Privacy Policy | StudySync

1. Introduction

StudySync is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and protect information about you when you use our free student note-taking and study application ("the App"), in accordance with the General Data Protection Regulation (GDPR) and applicable EU data protection law.

By using StudySync, you confirm that you have read and understood this policy.

2. Who We Are (Data Controller)

StudySync is the data controller for personal data processed through this App. You can contact us at:

Email: support@studysync.app

3. Data We Collect

3.1 Account Information

When you register or sign in, we collect:

Full name
Email address
Profile picture (if you sign in via Google OAuth or upload one)
Authentication credentials (hashed passwords for email/password accounts)

3.2 App Content You Create

We store the content you create and manage within the App, including:

Notes and note content
Flashcards and flashcard decks
Study session history and messages
Schedule events
Subject and semester classifications
Tags and labels

3.3 App Usage Data

We collect limited usage data necessary to provide the service:

Study streak count and last active date
App preferences and settings (theme, editor font, auto-save interval)

4. Legal Basis for Processing (GDPR Article 6)

We process your personal data on the following legal bases:

Performance of a contract (Article 6(1)(b)): To provide you with the StudySync service you have registered for, including storing your notes and study data.
Legitimate interests (Article 6(1)(f)): To maintain the security and integrity of the App and prevent abuse.
Consent (Article 6(1)(a)): Where you have given explicit consent, such as uploading a profile picture.

5. How We Use Your Data

We use your personal data exclusively to:

Create and manage your StudySync account
Store, display, and sync your notes, flashcards, and study content
Provide AI-assisted study features (content is processed by Groq AI; see Section 6)
Maintain your study streak and personalised settings
Ensure the security and availability of the App

We do not use your data for advertising, profiling, or any commercial purpose beyond providing the App.

6. Third-Party Services

We use the following third-party service providers. Each acts as a data processor on our behalf:

Neon (Database)

Your account and all app data are stored in a PostgreSQL database hosted by Neon, Inc. Neon operates data centres in the EU/EEA.

Vercel (Hosting & File Storage)

The App is hosted on Vercel infrastructure. Profile pictures you upload are stored in Vercel Blob storage.

Groq (AI Processing)

When you use AI-powered features (such as PDF formatting or flashcard generation), the relevant note content is sent to Groq, Inc. for processing. Groq does not retain your data for training.

We do not sell, rent, or share your data with any other third parties.

7. Data Retention

We retain your personal data for as long as your account is active. If you delete your account:

All your personal data, notes, flashcards, study sessions, and settings are permanently and immediately deleted from our database.
Profile pictures stored in Vercel Blob are deleted upon account deletion or when you remove your profile picture.
We do not retain backups of your personal data beyond standard database backup cycles (maximum 7 days).

8. Your Rights Under GDPR

As an EU resident, you have the following rights:

Right of access (Article 15): Request a copy of the personal data we hold about you.
Right to rectification (Article 16): Request correction of inaccurate personal data.
Right to erasure (Article 17): Request deletion of your personal data ('right to be forgotten'). You can also delete your account directly within the App.
Right to restriction of processing (Article 18): Request that we restrict how we process your data.
Right to data portability (Article 20): Request your data in a structured, machine-readable format.
Right to object (Article 21): Object to processing based on legitimate interests.
Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at support@studysync.app. We will respond within 30 days.

You also have the right to lodge a complaint with your local data protection supervisory authority.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

Encrypted connections (HTTPS/TLS) for all data in transit
Database-level access controls and authentication
Foreign key constraints ensuring data is fully deleted upon account removal
No storage of plain-text passwords (hashed and salted)

10. Cookies

StudySync uses a single session cookie to keep you logged in. This cookie is strictly necessary for the App to function and does not track you across other websites. No analytics or advertising cookies are used.

11. Children's Data

StudySync is intended for users aged 16 and over. We do not knowingly collect data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by displaying a notice within the App. The 'last updated' date at the top of this document will always reflect the most recent revision.

13. Contact

For any questions or concerns about this Privacy Policy, contact us at: support@studysync.app