Privacy Policy

Athena Privacy Policy

Effective Date: October 7th, 2026

What's changed in this version (October 7th, 2026)

  • We now describe session replay in our product analytics and the human review of some conversations for quality, both of which were already part of how Athena works.
  • We corrected what happens when you disconnect your LMS: the connection ends, and the study materials Athena created for you stay in your account until you delete them.
  • We added a section on access sponsored by your school.
  • We now give the same privacy rights to everyone, with a 30-day response commitment.
  • The Terms no longer include a license to improve AI models, which Athena does not do.

Athena is a learning service provided by Instructure, Inc. ("Instructure," "we," "us," or "our"). This Privacy Policy explains how Athena collects, uses, and shares personal information when you use our website(s), our mobile app, and related services (collectively, the "Service").

This policy is written in plain language and includes disclosures required by United States (U.S.) laws (for example, CalOPPA and modern state privacy laws such as the California Privacy Rights Act (CPRA), Colorado Privacy Act (CPA), Virginia Consumer Data Protection Act (VCDPA), and similar).

Who We Are & How To Reach Us

  • Service operator: Instructure, Inc. (Athena)
  • Address: 6330 S 3000 E, Suite 700, Salt Lake City, UT 84121, USA
  • Privacy email: privacy@studywithathena.com

Information We Collect

We collect only what we need to run and improve Athena:

  • Account identifiers: Email (required at sign-up). Name (optional).
  • Payment/subscription info: Payments are processed by Stripe. We receive limited transaction details (e.g., date/amount, Stripe IDs). We do not store full card numbers.
  • Content you create: Chat prompts/responses, attachments, and other content you add to Athena.
  • Education information you connect: Course information read from the LMS you choose to connect. See LMS Information You Choose To Connect below.
  • Usage & device data: IP address, browser/device type, pages viewed, clicks, time in app, referrer, and server logs—used for operations, security, and analytics.
  • Inferences: Estimates of your understanding of concepts and a study profile built from your interactions with Athena, used to personalize your tutoring. See Personalized Study Support below.
  • Cookies/trackers:
    • Strictly necessary: authentication and security cookies.
    • Product analytics: PostHog, to understand how Athena is used. PostHog also records some sessions so we can replay interactions with the page. See Cookies & Tracking.
    • Advertising/attribution: Google Analytics 4 and advertising/attribution tags (Meta Pixel, TikTok Pixel, Reddit Pixel, Google Ads tags). See Cookies & Tracking, including the regional and sponsored-access limits.

LMS Information You Choose To Connect (for example, Canvas)

If you connect your LMS, you authorize Athena to read course information you can already see there—including course materials, assignments, modules, your enrollments, and your own grades. We use this information to provide and personalize your tutoring and study features.

Your LMS remains the system of record. Athena reads course information when you use a feature rather than keeping a separate copy of your institution's records. We keep the study materials we create for you (for example, study spaces, learning objectives, quizzes, and flashcards) and your conversations. Relevant course information may be included in messages sent to our AI providers, as described in AI-Powered Features.

We do not change your LMS records. We do not give your school your conversations, study materials, or access to your account. Our service providers process information to help run and protect Athena, as described in How We Share Information.

Disconnecting: You can disconnect your LMS at any time. This removes the connection and stops further reads. It does not delete your study materials or conversations. To request deletion, email privacy@studywithathena.com. See Data Retention.

Access Sponsored By Your School

Some schools pay for their students' access to Athena. You still register for your own account and accept Athena's terms. Your account, conversations, and study materials remain yours.

  • How we know you are sponsored: When you connect your school's Canvas, we check that the Canvas site belongs to a sponsoring school with a current agreement and that you have an active enrollment there as a student or teacher. We re-check this periodically. Your school does not send us rosters or student records; the check uses only the Canvas connection you authorized.
  • What your school sees: We give your school aggregate usage counts. We do not give it your conversations, study materials, or access to your account.
  • Advertising and analytics: Once you are signed in, we do not load advertising or attribution tags, including Google Analytics, for sponsored learners. We use product analytics for sponsored learners as we do for everyone, to operate and improve Athena.
  • Institutional information: Where your school's agreement with Instructure covers information the school provides, we handle that information under the agreement and its Data Processing Addendum. Instructure acts as a FERPA "school official" for that institution-provided information. This does not give your school access to your personal Athena account.

