Privacy Policy

Effective date: July 30, 2026 · Last updated: October 2026

Lecto ("Lecto," "we," "us") is a courseware platform operated by Harp AI LLC (Lecto), available at readlecto.com. Lecto turns an instructor's course materials into a mobile-first reading and retrieval-practice experience, with tools for instructors to customize content and track completion.

This policy explains what information we collect, how we use it, and the choices you have. We wrote it to be readable. If anything is unclear, contact us at privacy@readlecto.com.

The short version

Your school owns student data. We process it only to run the course your instructor set up.
We never sell personal information. We never use student data for advertising or marketing.
Student personal information is never sent to any AI model. Our AI features operate only on course content (course text and instructor materials) and instructors' own search queries.
We keep only what the service needs, and we delete it when it's no longer needed or when your school asks.

Information we collect

Information you provide

Account: name and email address; your password is stored only as a cryptographic hash by our authentication provider (Firebase Authentication). We never see or store plaintext passwords.
Enrollment: the course key you enter, which links you to your instructor's course section.
Learning preferences: at signup, students answer three short questions about study habits, used only to select which pre-built version of course features (such as audio) fits best. These answers are never used for advertising or profiling outside the course experience.
Instructor content: instructors may upload course materials (presentations, documents, images) to customize their course.
Messages: messages instructors send to students through the platform.

Information generated by using Lecto

Progress and grades: which sections you complete, when you complete them, practice-question attempts and answers, and the chapter scores computed from completion. For enrolled students these are education records (see FERPA below).
Study activity: time spent reading, highlights, and study cards you create.
Technical data: standard logs (IP address, browser/device type, pages requested) generated by our hosting providers for security and operations.

Information we do NOT collect

We do not collect government IDs, physical addresses, phone numbers, precise location, or biometric data. We do not use third-party advertising trackers.

How we use information

We use information only to: operate the course experience (reading, practice, completion credit, gradebook); show instructors their own students' progress; send course-related notifications (e.g., grade alerts, sent via our email provider with your instructor's address as the reply-to); secure the service and prevent abuse; and improve the product using aggregated, de-identified usage data that cannot be linked back to any student.

We do not: sell personal information; share it with advertisers; use student data for marketing of any kind; build advertising profiles; or use student data to train AI models (ours or anyone's).

AI features (how our AI works and what it never sees)

Lecto uses AI (currently the Anthropic API for content generation and authoring assistance, and the Perplexity API for external source search behind the instructor "Sourced" feature) to help instructors author content: converting uploaded materials into readable blocks, generating practice questions grounded in the course text, writing image descriptions for accessibility, and similar authoring tasks.

Inputs to the AI are course content and instructor-supplied queries only: course text, materials the instructor supplies, and the questions an instructor types when searching for external sources. Student names, emails, grades, progress, and answers are never sent to any AI model. There is no per-student AI processing anywhere in Lecto.
No training: under our API agreements, Anthropic does not use data submitted through the API to train its models, and Perplexity does not use it to train, retrain, fine-tune, or otherwise improve any generative AI models. Perplexity additionally operates zero data retention on the API we use: only billing metadata (tokens, model, timestamp, key identifier) is retained, never prompt or response content.
Generated course content is grounded in the supplied source material. The "Sourced" feature deliberately looks outside it, and returns named citations that the instructor reviews before placing anything. Citations are screened against a denylist, capped at three, one per site. Both paths pass automated quality checks before instructors see them, and instructors can edit or delete anything generated.

FERPA: students at U.S. institutions

Student progress, attempts, and grade data in Lecto are education records under the Family Educational Rights and Privacy Act (FERPA) when Lecto is used in a course at a U.S. institution. The institution owns those records. To the extent the information we collect includes education records, Lecto is considered a school official with a legitimate educational interest under 34 CFR § 99.31(a)(1), performing an institutional service under the direct control of the institution. We use education records only for the purposes authorized by the institution and do not redisclose personally identifiable information from education records except as permitted by the institution or required by law.

Students who wish to inspect, correct, or amend their education records should contact their institution, which controls those records; we support the institution in fulfilling such requests. (You can view and update your own account information, name and email, directly in your profile.)

Sharing

We share personal information only with: your instructor and institution (their own students' data: that's the product); service providers who host and run Lecto under contractual confidentiality and use-limitation obligations: currently Google Firebase (authentication, database, file storage), Vercel (application hosting), Resend (transactional email), Anthropic (AI processing of course content only, no student data), Perplexity (external source search for the instructor "Sourced" authoring feature; course content and search queries only, no student data), ElevenLabs (audio generation from course content only, no student data), and Cloudflare (R2 storage and audio delivery); and authorities when legally required (we will notify the institution of any demand for student data unless legally prohibited).

We never share student data with any third party for that party's own purposes.

Security

We maintain administrative and technical safeguards appropriate to the data we hold: encryption in transit (TLS) and at rest (provider-managed), authentication on every request that reads or writes personal data, server-verified grade and completion writes (clients cannot write grades), role-based access rules enforced at the database layer, and dated internal security audits with tracked remediation. Our infrastructure providers (Google Cloud/Firebase, Vercel) maintain SOC 2 Type II certification.

If a breach affects your data, we will notify affected institutions without undue delay and no later than 72 hours after confirmation, with enough detail for the institution to meet its own notification obligations.

Data retention and deletion

Active accounts: we retain data while the account and its enrollments are active, including across terms so students keep their own study history.
Course archival: archived courses retain grade records per the institution's needs; students lose access, instructors retain gradebook history.
Account deletion: you may request deletion of your account at privacy@readlecto.com; we honor requests within 30 days except data we must keep for the institution's education records or legal obligations.
Institutional termination: when an institutional agreement ends, we return or delete the institution's student data per our Data Processing Agreement, available to institutions on request, and certify deletion on request. The institution has 60 days after termination to export its data; we then delete it within 30 days.

Minors

Lecto is designed for higher education. It is not directed to children under 13, and we do not knowingly collect information from children under 13 (if we learn we have, we will delete it. Contact us). Some college courses include students under 18 (e.g., dual enrollment); their data receives the same FERPA protections described above, and we rely on the institution to have obtained any consents its policies require.

State privacy rights

Depending on your state, you may have rights to access, correct, delete, or obtain a copy of your personal information (e.g., under the California Consumer Privacy Act and similar laws). Contact privacy@readlecto.com to exercise them; for education records, we will route the request through your institution as FERPA requires. We do not sell or "share" (as CCPA defines it) personal information, so there is nothing to opt out of.

Changes

We will post updates to this policy on this page and update the date above. For material changes affecting student data, we will notify institutional customers at least 30 days in advance.

October 2026: updated the description of the service in the introduction, and changed "textbook text" to "course text" in the AI sections.

Contact

Harp AI LLC (Lecto)
2139 W Martin Luther King Jr Blvd, Unit 528
Fayetteville, AR 72701
Phone: (479) 579-9392
privacy@readlecto.com