Privacy Policy

October 15, 2026 · Seven Systems

This policy covers Northstar Tutor’s web classroom and its Android, iPhone, and iPad apps. Seven Systems operates Northstar Tutor. The apps display the online classroom, so their data practices include the web services used by that classroom.

Learning records on your device

Northstar saves course progress, quiz attempts and results, proficiency records, and answer-review records in your browser or the app’s website storage. The full BCS language course is available during the one-time 10-minute preview, with General Education + Language membership, or through a complimentary grant that includes Language. In the iPhone and iPad apps, the one-time 10-minute guest preview does not require an email address or emailed code; Sign in with Apple remains available for membership purchase and restore. Google and email/password access are described below; the choices offered depend on your app version or account page. Progress stays on this device in an account-specific storage area; membership access, not lesson progress, follows your account across devices. Signing out or deleting an account can clear local progress. These records are not automatically synchronized to a cloud gradebook. Clearing website data or removing the app’s stored data can remove saved progress.

Your account, preview and membership

The iPhone and iPad apps keep a randomly generated guest credential in platform-protected device storage, separate from the expiring sign-in session. Northstar stores a keyed one-way reference to that credential, a random guest account reference, preview-start time and protected session records in encrypted private server storage. The device credential remains across sign-out and session expiry so those actions do not restart the preview. It is not a hardware identifier or an advertising identifier.

When you choose Sign in with Apple, Apple provides an app-specific identifier and may provide a verified email address, including a private relay address if you use Hide My Email. Northstar verifies the Apple response and stores any provided email address, a keyed reference to the Apple identifier and an authorization token in encrypted private server storage to recognize your account and revoke the Apple connection when you delete it. Northstar does not receive your Apple password. Apple sign-in does not automatically merge an existing email account or its purchases, even when the email addresses match.

When you choose Continue with Google where offered, Google supplies a signed identity response with a Google account identifier and verified email address; it may also contain basic profile information such as a name or profile picture. Northstar uses the identifier and verified email to recognize your account, storing the email and a keyed one-way reference to the Google identifier in encrypted private server storage. The Northstar account record does not store your Google profile name or picture. Northstar does not receive your Google password or request access to your Gmail messages, Drive files, contacts or calendar through this sign-in. Google sign-in does not automatically merge an Apple or email account or its purchases, even when email addresses match. Use the same sign-in method as your existing membership.

For email/password accounts, Northstar sends a one-use email-verification and password-setup link through Twilio SendGrid. You choose a password after opening that link, then sign in with your email and password, without entering an emailed login code. Password recovery also uses a one-use email link. Northstar receives the password over an encrypted HTTPS connection to create or check a randomly salted, one-way password hash; it stores that hash, not a readable copy of your password. Account emails contain your email address and the setup or reset link, not your password. We disable click and open tracking for these account emails. SendGrid and the recipient’s mailbox may retain the message and delivery information. Older app versions may continue to offer legacy email-code access for existing accounts through the configured provider, Resend or Twilio SendGrid.

Northstar stores your email where provided, a random account reference, protected sign-in records, the time your one-time 10-minute preview began, subscription verification records and any complimentary grant. These records are encrypted in private server storage. Browser sessions use a secure, HttpOnly cookie; the native apps store their sign-in credentials using platform-protected storage. Account access is not an advertising identifier.

Apple or Google processes in-app payments. Northstar does not receive your full payment-card details. To verify access, Northstar exchanges a random or obfuscated account reference, product and transaction identifiers, signed purchase evidence or purchase tokens, and subscription status with the store. Northstar retains the minimum purchase-verification and ownership records needed to restore and check access, prevent duplicate claims and respond to account support. Complimentary access does not cancel an existing store subscription.

Email-verification and password-setup links expire after 24 hours; password-reset links expire after 30 minutes. Each link can be used once, and completing setup or a reset revokes that email account’s existing sign-in sessions. Legacy email sign-in codes and Apple and Google sign-in challenges expire after 10 minutes; sessions expire or are revoked when you sign out. Expired sign-in, session and rate-limit records are cleaned up during account operations. Temporary keyed IP, email, device and account references limit repeated requests. Guest, account and membership records otherwise remain until deletion.

The iPhone and iPad apps offer deletion of guest preview data and Apple-linked accounts. Apple account deletion requires a recent Sign in with Apple and confirmation that Apple authorization was revoked; if revocation cannot be confirmed, Northstar does not report the account as deleted. Google and email/password accounts can be deleted on the account page after a recent sign-in with the same Google account or password. Legacy email-account deletion requires recent email verification. Deletion removes the active guest or account record, email, stored password hash if any, active sessions, grants, stored purchase evidence and any stored Apple authorization token. Opaque keyed guest-device, Apple and Google identity, and email/account references, preview-start history, transaction ownership and revoked complimentary-campaign markers remain for abuse prevention. These retained records cannot be used to email you and have no scheduled expiry. They are not a renewed subscription or an active free-access grant. Deleting a Northstar account does not delete your Google account; you can separately manage Northstar’s connection in your Google account settings.

Account deletion does not automatically erase provider, email or hosting records already transmitted. It does not cancel Apple or Google billing. Contact support for privacy requests, and cancel subscriptions separately in the store.

The native Google Sign-In SDK may also process data in categories declared by Google, including name, email address, phone number, account and device identifiers, approximate location derived from network information, and sign-in usage or diagnostic data. These categories support authentication, security and fraud prevention, and service operation or analysis; the SDK declaration does not mean that every category is collected in every sign-in. Google may link this information to your account or device. Northstar does not request precise device location or full payment-card details through Google sign-in, and the SDK declares no tracking. This provider-side processing is separate from the limited Northstar account record described above. See Google Sign-In privacy disclosures and Google’s Privacy Policy.