Sensitive Information

We use account-access information (your email and password) to sign you in and protect your account. We do not ask for other sensitive personal information (for example: government IDs, precise geolocation, health or biometric data, or full financial account numbers). Messages and uploads may still contain sensitive information if you include it; if you do, it is processed as part of your content, including by our AI providers. Please do not include government ID numbers, payment-card or bank-account numbers, or private health details in your Athena content or support messages. To request deletion of something you included, email privacy@studywithathena.com.

AI-Powered Features

  • How AI uses your information: Athena uses AI providers, including OpenAI, Google, and Anthropic, to generate tutoring responses. Depending on the feature, we send your message, relevant conversation history, uploads and course material, your preferred first name, and Canvas identifiers.
  • No model training: Athena does not train or fine-tune AI models on your content. Our agreements with these providers prohibit using Athena data to train their models.
  • Provider retention: Providers may keep inputs and outputs for a limited time to detect abuse and keep their services safe, and longer where the law requires or where content is flagged as violating their usage policies. Under their published API policies, OpenAI and Anthropic delete this data within 30 days; Google keeps it only for a limited period for the same purpose.
  • Please avoid including sensitive information in your messages or uploads.

Human Review

Athena staff and contracted reviewers review some conversations to evaluate response quality. The review view removes identifiers, but what you write may still identify you. Staff helping you with support may see your account email.

Personalized Study Support

Athena uses your messages and responses to estimate your understanding of concepts and build a profile that helps tailor tutoring and study reminders. These estimates are for study support—we do not use them to make admissions, official grading, or other decisions with legal or similarly significant effects.

How We Use Information

  • Service delivery. Account creation, login, core features, and (if connected) reading your LMS at your direction.
  • Improvement. Debugging, analytics, testing, quality review, and personalization.
  • Communications. Transactional messages (e.g., account notices). You can unsubscribe from product and recommendation emails at any time in settings.
  • Security & fraud prevention. Protecting users and our Service.
  • Legal compliance. Tax/accounting and responding to lawful requests.
  • With consent/at your direction. When you ask us to do something outside the above.

De-identified and aggregate information: We may use and share information that no longer reasonably identifies you. We keep de-identified information in that form, do not try to identify you from it, and require recipients to do the same, except where the law permits testing whether de-identification works. Any limits that apply to school-provided information still apply.

How We Share Information

We do not sell your personal information for money, and we never give it to data brokers. We share information only as follows:

  • Service providers that work for us (e.g., cloud hosting and storage, AI model providers, product analytics, payments, email, logging). They must use data only to provide services to Athena. A current list of these providers is available at https://www.studywithathena.com/subprocessors.
  • Advertising and measurement partners: On our website we use Meta, TikTok, Reddit, and Google Ads tags to measure whether our ads work. These tags receive identifiers and usage information from your browser. California law counts this as "sharing," and some state laws call any exchange of value a "sale," even though no money changes hands. That is why you will see those words in the opt-out section. You can opt out at any time; sponsored learners and visitors from the EU/EEA/UK/CH are excluded automatically. We use Google Analytics 4 to understand usage.
  • Affiliates/corporate transactions. If Athena is reorganized, acquired, or spun out, information may transfer to a successor that must protect it consistently with this policy.
  • Legal/safety. When required by law or to protect rights and safety.
  • With your consent/direction. For example, if you enable a specific integration.

Cookies & Tracking

Strictly necessary cookies (e.g., authentication and security) are required to operate Athena and deliver the Service.

U.S.: We use Google Analytics 4 and advertising/attribution tags (Meta, TikTok, Reddit, Google Ads) to understand usage and measure whether our ads work. We do not sell your information for money; state privacy laws nonetheless treat sending identifiers and usage data to advertising partners as "sharing" or a "sale," so you have the right to opt out. See Your Privacy Rights.

