Lecture Lab · Privacy Policy
Privacy Policy for Lecture Lab
Who we are
Lecture Lab is made by DevX Group LLC. This policy covers the Lecture Lab iPhone app. Lecture Lab has no account and no sign-in.
What stays on your phone
Your lecture recording never leaves your iPhone. Recording, transcription, playback and search happen on the device. The app does not upload the original recording for any feature. If iCloud Backup is on for your iPhone, Apple may include the recording in your own iCloud backup, which DevX Group LLC cannot access.
Board Snap photos you take of the board or slides stay on your iPhone. Text recognition reads them on the device. The photos are left out of iCloud and computer backups and are deleted with their lecture.
Your Terms of Use agreement (version and date) and your yearly renewal reminder record (the reminder channel you chose, when, and the date the reminder is set for) are saved on your iPhone only. They are never sent to us.
Cloud AI only with your permission
Study packs, the podcast, and Ask answers use cloud AI. Before any lecture text leaves your phone, the app shows what is sent and asks you to switch on a permission that starts off. You can give it for one lecture at a time, or once in Settings for the lectures you choose to send. You can withdraw it in Settings at any time. When we change what is sent, the app asks for your permission again before the next cloud request.
Declining keeps recording, transcripts, playback and study material you already saved available on your phone.
What we send, and where
With your permission, the app sends data to DevX Group LLC's server, which is hosted on Supabase, and the server sends the content needed for your request to Google's Gemini models on Google Cloud. What is sent:
- For a study pack or podcast: the lecture's transcript, the text read from your board photos and the second of the recording each was taken, title, course, language and duration, plus an identifier for the lecture. The photos themselves are never sent.
- For Ask: the same lecture details and transcript, plus your question, your recent questions and answers about that lecture, and your playback position.
- For spoken answers and the podcast: the generated text, so it can be turned into speech.
- For Pro features: your subscription transaction, signed by Apple, so the server can confirm you are subscribed.
We do not ask for your name, email or Apple ID. Lecture text is not anonymous, though: a transcript, title or question can contain names or other personal details, yours or other people's. Check what a lecture contains before you send it, and get permission to record or share other people's words.
Google as our service provider
Google processes this content as our service provider, using its Gemini models on Google Cloud's Vertex AI, to generate your study pack, podcast, answers and speech, and returns the result to you. We can switch to Google's Gemini API on the same paid Google account as a backup; the same rules below apply.
Google's terms for these paid services say Google does not use the content we send, or what it returns, to train or improve its models. Google may cache it briefly (on Vertex AI, deleted within 24 hours) and may keep it for a limited time to detect abuse and meet legal requirements, as those terms describe. If the app ever runs on a Gemini service where Google may use this content to improve its models, the permission screen says so before you send anything.
Purchases and subscription checks
If you subscribe to Lecture Lab Pro, Apple handles the payment. We do not receive your payment details, card number, or Apple ID.
To confirm you are subscribed, our server checks Apple's signature on the subscription transaction your iPhone sends with a Pro request. The server may also send your subscription's original transaction ID to Apple's App Store Server API to read whether it is still active, expired or refunded, and holds that answer in memory for a few minutes so it does not ask Apple on every request.
What we keep on our server
Our server does not store your transcript, board photo text, lecture title, course, questions or answers after it sends the response back to your phone.
It does keep records needed to run the service, without lecture or question content:
- Usage counters for daily and monthly limits, stored under a key derived by hashing your subscription transaction ID, so it is not your name or Apple ID.
- Cost and outcome records: which feature was used, whether it succeeded, which AI model answered, token counts, cost and timing. These records carry no user key.
Our logs never contain your transcript, questions or answers. Supabase, which hosts our server, and Google may also process network details such as IP addresses, and the content of your request, under their own terms.
Analytics and crash reports
Lecture Lab has no analytics, advertising or tracking SDK. We do not record which screens you visit or what you tap.
From version 1.1, crash reporting is on. If the app crashes, hangs or a feature fails, it sends a report to Sentry (Functional Software, Inc.), our service provider, in the United States. A report holds the crash stack trace (function names, no values), your device model, iOS version, app version, whether the app was in the foreground, a few screen and app-state names such as "recording started", and, for a failed feature, the place it failed (for example transcription or PDF export) with an error code. A random installation ID, which Sentry creates and which is not linked to your Apple ID or subscription, lets Sentry count how many people a crash affects.
