Privacy Policy

Last updated: 13 September 2026

This policy explains what Physicstan collects, why, who else sees it, how long it is kept and what you can do about it. It is written to be read rather than skimmed past, because the most important disclosure here is one many competing services bury: your physics questions and any homework images you upload are sent to a third-party AI provider outside the EU in order to generate an answer. That is set out in full below.

Who is responsible for your data

Physicstan is operated by Muzammal Amin, a PhD researcher in Physics based in Italy, acting as an individual rather than through a registered company.

For the purposes of the EU General Data Protection Regulation (GDPR) and Italian data protection law, Muzammal Amin is the data controller.

Contact for any privacy matter: contact@physicstan.com

Because the controller is established in Italy, the GDPR applies to everyone who uses Physicstan, including users in the United States and elsewhere. You get the same rights regardless of where you live.

What is collected

When you create an account

Email address, which is required
Password, stored only as a cryptographic hash and never in readable form
A display name, if you choose to give one
Whether your email has been verified, and the verification token until it is used

When you use the AI

The text of your questions and follow-up messages
Images and PDFs you upload
The AI’s responses to you
Which mode you used, which provider and model answered, timestamps, token counts, an estimated cost figure, and any error codes if the request failed
Your credit transactions, held as a ledger of grants and charges

When you give feedback

Your thumbs up or thumbs down rating
Any comment you write when reporting a problem
A link to the specific message and request concerned

For abuse prevention

A hashed version of your IP address, together with the event type such as registration or trial granted, and the time it happened

Your IP address is not stored in readable form for this purpose. It is passed through a keyed HMAC-SHA256 hash using a secret held on the server, which produces a value that can be compared against other hashes but cannot practically be reversed back into an address.

When you subscribe

Your Stripe customer and subscription identifiers, plan, price identifier, subscription status and current period end
A record of payment-related events received from Stripe

Card numbers never reach this site. Payment details are entered on Stripe’s own hosted checkout page and are held by Stripe, not by Physicstan.

Automatically

Standard WordPress session and login cookies, which are necessary for the site to work
Standard web server logs kept by the hosting provider

Physicstan does not run advertising trackers or sell data to anyone.

Who your data is shared with

These are the third parties involved in delivering the service. All of them act as processors on our behalf, except where noted.

AI providers: Anthropic and OpenAI

To generate an answer, the content of your question, any images or PDFs you upload, and the relevant conversation history are transmitted to a third-party AI provider.

Physicstan currently uses Anthropic (Claude Sonnet) and OpenAI (GPT models), and can be switched between them depending on need. Both are established in the United States. This means your question content leaves the EU.

This is unavoidable for the service to function, and it is why it appears prominently at the top of this policy rather than in a footnote. In practical terms:

Do not upload material you would not want processed by a US company. That includes anything containing personal information about you or others that is not necessary to the physics question. A photograph of a worksheet with your full name and student number written at the top is a good example of something to crop first.
The system does not store the raw provider responses separately by default. That behaviour is a configurable setting and is switched off.
Each provider operates under its own terms and privacy commitments for API usage, which differ from their consumer chatbot products.

Stripe

Payment processing. Stripe receives your payment details directly and provides us with subscription status and identifiers. Stripe is an independent controller for its own payment and fraud purposes.

Hosting provider

The site and its database are hosted on managed WordPress infrastructure. The host has technical access to the server in the course of operating it.

Cloudflare

If bot protection is enabled, Cloudflare Turnstile runs on the registration form and receives the information necessary to assess whether a submission is automated.

Content delivery

Mathematical notation is rendered using the MathJax library, loaded from a public CDN. Loading it exposes your IP address to that CDN in the ordinary way any external asset does.

Legal disclosure

Data may be disclosed if required by law, court order, or to protect against fraud, security incidents or unlawful use.

