Transparency

Privacy at ExamDraft

ExamDraft is designed so your study materials do not pass through an ExamDraft-owned content backend. The app runs in the browser. When you use AI features, your browser talks to the provider you selected. This page explains what is stored locally, what is sent to external AI providers, and which parts of that flow you control yourself.

Version: April 2026 No user account required Bring Your Own Key

Summary

Your API key is stored locally in your browser, not on ExamDraft servers.
Analysis, generation, and AI grading send content directly to Anthropic or OpenRouter.
Analysis results and generated exams may be stored temporarily in your browser session.
ExamDraft does not maintain a classic user-content database for your uploaded learning material.

Responsibility

ExamDraft is a static web application. ExamDraft is responsible for the product interface and the way these pages describe product behavior.

For content that you actively send to an AI provider, the relevant provider is additionally responsible for its own processing. That applies in particular when you trigger analysis, exam generation, or AI grading.

Contact for privacy questions: [email protected]

1. Data stored locally in the browser

ExamDraft stores part of its state exclusively in your browser so the app can continue working across page changes and sessions.

API key for the selected provider in localStorage.
Provider and model preferences in localStorage.
Temporary analysis results and generated exams in sessionStorage so you can continue within the same browser session.
No persistent ExamDraft document vault for your uploaded PDFs. Files are read for processing and then only used as needed for the active flow.

2. Data sent to AI providers

When you actively use ExamDraft for analysis, exam generation, or AI grading, your browser sends the required content directly to the provider you selected. ExamDraft currently supports providers such as Anthropic and OpenRouter.

Depending on the feature, that may include:

text extracted from past exams,
text extracted from model solutions or marking schemes,
lecture context from uploaded PDFs or from your pasted topic summary,
answers you type when using AI grading.

ExamDraft does not proxy this traffic through its own content backend. The transfer goes directly from your browser to the selected API. The provider's own privacy terms apply in addition, especially the Anthropic Privacy Policy and the OpenRouter Privacy Policy.

3. No ExamDraft content database

ExamDraft does not operate a classic user document store for your exam content. In particular, there is no product-side archive where ExamDraft keeps your uploaded exams as a long-term content library.

The practical consequence is simple: the meaningful content processing happens either in your browser or at the external AI provider you selected.

4. No classic tracking layer

ExamDraft currently does not rely on classic user accounts, personalized ad profiles, or product-side analytics for your study content.

Necessary browser and hosting processes may still exist. This page describes how your content is handled inside the product flow itself.

5. Legal basis and user control

Where privacy law applies, local browser storage is mainly used to provide the functionality you explicitly requested. Transfers to external AI providers happen because you actively trigger those functions and use your own API key.

You decide:

whether to connect ExamDraft to an external provider at all,
which provider you use,
which documents or text you supply as context,
whether to paste a compact lecture summary instead of uploading full lecture PDFs.

6. Retention, deletion, and rights

Locally stored data remains in your browser until you remove it or until browser logic clears or replaces it. Session data is intended for the active session.

If you want to delete local ExamDraft data, you can remove the site's stored data in your browser settings. If you have questions about how an AI provider stores or further processes content after the API request reaches them, you need to contact that provider directly.

Contact: [email protected]