A report never holds your transcript, lecture titles, course names, questions, answers, file names or paths, IP address or screenshots. Sentry keeps reports for 30 days and does not use them for advertising or tracking.
Adults only
Lecture Lab is rated 18+ on the App Store, and its cloud AI features are for adults 18 and older. The permission screen asks you to confirm you are 18 or older. Lecture Lab is not directed at anyone under 18, and we do not knowingly collect information from children.
From version 1.1, on iOS 26 and later, when you turn on cloud AI the app also asks Apple's Declared Age Range feature whether you are 18 or older. You choose whether to share it. The app receives only an age range, never your birth date, and keeps only the answer on your phone. If the range shows you are under 18, cloud AI stays off and nothing is sent; recording, transcripts and playback still work. If you decline or the feature is unavailable, the app relies on your confirmation.
AI-generated content
Study packs, podcasts and Ask answers are generated by AI (Google Gemini) from your lecture. From version 1.1 the app labels them "Generated by AI", each podcast starts with a spoken line saying it is generated by AI, and podcast audio files saved on your phone carry a tag marking them as AI-generated. The podcast voices are synthetic and do not imitate real people. AI output can be wrong, so check it against the lecture.
Your choices and deleting your data
- Choose per lecture whether to send it, or never send anything. Recording, transcription and playback work without cloud AI.
- Withdraw cloud permission in Settings at any time.
- Delete a lecture in the app to remove it from the app on your phone. Deleting the app removes what it stored on your phone.
- Our server keeps no lecture content to delete. For questions about the usage records above, or any other privacy request, email us.
Users in the EU, EEA and UK
If you are in the European Union, the European Economic Area or the United Kingdom, the GDPR or UK GDPR gives you these rights and protections. DevX Group LLC is the controller of the data described here.
- Legal basis.Providing the app and the paid subscription you ask for, including the subscription check with Apple and usage counters for limits: performance of a contract (GDPR Art. 6(1)(b)). Sending lecture text and questions to cloud AI: your consent (Art. 6(1)(a)), which you can withdraw in Settings at any time without affecting earlier processing. Keeping cost and outcome records without a user key, to run and secure the service: our legitimate interests (Art. 6(1)(f)). Crash reports to Sentry, to find and fix faults and keep the app stable: our legitimate interests (Art. 6(1)(f)). Reading the Apple age range, which you choose to share: our legitimate interest in keeping cloud AI for adults only, as our AI provider's terms require (Art. 6(1)(f)).
- International transfers.Our server runs on Supabase in the United States (East US), and Google processes Gemini requests in the United States and other countries, wherever it has capacity. Supabase protects transfers with the European Commission Standard Contractual Clauses (and the UK equivalent) in its Data Processing Agreement. Google LLC is certified under the EU-U.S. Data Privacy Framework and its UK Extension, and its data processing terms also include Standard Contractual Clauses. Crash reports go to Sentry in the United States, under its Data Processing Addendum. You can ask for a copy of these safeguards at privacy@devxgroup.io.
- Retention.Lecture and question content is not stored after the response. Usage counters and the cost and outcome records in section 7 are kept for as long as we need them to enforce limits, account for costs and secure the service; they are not yet deleted on a fixed schedule. You can ask us to delete the counters linked to your subscription at any time.
- Your rights.You can ask for access, correction, deletion, restriction, portability, or object to processing based on legitimate interests, by emailing privacy@devxgroup.io. Because the server keeps no lecture content and no name or Apple ID, we may need you to tell us your subscription transaction details to find usage records.
- Complaints.You have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work, or where you think your rights were infringed. In the UK this is the Information Commissioner's Office (ico.org.uk).
- EU and UK representative.Representative contact details are not yet published. privacy@devxgroup.io is our controller contact, not a GDPR Art. 27 representative. Contact us there to exercise your rights or ask about representation. This does not remove any obligation to appoint a representative where one applies, or limit your right to contact a supervisory authority.
- Automated decisions.The app does not make decisions with legal or similarly significant effects about you by automated means.
Contact
Questions about this policy or about your data: privacy@devxgroup.io
DevX Group LLC, San Diego, California, USA
Changes to this policy
We will update this page when what we collect or how we use it changes, and update the "Updated" date at the top. When a change is significant, the app tells you in the app (on iOS 26.4 and later through Apple's update notice where the law of your region requires it), and asks for your permission again before sending anything if what is sent changes.