What IBOS knows about you

IBOS is built and run by Dennis Sokol, who sat the IB Diploma and is now a student at ESSEC Business School in France. It is not a company. For anything on this page — a question, a correction, or a request to delete your data — write to privacy@ibos.study.

You gave an email address, and optionally a name, a school and an IB year. That is all that is stored, and it is used for one thing: to write to you once when IBOS opens to your school.

No account is created, nothing is shared with anyone, and you are not on any other list. Ask and it is deleted the same day.

IBOS stores what you type into it, because that is what it plans around: your name and email, your subjects and their topics, your deadlines, the hours you are usually free, the tasks it schedules and whether you finished them, topics you flag as shaky, the grades you record, the links and notes you file as materials, and — if you use them — your university applications and essay drafts.

Your password is never stored. It is put through scrypt with a per-password salt, and only the result is kept, so nobody — including us — can read it back. The cookie that keeps you logged in is stored the same way: the database holds a SHA-256 of it, never the value itself.

Your data is yours alone. Every row carries your account id and every query filters on it, so no other student can reach your plan, and no teacher sees it either.

To spot someone trying to break into an account, IBOS keeps a short record of sign-ins, failed sign-ins and password changes: the time, the network address, and a scrambled fingerprint of the email rather than the email itself. It sits in the hosting logs at Vercel and is gone within a day.

In the European Union. The database is in Ireland, and the servers that run IBOS are pinned to Dublin.

Two exceptions, both real: the site is hosted by Vercel and the database by Turso, and if AI features are on, the text those features need is sent to Anthropic in the United States to be answered. Anthropic does not use it to train models.

Three parts of IBOS use AI: the assistant, the essay coach, and reading a homework paste. Each one sends only what it needs — the question you asked, the essay you are working on, or the text you pasted — along with the relevant part of your subject list.

You can turn all of it off in Settings → AI & privacy. That is a real switch, not a hidden button: the server checks it before anything is sent, so with it off nothing about you reaches Anthropic at all.

There is no advertising, no tracking pixel, no analytics script and no third-party cookie. Nothing is sold, and nothing is shared with your school, your teachers or your parents. IBOS sets two cookies, both essential: one keeps you signed in and one remembers your cookie choice. Every one is listed in the cookie policy.

You can download everything IBOS holds about you at any time, as a plain JSON file, from /api/export or via Settings → Data.

The same page deletes it. That removes your account and everything in it — subjects, topics, deadlines, tasks, grades, materials, applications and essays — immediately and for good. There is no recovery, which is the point.

Under GDPR you can also ask us to correct something, to stop using your data, or to hand it to another service. Ask, and we will.

IBOS is built for students aged roughly 16 to 19. In France the age at which you can agree to a service handling your data on your own is 15; if you are younger, ask a parent or guardian before signing up.

Your account data stays while your account does. Delete it and it goes immediately. Early-access entries are deleted once IBOS has opened to your school and you have either signed up or told us you would rather not.

If this page changes in a way that matters, the date at the top changes with it and anyone with an account gets an email. It will not change quietly.