Who we are
Professor Turtle (“we”, “us”) is a revision tool for Singapore students from Primary 1 to Secondary 4. It generates practice questions, helps mark answers, and provides revision flashcards. It is available at professor-turtle.com and as an Android app. Questions about this policy: admin@professor-turtle.com.
What we collect
- Account details: your name, username and email address. If you register with a password, we store only a salted bcrypt hash of it, never the password itself. If you sign in with Google, we receive your name and email from Google and no password.
- Your study content: the subjects and levels you choose, the questions generated for you, your answers, marking results, saved drafts, study history, flashcard progress, and Chinese word banks you create.
- Uploaded images: if you upload a photo of a worksheet or handwritten answers, the image is sent to an AI vision service to be read and, where you ask, marked.
- Usage and security data: how many AI tokens you have used each day (to apply the daily limit), and a log of generation requests (time, username, level, subject, outcome) used to run and debug the service. Our servers may record your IP address for rate limiting and abuse prevention.
- Feedback: anything you send through the feedback form, plus the contact detail you choose to include.
- Cookies and local storage: a session cookie to keep you signed in (up to 24 hours), a security cookie that protects against cross-site request forgery, and browser storage for your theme, answer drafts and similar preferences. We do not use advertising or analytics trackers.
How we use it
- To create your account, sign you in, and verify your email address with a 6-digit code.
- To generate questions, mark answers, and show your history and progress.
- To enforce daily usage limits and keep the service secure.
- To respond to feedback and support requests, and to notify the site administrator of new registrations and password-reset requests.
We do not sell your data. We do not show ads. We do not use your content to build advertising profiles.
Who we share it with
We use these service providers to run Professor Turtle. They process data only to provide their service to us:
- AI model providers (OpenAI-compatible providers and the OpenCode gateway): receive the text of your questions and answers, and uploaded worksheet images, to generate and mark content. We do not send your name or email in these requests; we send only a one-way hashed identifier so requests from the same session can be grouped.
- Google: if you choose Sign in with Google.
- Email providers (Brevo and Zoho): deliver verification codes and administrator notifications.
- Hosting (Vercel for the website, Zeabur in Singapore for the server and database, and Cloudflare for network protection).
We may also disclose information if required by law.
How long we keep it
- Your account and study data are kept until you delete your account.
- Accounts that never complete email verification are removed after 24 hours.
- Generation logs are kept in a rolling window; when you delete your account, your username is removed from them.
Deleting your account and your data
You can delete your account at any time from inside the app (use Delete my account), or follow the steps on our account deletion page. Deleting your account removes your profile, drafts, history, flashcard progress and word banks.
Children
Professor Turtle is built for school students and their parents or guardians. Students under 13 should use it with a parent or guardian’s permission. We ask only for the details needed to run an account. If you believe a child has given us personal data without a parent’s consent, email us and we will delete it.
Your rights
Under Singapore’s Personal Data Protection Act you may ask to access or correct your personal data, or withdraw your consent to our using it. Email admin@professor-turtle.com from the address on your account, and we will respond within 30 days.
Security
Connections are encrypted with HTTPS. Passwords are stored as bcrypt hashes, session cookies are HttpOnly and signed, and our systems apply rate limits and request validation. No system is perfectly secure; please use a strong password and sign out on shared devices.
Changes to this policy
We will update this page when our practices change and revise the effective date above.