Privacy
Updated October 14, 2026
Short version: your pages stay on your iPad. When you tap Check, Clean up page or Talk, only what that needs leaves the iPad, and only to the services below.
What stays on your iPad
Your pages, imported PDFs, ink, saved mistakes, settings and streak stay on your iPad. There are no accounts and no sync. We can't see these files and we don't back them up. Delete everything in Settings wipes them from the iPad.
Who receives what, and why
When you tap Check or ask, the app sends our coach server (coach.dmchang.xyz) a picture of your page and what you typed, with a few lines of context such as the text printed on your PDF and your recent questions. The server routes this through a cloud provider to the models below. Nothing is sent in the background. The coach server only answers devices paired with an invite code the owner hands out; there is no open sign up.
Anthropic Claude writes the coach reply, reading the page picture and your words. Anthropic also transcribes Clean up pages and scans. Google Gemini is the backup for the coach reply, Clean up pages and scans. It also powers live voice when the server picks it. OpenAI checks safety and voice. Its reply judge reads the coach reply words for leaks, its moderation reads what you sent and what the coach said, and each finished Talk line is checked the same way. On Check, OpenAI also sees small pictures of single handwritten lines, to double check what the coach read, plus your page lines and your question, to judge whether the reply makes sense. It never gets the whole page picture. Clean up page sends OpenAI no page picture at all. During Talk, OpenAI receives your voice and the page picture when it is the Talk voice below.
Talk runs through our coach server by default. Your voice and a small picture of the page travel through our server to the Talk voice, which is OpenAI by default and Google Gemini when the server picks it. Only the emergency fallback talks straight to the voice service from the iPad, using a short-lived credential our server mints for that one session.
When you paste a link, your iPad opens that website itself to show its title on the card. That site sees a visit from your iPad, the way it would if you opened it in a browser. The coach sees nothing about the link.
If you add your own AI key in Settings, the key stays on your iPad and is sent only with your own Check requests. It is never written to our logs. Talk and Clean up page never use your key.
What we keep
We never keep the picture of your page. During the beta our server keeps a short text log of each Check so we can find and fix bugs: what you typed, what the coach read from your page, and what it replied. Each log is deleted after 30 days, or sooner if you ask.
Safety flags keep the category only, never your words. The usage log keeps costs and timings, never page pictures, words, keys or code.
Kids and parents
Pencil Coach is for ages 13 and older. The app asks for your birth month and year at the start and stops under 13s there. It keeps only the answer, never the birth date.
Parents and guardians: you can ask what was kept, ask for it to be deleted sooner than 30 days, or withdraw consent with the Withdraw consent row in Settings. Withdrawing consent clears the agreement and turns the coach off on that iPad.
The beta list
If you join the beta list, we store your email address, the date you signed up and which button you used. We use it to email you about the beta, nothing else, and we don't share or sell it. The first beta groups are for testers 18 and older in the US. To be removed, email [email protected].
This website
This site is hosted on Cloudflare Pages. It sets no cookies, runs no analytics and loads no ads or trackers. Its fonts are hosted here, not on a third party.
Age
Pencil Coach is for people 13 or older. See Kids and parents above.
Changes and questions
If this changes, we update the date at the top. Questions, want something deleted sooner than 30 days, or want to report a bad or harmful coach reply? Email [email protected].