This policy explains what information Shiloh App LLC collects when you use getshiloh.com and the Shiloh iOS app, why we collect it, and the choices you have.
Where Shiloh operates under a separate Data Processing Agreement (DPA) with an institution, the DPA governs in the event of any conflict with this policy as it relates to that institution's students. Please read this policy alongside our Terms of Service at getshiloh.com/terms.
Shiloh App LLC, a Texas limited liability company ("Shiloh," "we," "us"), operates getshiloh.com and the Shiloh mobile app for iOS (together, the "Service"). Shiloh helps college students organize a semester: it reads syllabi to extract deadlines, tracks grades and GPA, and syncs calendars.
By using the Service, you agree to this policy. If you do not agree, do not use the Service. Contact us at help@getshiloh.com.
Account information. Your name, email address, and school (from onboarding). You sign in with Google or Microsoft (web) or Google, Microsoft, or Apple (iOS). We never see or store your password.
Academic content you provide. Syllabus files (PDF or photo), deadlines, grading categories, grades, completion status, class and professor details, GPA and transcript data (uploaded for AI extraction or entered manually), and feedback you send us.
Shared flashcards. If you share a flashcard deck, its cards and your username are visible to other Shiloh users, and anyone can copy the deck. Shared decks don't include your study guide or your notes. Other users see your username, never your email. Shiloh admins who review reported decks can see the author's email.
Study activity. If you use Next bite, we store the small steps generated for your assignments, any time estimates you edit, the assignment prompt if you choose to paste one, how long you spend on a step, and whether you finish or skip it. When a step doesn't happen we may ask what got in the way; answering is optional, and your answer (for example "too big" or "too tired") is stored with that step.
Device and billing information. Push notification device tokens, your subscription, and billing status. Payment card details are handled by Stripe; we do not store full card numbers.
Usage and technical information. Error reports and diagnostics, rate-limiting data, and the cost and volume of AI calls made on your behalf. We use signed session cookies (web) and tokens (mobile) to keep you signed in.
We do not collect precise location. We collect no location data and no advertising identifiers, and we use no ad trackers, in either the web app or the iOS app.
We use your information to:
We do not sell your personal information. We do not use it for advertising or share it with advertisers.
We use the providers below to run the Service. They receive only what they need for their function. AI features send your content to AI providers to generate results; you should not submit anything you are not comfortable having processed this way.
| Provider | What it does | What it receives |
|---|---|---|
| Anthropic (Claude) | Reads syllabi, images, and calendar-assistant actions; breaks assignments into steps | Your syllabus files, images, and prompts. For Next bite, also the assignment's name, class name, due date and grade category, any assignment prompt you paste, and the text of a step you ask us to split or rewrite. We do not send your name or email. Anthropic does not train its models on this content. |
| Cloudflare | TLS and CDN | Traffic |
| Stripe | Checkout, customer portal, subscription webhooks | Email, billing details, subscription status |
| Google, Microsoft, Apple | Sign-in and calendar sync | Account identifiers, and calendar data if you connect a calendar |
| Expo | Push notification delivery | Device push tokens and notification content |
| Resend | Transactional and digest email | Email address and message content |
| Railway | Hosting, database, scheduled jobs | All Service data is stored and processed on its infrastructure |
| Sentry | Error monitoring | Error diagnostics, which may include limited account or request context |
| Redis | Rate limiting | Request identifiers |
If you connect a Google or Microsoft calendar, we access your calendar data only to show your calendar in Shiloh, create or update the deadlines and events you ask us to sync, and run the AI calendar assistant, which changes events only after you confirm. We do not use this data for advertising, do not sell it, and do not allow humans to read it except with your consent, to investigate abuse or security issues, or as required by law. We do not use it to develop or train generalized AI models.
Shiloh's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
You can disconnect a calendar in Shiloh at any time and revoke Shiloh's access in your Google or Microsoft account settings.
| Data | How long |
|---|---|
| Syllabi, deadlines, grades, GPA data | Until you delete your account |
| Next bite steps, pasted prompts, time spent | Until you delete the assignment or your account |
| Next bite activity record (starts, finishes, skips, your answers) | Until you delete your account |
| Billing and subscription records | As required for tax and accounting, even after account deletion |
| Study: questions built from text you paste, short quotes from it, your answers, and your review schedule | Until you delete the set or your account |
| Study questions you flag as "This looks wrong" (the question and its short source quote) | Until you delete your account, so we can fix bad questions |
| The full text you paste into Study | Not stored by us. It stays in your browser tab while you study, and we send it to our AI provider only to write or refine your questions |
| Error logs and AI cost logs | 3 months, even after account deletion |
You can delete your account in the app. Deleting it removes your account and the data associated with it, including syllabi information, deadlines, grades information, GPA data, and Next bite steps and activity. Billing records and logs are kept as described above.
We share information only:
Our team can access your content in limited cases, such as investigating abuse, fixing a bug you report, or complying with the law. Administrator accounts exist for operating the Service.
Shiloh stores user-generated academic data including class names, grading structures, deadlines, and syllabus files. While Shiloh is not itself an educational institution, we handle this data consistently with the Family Educational Rights and Privacy Act (FERPA).
When Shiloh enters a formal agreement with an institution to provide the Service to that institution's students, Shiloh acts as a "School Official" with a legitimate educational interest under FERPA's school official exception (34 CFR § 99.31(a)(1)). In that context, Shiloh's use of student data is limited to the purposes authorized under the applicable Data Processing Agreement. Institutions interested in a formal DPA may contact us at help@getshiloh.com.
Regardless of where you live, you can ask us to:
Email help@getshiloh.com from the address on your account. We will respond within 45 days. If we decline a request, you may appeal by replying to our response, and we will answer the appeal within 60 days. Some laws, including the Texas Data Privacy and Security Act and California privacy law, give residents additional rights, and we honor them where they apply.
Emails. You can turn off the Daily Digest and reminder emails in Settings or through the unsubscribe link in the email. We may still send essential messages about your account, billing, and security.
Notifications. You can turn off push notifications in your device settings.
Cookies and similar technology. We use signed cookies and local storage to keep you signed in and make the web app work offline. We do not use advertising cookies.
Security. Traffic is encrypted in transit, data is scoped to your account in our database, and secrets are kept in access-controlled environment variables. No system is perfectly secure, and we cannot guarantee absolute security.
Age. The Service is for people 13 and older. We do not knowingly collect information from anyone under 13. If we learn we have, we will delete it. If you believe someone under 13 has an account, contact us.
Dual-credit and minor users. Some students who use Shiloh through a partner institution's dual-credit program may be under 18. For these users, we collect and use information only as described in this policy, solely to provide the Service in connection with their coursework. A parent or legal guardian of a user under 18 may contact us at help@getshiloh.com to review, correct, or request deletion of that user's information. We do not use any user's information for targeted advertising or behavioral marketing, regardless of age.
Where data is processed. The Service is operated from the United States, and your information is processed and stored in the United States. If you use it from elsewhere, you understand your information will be transferred there.
Not a school system. Shiloh is not affiliated with any college or university, and you provide your own academic content. Shiloh does not act on behalf of a school, and this policy does not replace your school's own privacy practices.
Changes. If we make material changes, we will give at least 14 days' notice by email or in the app before they take effect. The date at the top shows when this policy last changed.
Shiloh App LLC
Email: help@getshiloh.com
Website: getshiloh.com