your Account page (Delete Account, confirmed with a one-time code sent to your account email), or ask support to do it. Deleting your account signs you out everywhere and cancels any subscription immediately, without a refund for the rest of the billing period. When your account is deleted we delete the personal data described in section 9, including any support chat conversations (copies of emails already sent to our support mailbox remain until removed, as section 9 explains), and replace your email address on the account record with a placeholder; the de-identified billing and API cost records described there are retained. A deletion you request does not create a termination record and does not prevent you signing up again later. Our customer and outreach records (section 3) are kept when you delete your account or remove your waitlist entry: the record stays, marked to show the account was deleted or the entry removed, with the contact details, notes and call history it already held, so our team keeps a history of who it has been in contact with. To have those records deleted too, email support; we also remove any copy of your details from our Google Contacts address book. They are deleted without a request only when an entry belongs to someone under 13 (section 11). If you are not a customer and want your information removed from our contact records, email support and we will delete it. An administrator may erase an account without a refund, stop its future billing, and release its email address and trial eligibility for a new registration. A separate administrative history record may retain the account’s name, email address, original creation date, and erasure date until that record is separately deleted; it contains no passwords, password hashes, login tokens, or payment credentials. Deleting that identity record does not delete the de-identified billing, referral earnings, API cost, or administrative audit records we retain. Backups expire through their normal retention process and cannot be instantly erased by an account action. A deletion request concerns information we control; information held by Stripe, AI model providers, your LMS, or external courseware may be governed by those services’ own processes and policies.

11. Children

Silent Student is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. Every form that creates an account or joins our waitlist asks for your birth year, and only when the year alone cannot tell, your birth month or day. If the answer shows you are under 13, we do not create an account or a waitlist entry and we do not keep the answer. We do not store anyone’s birth year or birth date, including when the signup goes ahead.

After an under-13 answer, the browser that gave it is blocked from our signup forms for 24 hours. The block is a small cookie that holds only the value “1” and no identifier. While it is set, our website analytics described in section 6 do not run and no visitor identifier is created in that browser. If the block is applied after the page opened, collection stops and the browser's pending first-party analytics events and visitor identifier are cleared. If someone under 13 opens a personal invitation we emailed from the waitlist, we delete the waitlist entry behind that invitation, including its email address, phone number, and name, together with the customer and outreach records that carry that email address, including any social media messages and contact details we held for a profile listed with that address, and we remove any copy of those details from our Google Contacts address book. The invitation stops working. Copies of emails we already sent to that address may remain in our support mailbox until they are removed. If you believe a child under 13 has given us personal information, contact support and we will delete it.

12. Changes to this policy

We may update this policy as Silent Student or its data practices change. The effective date at the top identifies the current version. When a change materially affects how we collect or use your information, the desktop app asks you to accept the updated Terms before you can keep using it.