International transfers

Sending question content to Anthropic and OpenAI, and payment data to Stripe, involves transferring personal data from the European Economic Area to the United States. These transfers rely on the safeguards available under Chapter V of the GDPR, in practice the European Commission’s Standard Contractual Clauses and, where the recipient participates, the EU-US Data Privacy Framework.

You can request further information about the safeguards in place by writing to us.

Why we process it, and on what legal basis

Purpose	Legal basis
Creating and running your account	Performance of a contract
Generating AI answers and storing your conversations	Performance of a contract
Sending the email verification message	Performance of a contract
Granting, holding and settling credits	Performance of a contract
Processing subscriptions and payments	Performance of a contract
Keeping accounting and tax records of payments	Legal obligation
Preventing abuse of the free trial, including hashed IP records	Legitimate interests, in keeping a free tier viable
Security, error logging and debugging	Legitimate interests
Reviewing reported errors to improve answer quality	Legitimate interests
Bot protection on registration	Legitimate interests

Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights, and you can object at any time using the contact address above.

How long it is kept

The defaults are:

Uploaded files: 14 days, then deleted automatically
Conversations and messages: 365 days
Request and error logs: 90 days
Credit ledger: for as long as your account exists, since it is the record of your balance
Hashed IP abuse records: for the configured trial window, which defaults to 30 days
Subscription and payment records: retained as long as required by Italian accounting and tax law, which is longer than the periods above
Account data: until you delete your account

You can delete any individual conversation yourself at any time from your account, without asking us.

Where uploaded files are stored

Photographs and PDFs you upload are deliberately not placed in the WordPress media library, which is publicly served. They are written to a separate private directory outside it, given randomly generated filenames rather than your original filename, and protected by generated deny rules.

Conversations are private records tied to your account. They are never published as pages, never indexed by search engines, and not visible to other users.

Security

Passwords are stored as hashes, never in readable form
Provider API keys are encrypted at rest using AES-256-GCM
Payment card data never touches this server
IP addresses used for abuse control are hashed with a server-side secret
Uploaded files are stored outside the public web root with unpredictable names

No system is perfectly secure. If you believe your account has been accessed by someone else, contact us immediately.

Children and younger students

Physicstan is built for physics students, and many physics students are under 18.

Under the GDPR, where processing relies on consent, children below a certain age require parental authorisation. Italy sets that age at 14. Other countries in the EEA set it between 13 and 16, and the United States applies separate rules to children under 13.

Accordingly:

You must be at least 14 to create an account. If you are under 14, do not register.
If you are between 14 and 18, we encourage you to tell a parent, guardian or teacher that you are using it.
If you are a parent or guardian and believe a child under 14 has created an account, contact us and we will delete it and the associated data.

We do not knowingly collect data from children under 14.

Your rights

Under the GDPR you have the right to:

Access the personal data held about you
Rectify anything inaccurate
Erase your data, subject to records we must keep for tax purposes
Restrict processing in certain circumstances
Portability, receiving your data in a structured, commonly used format
Object to processing based on legitimate interests
Withdraw consent at any time, where consent is the basis

To exercise any of these, email contact@physicstan.com from the address registered on your account. We will respond within one month, as the GDPR requires.

There is no charge for making a request.

Automated decision-making

Physicstan does not make automated decisions producing legal or similarly significant effects about you.

The AI generates educational content, and the free-trial abuse controls make an automated determination about whether a new account receives the free credit allowance. That determination does not restrict your ability to use or pay for the service, and you can ask us to review it.

Complaints

If you are unhappy with how your data has been handled, please contact us first so we can try to fix it.

You also have the right to complain to a supervisory authority. In Italy this is the Garante per la protezione dei dati personali (www.garanteprivacy.it). If you live in another EEA country, you may complain to your own national authority instead.

Changes to this policy

If this policy changes materially, the date at the top will be updated and the change noted here. Continuing to use Physicstan after a change means the updated policy applies.

Terms of Use
Refund and Cancellation Policy
Accuracy and Method, which explains what the AI does and does not verify
Contact