Your essays are yours. Full stop.
Last updated: 17 September 2026. This policy explains what we collect, why, and the promises we make about your work.
1. Who we are
essaycriteria is an independent study tool that provides AI-assisted feedback on IB Diploma Programme essays — the Extended Essay, the TOK essay and Group 1 Higher Level essays. We are not affiliated with, endorsed by, or connected to the International Baccalaureate Organization. For any privacy question or request, contact us at privacy@essaycriteria.com.
Purpose of our service
Our purpose is to help IB DP students become better writers. A swarm of specialist AI examiners marks your essay against the IB’s published assessment criteria, gives feedback pinned to the descriptors and to lines of your own text, and provides insightful analysis — structure maps, claim→evidence audits and next-draft roadmaps. But we never write for students: no ghost-written paragraphs, no “improved” essays, no text you could paste into your draft. The thinking, the argument and the words must stay yours.
2. Information we collect
Provided by you
- Account details — your email address, either entered directly together with an encrypted password or received from Google when you use “Sign in with Google” (see section 3); if you sign in with Google we receive only your email address. An account isn’t required for your first free criterion.
- Essay submissions — the text or PDF you submit, the task type you select (e.g. EE in History, TOK title 3), and any RPPF reflections you upload.
- Support communications — anything you send us when asking for help.
Collected automatically
- Usage metrics — pages visited and features used, in aggregate.
- Standard technical logs — IP address, browser type and session data, kept for security and reliability.
3. Sign in with Google
This section describes in full how essaycriteria accesses, uses, stores and shares Google user data, in line with the Google API Services User Data Policy.
3.1 What Google user data we access
If you choose “Sign in with Google”, we request only the most basic scope needed to identify you: your email address. That is the single piece of Google user data we receive. We request no name, profile picture or other profile fields, and no access to Gmail, Drive, Contacts, Calendar, photos or any other Google service — we never see your Google password, and we never read, write or monitor any data inside your Google account.
3.2 How we use it
This information is used solely to provide user-facing functionality: to create and identify your essaycriteria account and to authenticate you when you sign in. Your email address is used for nothing else. It is not used to develop, improve or train any AI or machine-learning model, personalised or non-personalised; our essay-marking models only ever see the essay text you submit, never your Google account information.
3.3 How we share it
We do not sell, rent, broker or otherwise transfer Google user data to third parties for advertising, marketing, creditworthiness checks or the creation of databases. The only third parties that ever come into contact with it are the infrastructure providers listed in section 7 (for example, our hosting and CDN provider), each bound by a data processing agreement and acting solely on our instructions to run the service. Any transfer of this data to another app, should one ever occur, will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
3.4 How we protect it
Google user data is stored only on our own systems, encrypted in transit (TLS) and at rest, with access restricted to the engineers who need it and logged and audited, as described in section 6.
3.5 How long we keep it, and how to delete it
Google-derived account data is kept for as long as your account is active. You can revoke essaycriteria’s access to your Google account at any time via Google Account → Security → Third-party apps with account access. To have the data we hold deleted, delete your account in the app or email privacy@essaycriteria.com with a deletion request; we will respond within 30 days. On deletion, the data is removed from our active systems within 30 days and from encrypted backups within 90 days (see section 8).
4. How we use information
- To mark your essay: running the swarm, generating your report, and storing it for your account history.
- To operate and secure the service — preventing abuse, fraud and automated attacks.
- To improve the service using aggregate usage patterns — never by training on individual essays.
- To communicate with you about your submissions and, only with consent, product updates.
- To meet legal obligations.
5. Essay protection commitments
- Your essays are never used to train or improve any AI model.
- We do not sell, rent or share your essays with third parties for their own purposes.
- Your essays are never added to plagiarism databases.
- Essays are stored encrypted, only so you can access your reports. They are not deleted on a fixed schedule — you can delete a submission yourself at any time, or ask us to delete it.
- You may delete a submission at any time; teachers and schools on cohort plans may request deletion on students’ behalf.
6. Security
All traffic is encrypted in transit (TLS) and stored content is encrypted at rest. Access to production systems is restricted to the engineers who need it, logged and audited. Backups are encrypted and follow defined retention policies.
7. Third-party services
We work with a short list of providers, each bound by a data processing agreement:
- AI providers (frontier model engines) — used solely to process your essay for marking, on terms that prohibit them from training on your content.
- Hosting & CDN (Cloudflare) — serving the application and protecting it from abuse.
- Payment processing — card details go directly to the processor; we never see them.
8. Data retention
- Essays and reports: for as long as you keep them in your account. You can delete them yourself at any time, or request deletion from us.
- Account data: for as long as your account is active. On deletion, data is removed from active systems within 30 days and from encrypted backups within 90 days.
- Google account data: as described in section 3.5 — retained while your account is active, and deleted on request within the same windows above.
9. Your rights (GDPR & friends)
Wherever you live, you can ask us to access, correct, export or delete your personal data, object to or restrict its processing, and withdraw consent at any time. Email privacy@essaycriteria.com and we will respond within 30 days.
10. Children & young people
Our users are mostly DP students aged 16–19. The service is not directed at children under 13, and we do not knowingly collect their data. Where local law requires parental consent for younger teenagers, we ask for it. Parents may contact us to review or delete a student’s data at any time — and student data is never used for marketing.
11. Cookies
We use strictly necessary cookies for sign-in and security, preference cookies to remember your settings, and — only with your consent — privacy-respecting analytics that do not build personal profiles. You can manage cookies through the consent banner or your browser.
12. International transfers
Our providers operate globally, so data may be processed outside your country. Where it is, we rely on EU-approved Standard Contractual Clauses and equivalent safeguards.
13. Changes to this policy
Material changes will be announced by email or a notice in the app, with an updated date at the top of this page. Continued use of the service after a change takes effect means you accept the revised policy.
14. Contact
Privacy questions and requests: privacy@essaycriteria.com · General support: support@essaycriteria.com
Student privacy is paramount. We exist to help people learn to write — not to exploit what they write.