Product analytics and session replay: We use PostHog to understand feature use. For some sessions, PostHog records interactions such as clicks, scrolling, and navigation. Replays show the page as you saw it, including what you type in chat and quizzes; they mask passwords and on-page account details such as your name and email. They are linked to your account—they are not anonymous. We do not load PostHog for visitors we detect in the EU, EEA, UK, or Switzerland, and we do not load it when your browser sends a Global Privacy Control or Do Not Track signal.

European Union (EU), European Economic Area (EEA), United Kingdom (UK), and Switzerland (CH) (no banner): For visitors we detect from the EU/EEA/UK/CH, we do not load any non-essential third-party scripts (e.g., no GA4, Meta Pixel, TikTok Pixel, Reddit Pixel, or PostHog). We do not send server-side conversion events to advertising platforms for these visitors. Because we do not set non-essential cookies/trackers in these regions, no cookie consent banner is required. If we later enable non-essential analytics or advertising tools in the EU/EEA/UK/CH, we will first present a consent banner and obtain valid opt-in consent before using them.

Your Privacy Rights

We give these rights to everyone who uses Athena, wherever you live. Some of them are required by particular state or national laws; we apply them to all users.

  • Access: ask what personal information we hold about you and receive a copy.
  • Correction: fix information that is wrong. You can change your preferred name in settings; to correct your email, email privacy@studywithathena.com.
  • Deletion: ask us to delete your account and your content. See Data Retention for the few things we must keep (such as billing records).
  • Opt out of advertising measurement: see Your advertising opt-out below. We do not profile you for decisions with legal or similarly significant effects, and we do not sell your information for money.
  • Know who received your information: on request, we will tell you which third parties received your personal information. For most users this is only the advertising partners named in Cookies & Tracking.
  • Appeal: if we decline a request, reply to our decision and we will review it again and explain the result, including how to reach your regulator where one applies.
  • No retaliation: we will never reduce your service or charge you more for exercising these rights.

How to ask: email privacy@studywithathena.com. We verify identity for access, correction, and deletion requests (usually by confirming your account email); we do not require verification to honor an opt-out. An authorized agent can contact us on your behalf. We respond within 30 days; if a request is complex we will tell you why and when to expect our answer.

Your advertising opt-out: We don't sell your personal information for money. This opt-out exists because the law treats sending data to advertising partners as "sharing" (or a "sale" in some states) and gives you the right to stop it. We honor the Global Privacy Control (GPC) signal as that opt-out. When your browser sends GPC we do not load advertising, retargeting, or analytics tags, and we treat a Do Not Track signal the same way. If you are signed in when your browser sends the signal, we record the opt-out on your account and apply it on every browser and device you use until you ask us to change it. You can turn on GPC in a supported browser or extension (see globalprivacycontrol.org). We process the signal in a frictionless manner: no fee, no change to your service, and no pop-ups. Because we honor GPC in a frictionless manner, we do not display a separate "Do Not Sell or Share" link. You can also opt out by emailing privacy@studywithathena.com; no account or identity verification is needed.

Additional information for the EU/EEA/UK/CH

The rights above apply to you. Under GDPR/UK GDPR you also have the rights to portability, restriction, objection (including to direct marketing), and withdrawal of consent where processing is based on consent. These rights apply to personal information collected when you browse, not only when you create an account.

  • Why we use your information: We use the information needed to create your account and provide the tutoring and billing services you request in order to perform our agreement with you. We use information to protect Athena and improve service quality based on our legitimate interests in a secure, reliable service, where those interests do not override your rights. Where processing requires consent, we ask first, and you can withdraw it. We also keep information where required by applicable law.
  • Your choices: Your email is required to create an account; your name is optional. Connecting your LMS is optional; without it, Athena cannot read your course information.
  • Where information comes from: We receive information from you, your device, Stripe, and, if you connect it, your school's LMS—read with your authorization, not sent to us by your school. Your school does not send us rosters or student records.
  • To exercise any right, email privacy@studywithathena.com (see How to ask above). Instructure's Data Protection Officer can be reached at privacy@instructure.com. You may also complain to your local data-protection authority.
  • As noted in Cookies & Tracking, we do not set non-essential cookies/trackers for EU/EEA/UK/CH visitors, so cookie choices are not required there.
  • If Swiss data-protection law applies to you, you may contact us to exercise your rights under that law.

