Privacy Policy

Last updated: October 16, 2026

Scivra ("we", "us") provides interactive 3D science labs for high school students at scivra.com. Scivra is operated by an individual based in Taiwan. This policy explains what information we collect, why, and how you can delete it. We try to collect as little as possible.

Students and parents

Scivra is designed for students in grades 9–12 and their parents. You must be at least 13 years old to create an account. The service is not intended for children under 13, and we do not knowingly collect their personal information. If you believe a child under 13 has created an account, contact us and we will delete it. If you are under 18, a parent or legal guardian must agree to any purchase, and may complete checkout on your behalf.

Students and parents or legal guardians can email support@scivra.com to request access to, correction of, or deletion of account information. Before sharing or deleting information, we may need to verify the account holder’s identity and, for a parent or guardian’s request, their authority to act for the student. Account holders can also delete their account in Settings → Security.

We keep account information while the account exists and delete it when the account is deleted. Copies may remain in database backups for up to 30 days. The retention periods and exceptions for payment records, logs and messages are explained in How long we keep information. Lab work stays in the learner’s browser; deleting an account clears its lab work only from the browser used for deletion. Other devices’ site data must be cleared on those devices.

What we collect

Account information. Your name and email address. If you sign up with email, we store a secure hash of your password, never the password itself. If you sign in with Google, we receive your Google account ID, name, email address and profile image, along with the sign-in tokens Google issues.

Sign-in sessions. When you sign in, we store a session record with your IP address and browser type. We use it to keep you signed in, to limit an account to four devices signed in at the same time, and to protect your account.

Subscription and payment status. Your plan, its status, billing period, and refund status, plus the identifiers Stripe gives us. Payments are processed by Stripe. We never see or store your full card number.

Free trial start date. The date you first opened a trial lab, so we can apply the 7-day free period. We also keep your free-period reminder preference and whether we attempted the single reminder. You can turn it off in notification settings or through the reminder email.

Account milestones and first source. We record how you first signed up, when your email was first verified, when checkout first started, and when subscription or lifetime access was first paid for. We use these to count conversions; they contain no lab work. When you arrive through a tagged link, we keep its source, medium, campaign and content labels, landing path and first-visit time in a first-party cookie for up to 30 days. If you create an account, we save those labels with your account to count registrations and payments by source. We do not store a full referring URL or your lab activity for this purpose.

Parent payment requests. If a student asks us to email a parent a payment link, we use that address to send the request. We do not store the readable address in our database, logs or analytics, send it to Stripe as the student’s customer email, or add it to a mailing list. We keep a keyed identifier briefly to limit requests, and for 180 days if the recipient blocks further requests. Payment access, billing emails and subscription management belong to the student’s account.

Messages you send us. If you use the contact form or the chat window, we receive what you write and the email address you provide.

Server logs. Like most websites, our hosting provider records each request, including IP address, browser type and the page requested. Our application also logs operational events, such as errors and payment processing. We avoid writing your name or email address into these logs, though an error message passed on from a service provider may occasionally include them. We use logs to keep the service running and secure.

What we do not collect

Your lab work. Predictions, notebook entries, answers and scores stay in your own browser. They are never sent to our servers.
Your date of birth, school, grade, or home address (Stripe may ask for a billing address at checkout).
We do not show ads, sell personal information, share it for cross-context behavioral advertising, or build advertising profiles.

Your lab work on your device

Labs save your progress in your browser's local storage so you can pick up where you left off. Progress is kept separately for each account on a device. When you sign out, the labs switch to a separate guest space, and your saved progress stays on that device for when you sign back in. When you delete your account, we clear that account's saved progress from the browser you delete it from. Progress saved on other devices stays there until you clear that browser's site data.

Cookies and analytics

Our account and interface cookies include a sign-in session cookie, a cookie that keeps lab progress separate for each account, and a cookie that remembers whether the settings sidebar is open. A separate first-source cookie keeps the limited tagged-link information described above for up to 30 days; it is not read or updated by the learning pages. Your light or dark theme and your lab graphics settings are remembered in your browser's local storage. The chat window on public and account pages is provided by Crisp, which loads automatically on those pages and may set its own cookies to keep a chat conversation going. Our analytics on public and account pages use Cloudflare Web Analytics, which does not use cookies and does not track you across sites. The lab pages (/learn and /labs), parent payment pages and recipient-block pages load no analytics or chat tools. Parent payment pages use a short-lived token in this tab’s session storage to restore a request after checkout; the token can only pay for its fixed student and expires with the link. See the Cookie Policy for details.

