Privacy Policy

1. Scope

This Policy covers the mobile app, backend API, website, WebSocket and live-session services, AI quiz-generation features, billing and rewarded-ad features, support channels, and related services. Third parties such as Google, Firebase, Google Play, Apple, AdMob, payment providers, AI providers, speech-recognition providers, hosting providers, and device operating-system services may process information under their own policies.

2. Information we collect

Account, profile, and authentication information

When you register, sign in, or update a profile, we may process your name, username or display name, email address, password-related authentication information, avatar if you provide one, account and provider identifiers, role, verification and active status, account timestamps, last-login time, and preferred study categories. We also process access tokens, refresh tokens, Firebase ID tokens, session state, password-reset and account-deletion request data.

Google, Apple, and Firebase sign-in

If you choose a supported sign-in provider, we may receive the email address, name or display name, provider identifier, profile metadata, and authentication credentials authorised by that provider. We use this only to authenticate you, create or connect an account, maintain sessions, protect security, and provide account-based functionality. The current implementation does not request access to Gmail, Google Drive, Google Calendar, Contacts, Photos, YouTube, or similar Google services.

Quizzes, flashcards, and public content

We process the content and metadata you create or use, including quiz and flashcard titles, descriptions, categories, tags, questions, answers, explanations, hints, visibility settings, creator information, ratings, likes, downloads, reports, timestamps, and moderation actions. Public, shared, or live-session content and related metadata can be visible to other users according to the feature settings you choose.

Study activity and live sessions

We process selected answers, written answers, correctness, scores, rankings, time spent, progress, attempts, study history, XP, and performance summaries. For live sessions, we may process session and participant identifiers, usernames, join codes, participant lists, answers, scores, leaderboards, chat messages, reactions, events, and session history. Information you share in a live session can be visible to its host and participants.

AI features and uploaded content

When you use AI generation, we may process prompts, instructions, selected document text, file metadata, quiz settings, extracted text, generated study materials, and token or entitlement checks. The app may extract document text on your device and send extracted or compressed text to our backend for generation. Do not submit confidential, regulated, private, proprietary, copyrighted, or third-party content unless you have the right to use it and are comfortable with it being processed for this feature.

Purchases, rewarded ads, and technical information

We may process token balances and usage, subscription and purchase status, product identifiers, Google Play purchase tokens, verification results, and records needed for entitlements, fraud prevention, support, and legal compliance. We do not collect full payment-card numbers when a platform payment provider handles the transaction.

Google Mobile Ads / AdMob and its partners may process advertising identifiers, IP address, device and network information, ad requests, impressions, rewards, interactions, consent choices, and fraud-prevention signals when rewarded ads are used. We receive limited completion or reward information needed to unlock an app feature. Ads may be personalised or non-personalised depending on consent, region, device settings, and provider configuration.

We and our providers may also process IP address, request metadata, logs, timestamps, app version, device and operating-system information, language or locale, connection status, diagnostics, error reports, and security signals. The app can store authentication state, settings, local quizzes and flashcards, progress, notification state, and transient document-selection data locally on your device.

Optional microphone and notification features

If you choose speech-to-text, your device or speech-recognition provider may process audio to return recognised text. We do not intentionally store raw microphone recordings on our backend; recognised text may be stored or transmitted if you save or submit it. If you enable optional reminders, the app may process notification permission, preferences, local notification state, and timezone information. You can revoke these permissions in device settings.

3. How we use information

We use information to provide and improve study features; create, authenticate, secure, and manage accounts; enable quiz, flashcard, sharing, live-session, AI, notification, purchase, and rewarded-ad functions; personalise study experiences; respond to requests; prevent fraud, abuse, cheating, and unauthorised access; enforce our terms; and comply with legal obligations.

4. How we share information

We may share information with service providers that help operate the service, including authentication providers, cloud and database infrastructure, security, email delivery, AI, speech-recognition, analytics or diagnostics, billing, app-store, and advertising providers. The backend is hosted through Render; email delivery uses Brevo; AI generation may use OpenRouter and DeepSeek according to feature configuration.

We share content and metadata with other users when you make content public, share a link or invitation, join a live session, publish study material, or otherwise direct us to share it. We may disclose information when required by law or reasonably necessary to protect rights, privacy, property, safety, security, or to investigate fraud, abuse, and policy violations. If the service undergoes a merger, acquisition, financing, reorganisation, bankruptcy, or similar transaction, information may be transferred as permitted by law.

5. Google data, AI, and advertising

We use Google sign-in and Firebase data only for the disclosed authentication and account functions. Google Play purchase information is used to verify purchases, grant or restore access, prevent fraud, and provide billing support. We do not sell Google user data.

AI-generated content may be inaccurate, incomplete, biased, outdated, duplicated, or unsuitable for your needs. Review AI output before relying on, publishing, or sharing it. AI providers process submitted text under their own terms and privacy policies.

Rewarded advertising can involve advertising-related processing by Google and AdMob partners. Where required, Google consent choices are presented before Mobile Ads initialises. You can manage advertising identifier and ad-personalisation settings through your device or Google settings.

6. Retention and deletion

We retain information for as long as reasonably necessary for the purposes in this Policy, unless a longer period is required or permitted by law. Retention can vary for account data, authentication data, study content, AI prompts and output, attempts and live sessions, purchases and subscriptions, support records, security logs, and backups.

After a verified account-deletion request, we delete or de-identify account-associated information from active systems within 30 days where feasible. We may retain limited information for legal compliance, security, fraud prevention, billing, tax, accounting, refunds, chargebacks, purchase verification, disputes, terms enforcement, backups, or system integrity. Account deletion does not automatically cancel a subscription purchased through Google Play, the App Store, or another payment provider; cancel it with that provider. It also may not remove data already stored locally on your device or copies another user has already downloaded, exported, cached, or shared.

You can request deletion in the app or through the public account-deletion page.

7. Your choices and regional rights

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or receive a portable copy of your personal information; withdraw consent; opt out of certain advertising-related processing; appeal a privacy decision; or complain to a regulator. You can update available profile information and content settings in the app, control public visibility where supported, revoke optional device permissions, manage ad settings, revoke Google access through Google Account permissions, and contact us to exercise privacy rights. We may need to verify your identity before responding.

We do not knowingly sell personal information or the personal information of children under 16. The app is not intended for children under 13. If you believe a child has provided personal information without required consent, contact us so we can take appropriate action.

8. Security and international processing

We use reasonable administrative, technical, and organisational measures designed to protect information from unauthorised access, loss, misuse, alteration, and disclosure. These measures can include encrypted production transport, authentication controls, role-based access, service-provider controls, logging, monitoring, and data minimisation. No method of transmission or storage is completely secure, so keep your device and credentials secure.

We and our service providers may process information in countries other than your country of residence. Where required, we will use safeguards required by applicable law for international transfers.

9. Changes and contact

We may update this Policy when our service or legal requirements change. We will post the updated version here and revise the date above. For privacy questions, requests, complaints, or account-deletion requests, contact oraezu at studypass.hq@gmail.com.