Data Retention

  • Account information and study content: We keep your account information, conversations, uploads, and saved study materials until you delete them or request deletion, subject to the exceptions below. We do not currently delete accounts or study content automatically because of inactivity. To request deletion, email privacy@studywithathena.com; we delete upon verified request.
  • Operational logs and traces: Web-tier logs expire after 30 days; learning-engine logs and traces expire after 90 days.
  • Analytics and session replays: Session replays are kept for 30 days. Analytics events are kept while your account exists and are deleted when we delete your account at your request.
  • Billing records: We generally keep transaction records for about seven years for tax, accounting, and fraud-prevention purposes.
  • AI-provider records: See AI-Powered Features for provider retention.
  • Backups: Database backups are kept on fixed schedules for disaster recovery and expire automatically; the longest-lived backups are deleted within about four months. Backups are encrypted, stay in the United States, and are not used to restore deleted data except to recover from an outage.
  • Exceptions: Some information may need to be kept for a legal obligation, a specific security investigation, or a legal claim. We keep it only for as long as needed for that purpose.

Children

Athena is a general-audience service for people age 13 and older. We do not knowingly collect personal information from children under 13. If we learn an account belongs to a child under 13, we delete the account and associated personal information. Contact privacy@studywithathena.com if you believe a child under 13 has an account. If you are 13–17, you need a parent or guardian's permission to use Athena.

Security

We use reasonable safeguards to protect personal information, including:

  • Encryption in transit (HTTPS) and at rest; hashed passwords.
  • Access controls and least-privilege practices for staff and vendors.
  • Monitoring, logging, and incident response procedures.

No method is 100% secure; please use a strong, unique password and tell us promptly if you suspect unauthorized access. You can report a security concern to security@studywithathena.com.

International Users & Data Transfers

We are a U.S.-based service and store Athena data in the United States. If you access or use the Service from outside the U.S., your personal information will be transferred to and processed in the U.S. (and possibly in other countries where our team or service providers operate). We use third-party service providers (subprocessors) to help run our Service (for example, cloud hosting or communications), and we require these partners to safeguard your data and use it only for our authorized purposes.

EU/EEA/UK/CH

  • Data transfers & safeguards: For covered EU/EEA and UK transfers, we use the European Commission's Standard Contractual Clauses and the UK Addendum as described in Instructure's Data Processing Addendum. Instructure, Inc. is also certified under the EU-U.S. Data Privacy Framework, the UK Extension to it, and the Swiss-U.S. Data Privacy Framework; see Instructure's Product Privacy Notice for details. You can email privacy@studywithathena.com for information about the safeguards and how to obtain a copy. In all cases we also apply reasonable technical and organizational safeguards (for example, encryption in transit and strict access controls). See Security.
  • Your rights: See Your Privacy Rights above.

Other Regions

  • Local rights & global standards: Privacy laws differ by country, and you may have additional rights under your local laws (for example, a right to access or delete your data). We encourage all users—regardless of location—to contact privacy@studywithathena.com with privacy requests or questions. We will handle your request in accordance with applicable law.
  • Where required and supported, we honor valid universal opt-out signals (such as Global Privacy Control) to indicate an opt-out from online tracking or "sale/sharing" of personal information.

Changes To This Policy

We may update this policy. If changes are material, we'll provide reasonable notice (e.g., in-product notice). If a change needs your consent, we will ask before applying it. Updating this policy does not remove rights or protections that apply to information we already hold. The Effective Date above shows the latest revision.

Questions or requests: privacy@studywithathena.com