How we use information

To create and secure your account and keep you signed in
To decide which labs you can open (free, trial, subscription or lifetime)
To process payments, refunds and billing through Stripe
To send account emails you need, such as email verification and password reset
To send one reminder before your free period ends, unless you turn it off; a send attempt does not guarantee delivery
To send a parent a payment request when a verified account holder asks us to
To count account registrations and payments by their first tagged-link source
To tell us, without your name or email address, when a payment succeeds
To send our newsletter, only if you opt in. You can unsubscribe at any time
To answer your questions

Service providers

We share information only with providers that help us run Scivra, and only what they need:

Stripe: payments, subscriptions, billing portal
Cloudflare: hosting, database, request and application logs, cookie-free analytics, sign-up bot check (Turnstile), and email delivery. Emails we send pass through Cloudflare, including their content, such as verification links, free-period reminders, parent payment requests and messages you send through the contact form
Google: sign-in, only if you choose it
Resend: newsletter delivery, only if you opt in
Crisp: the chat window on public and account pages (not on lab pages); it receives what you type in the chat and basic browser information
Discord: internal notifications to our team when a payment succeeds. These contain the plan, amount, time and a shortened internal payment reference, but not your name or email address

We may also disclose information if the law requires it, or to protect the rights and safety of our users or of Scivra.

How long we keep information

Account and subscription records are kept for as long as your account exists. When you delete your account, we delete your account, sign-in methods, sessions, payment records and password-reset records right away. If we cannot cancel your subscription or remove your password-reset records, the deletion does not go through and you can try again.
Account milestones and reminder settings are deleted with your account. Historical event dates that were never recorded are not reconstructed.
Parent payment links expire after 72 hours; their records are removed within a further 7 days after expiry, revocation or completion. Account deletion removes requests immediately. Request-limit identifiers stop affecting requests within 24 hours (IP-derived identifiers within one hour). Expired identifiers are physically deleted by cleanup scheduled every 15 minutes, with any backlog processed oldest first. Recipient block identifiers stop blocking requests after 180 days and are then removed by the same cleanup; you can contact support to remove them earlier. Email providers may keep messages under their own policies; deleting a student account cannot recall a sent email.
First-source cookies expire after 30 days without extending on later visits. Saved account source labels are deleted with your account.
Sign-in sessions stop working when you sign out, when they expire, or when signing in on a fifth device ends the oldest one. Expired session records are removed the next time they are used, and all of them are removed when you delete your account.
Backups. Copies may remain in our encrypted database backups for up to 30 days before they are permanently removed.
Newsletter. Unsubscribing stops all newsletter emails. When you delete your account, we also ask our newsletter provider to remove your email address. If that request fails, your address and its subscription status may remain with the provider. You can unsubscribe using the link in any newsletter email, or contact us and we will remove it.
Chat and email messages. Deleting your account does not automatically delete chat conversations in Crisp or emails you sent us. We keep emails for up to 12 months after we finish handling them. You can ask us to delete chat conversations or emails sooner.
Logs are kept by Cloudflare for a limited period, typically 7 days, and then deleted.
Stripe keeps payment records under its own policies and as financial regulations require.

Your choices and rights

Delete your account at any time in Settings → Security. If you have an active subscription, we cancel it first, so you are not charged again.
Access or correct your information in Settings, or by contacting us.
Free-period reminders can be turned off separately in notification settings or through the reminder link. Essential account emails are unaffected.
Parent payment requests can be blocked for 180 days through the confirmation link in the request email, without creating an account. A student can revoke an unpaid request from the pricing page; already processing payments cannot be recalled this way.
Unsubscribe from the newsletter using the link in any newsletter email, or in Settings.
Depending on where you live, including California and other U.S. states and Canada, you may have rights to access, correct, delete, or get a copy of your personal information. We do not sell or share personal information as defined by California law. To make a request, contact us. We will not treat you differently for exercising your rights.