Live AI tutor and microphone

You can use lessons and quizzes without starting a live AI conversation. The subscription classroom does not preload the public Anam widget. The AI notice explains that the optional tutor uses online providers; selecting the tutor button starts the connection. The classroom does not verify age. Language-course tutoring checks access through your signed-in account or active guest preview. For language sessions, Northstar records the provider session identifier, your random account reference and a short session deadline to stop expired or signed-out sessions. These cutoff records are removed after their short recovery window, normally within 65 minutes of issuance when the service is running. When you start the live tutor, Anam and its configured providers process your conversation, including typed messages, transcripts, lesson context, responses, and session diagnostics.

In iPhone and iPad version 1.2, the optional live tutor can use microphone audio when you grant iOS permission. While the tutor is active, audio is sent to Anam and its configured providers for speech recognition and replies. Stop Sabina, leaving the session, or backgrounding the app stops capture; it does not restart automatically. Denying permission leaves lessons and quizzes usable without live voice. Camera capture remains disabled. Earlier 1.1 builds do not enable microphone capture. In a web browser, audio requires browser permission.

On Android, the optional live AI tutor can use your microphone if you grant Northstar Tutor microphone permission. When you use live voice tutoring, audio is transmitted to Anam and its configured providers to recognize speech and produce a reply; transcripts, lesson context, responses, and session diagnostics may also be processed. Android may reuse a permission you previously granted. You can decline or revoke microphone permission and continue using lesson and quiz material. This Android app does not enable camera capture. The separate voice-input button depends on speech-recognition support in the device’s WebView; where available, recognition may use a device/browser service, and the resulting text follows the same handling as a typed response. We do not promise that voice recognition is processed only on your device.

Conversation information may remain with the provider after the lesson; ending a session does not automatically delete provider records. Retention depends on the active service configuration and provider terms. See Anam’s Privacy Policy. Do not enter private health, patient, financial, identification, or other sensitive information.

Read-aloud narration

Online narration starts off and requires a separate agreement to sharing text with OpenAI. When narration is enabled, Northstar sends the text to be spoken through its server to OpenAI’s speech service and returns the generated audio to your device. This is separate from the live Anam conversation. You can turn off classroom narration. Narration and live conversation are online services; they are not processed entirely on your device.

Email summaries and support

If you enter an email address and request a session summary, Northstar sends that address, the lesson and practice summary, and recommended next steps through its configured email provider, Resend or Twilio SendGrid. The summary does not include the full tutor transcript. Requesting it does not subscribe you to a marketing list. Email delivery systems and the recipient’s mailbox may retain the message and delivery information.

If you contact support, we receive the message, your contact details, and any attachments you choose to include. Please send only the information needed to explain your request.

AI content reports

Android and web users can use the Report an AI response form. If you choose to submit a report, Northstar sends your selected reason, the response or description you enter, any optional explanation or lesson name, and any optional reply email to Seven Systems’ Northstar support at cs@sevenhillsus.com through its configured email provider. No conversation transcript, screenshot, or microphone recording is attached automatically. A random request identifier helps avoid duplicate submissions. The server keeps temporary keyed IP hashes, request/content digests, and delivery references for abuse prevention and duplicate handling; report text and delivery records may remain with the email provider and support mailbox. Reports are used to investigate content concerns and improve safety. A submission confirmation means the email provider accepted the delivery request, not that a person has reviewed it or that inbox receipt is confirmed. Privacy and deletion requests can be sent to the contact below.

Technical information and providers

Microsoft Azure hosts the classroom. The classroom also requests Google Fonts and Anam resources. These services receive network information needed to respond, such as IP address, request time, browser or device information, and requested resource. Northstar uses IP addresses and requested-summary email addresses in temporary server memory to limit repeated requests. Hosting and service providers may retain operational, security, and diagnostic records under their service terms.

Where Google sign-in is offered, the web account page loads Google Identity Services to display the sign-in button and complete authentication. Loading that software can send network and browser information to Google before you choose the button. Email password-setup and reset-link pages do not load that sign-in software. See Google’s Privacy Policy and Twilio’s data-protection information for information about these providers. A web sign-in option does not mean every released mobile app version includes the same option.

General service-usage and performance information may also be used for provider analytics, including aggregated and deidentified usage described in the provider’s terms. Microphone permission is not permission to use your conversation for advertising.

The classroom does not include a Northstar advertising or cross-app tracking feature. Information is used to deliver learning, voice and email functions, protect the service, and answer support requests. Provider processing can occur in the United States or other countries where the providers operate.

Younger learners

The Anam live tutor is intended for people age 16 or older. Younger learners should use the lesson and quiz material without starting Anam or submitting personal information. Parents and guardians should supervise younger learners. The current classroom does not verify a learner’s age. Contact us if you believe a child has sent personal information through Northstar.

Your choices and requests

Use “Turn off online AI” in the classroom to withdraw your current AI choices. Northstar stops local narration and live streaming, requests a provider session stop, and asks again before starting either feature. Choices are held only for the current page session; no birth date is requested or saved. Previously transmitted provider records are not erased by stopping. Lesson text and practice remain available within your existing course access.

Use the iPhone or iPad app to delete guest preview data or an Apple-linked account. Google and email/password accounts can be managed or deleted on the account page; use the same sign-in method as your membership. You can decline microphone permission, avoid starting the live tutor, switch off narration, skip email summaries, and clear locally saved website data. Those choices do not erase information already sent to a provider or an email recipient. For questions or requests concerning access, correction, or deletion, contact us below. We may need enough information to locate a record and verify your authority; applicable law and the relevant provider’s process determine how a request is handled.

Contact and changes

Email cs@sevenhillsus.com with the subject “Northstar Tutor Privacy Request.”

We will update the date on this page when the policy changes.