Privacy Policy

Effective date: 4 September 2026
Last updated: 4 September 2026
Version: 1.0
Applies to: the Estudylog applications for iPhone and iPad (iOS / iPadOS), macOS, Android and Apple Watch (each, "the App"), the Estudylog widgets, Live Activities, Siri shortcuts and Spotlight entries, the Estudylog website at https://estudylog.com, and the backend services that support them (together, the "Service").

Who we are: Estudylog Inc., a corporation incorporated federally under the Canada Business Corporations Act, based in Toronto, Ontario, Canada ("Estudylog", "we", "us", "our"), based in Toronto, Ontario, Canada.
Contact for privacy questions: support@estudylog.com — or https://estudylog.com/contact
Data controller: Estudylog Inc. is the controller of the personal data described in this policy.
Where we operate: the Service is offered only in the countries and territories listed at https://estudylog.com/availability/. If your country is not listed, please do not use the Service.

0. The short version

• Estudylog is a study-tracking app. The data we hold is mostly data you typed in: your courses, your study sessions, your notes and your ratings.
• We use Firebase (Google) to store that data, Mixpanel to understand which features get used, and Sentry to find crashes and bugs. Payments are handled entirely by Apple.
• We do not sell your personal information. We do not share it for cross-context behavioural advertising. There are no advertising SDKs in the App and there is no ad tracking.
• Optional features — Calendar sync, Photos, HomeKit or Govee smart lights, Discord linking, the AI timetable import, notifications — only run after you turn them on and, where your operating system requires it, after you grant the system permission.
• We build aggregated, anonymised statistics from how Estudylog is used, and use them to improve the app and train our own models. That data does not identify you, and you can ask to be excluded (§4A).
• You can delete your account from inside the App. Deletion is scheduled with a grace period so an accidental tap is recoverable.

This short version is a summary for convenience only. The full policy below governs.

1. Scope and the nature of this document

This policy explains what personal data the Service collects, why we collect it, what we do with it, who else can see it, how long we keep it, and what rights you have.

It does not apply to:

• third-party services you choose to connect to the Service (Discord, Govee, your smart-home accessories) once your data reaches them — those services have their own privacy policies and are separate controllers of the data they hold;
• Apple's own processing of your Apple Account, App Store purchases, iCloud backups, or the data Apple collects from your device independently of the App;
• any website that we link to from the App (for example our subreddit or our Discord server).

Territorial scope. We make the Service available only in the countries and territories listed at https://estudylog.com/availability/. This policy is written for users in those places. If you access the Service from a country where we do not offer it, you do so on your own initiative and are responsible for compliance with your local law; we make no representation that the Service or this policy meets the requirements of a jurisdiction we do not serve.

If you do not agree with this policy, please do not use the Service.

2. Whether you need an account

Estudylog can be used in three states, and what we collect differs in each:

An anonymous account still creates a user record on our backend. It is still personal data under laws like the GDPR, because it is tied to a persistent identifier. We treat it as such.

3. What we collect — the complete inventory

We have listed this exhaustively rather than in categories, because vagueness in a privacy policy helps nobody. Not every item applies to every user; items marked optional are only collected if you use the relevant feature.

A note on platforms. The technical detail below is written from the iOS and iPadOS app, which is the most feature-complete. The macOS, Android and watchOS apps collect the same categories of data for the same purposes, but the platform mechanisms differ — for example, Apple's Keychain, App Attest and DeviceCheck, StoreKit, HomeKit, Live Activities and Siri have Android equivalents (Android Keystore, Play Integrity, Google Play Billing) or no equivalent at all, and some features are simply absent on a given platform. Where a specific item below only exists on one platform, we have said so.

3.1 Account and identity data

3.2 Study content — the data you create

This is the heart of the App and the largest category by volume.

Courses. Course name, course code, colour, status (active / paused / completed / archived), creation date, activation / pause / completion / archive timestamps, course start date, goal date, final exam date, final grade percentage, credits, term season and year, timezone, professor name(s) you enter, the university you attached to the course, an optional free-text course outline, a derived list of foundation-outline lines, structured topics (topic ID, topic name, target minutes), and key dates (a label and a date, e.g. "Midterm 2").

Study sessions. Session ID, the course it belongs to, start time, end time, your free-text notes for the session, your productivity rating, session type, the topic IDs and topic names you attached, effective (pause-aware) duration in seconds, pause count, a flag set when the device clock looked wrong, the timezone the session was recorded in, a local date key (e.g. 2026-09-04), server create/update timestamps, and — for sessions written since September 2026 — provenance fields: a schema version, whether it was a live timer or a manual retro entry, the device ID and device name that started it, the device ID and device name that saved it, and the platform, app version and build that saved it.

Live (in-progress) sessions. While a timer is running, a small record is mirrored to Firebase Realtime Database at activeSessions/{your uid} so your iPhone, iPad and Mac all show the same running timer. It contains the session ID, course ID, start time, last-resume time, accumulated seconds, paused state, the in-progress notes draft, the originating device ID, and a hard expiry stamp. It is deleted when the session finishes or is cancelled.

Derived metrics. Our Cloud Functions compute rollups from your sessions and write them where the App can read them: lifetime and per-period totals, streak counts, per-course metrics, per-month rollups, topic coverage, and the figures shown in Insights, widgets and charts. Clients never write these — only our server does.

Course wallpapers and timetables. The timetable schedule you build or import (course names, days, times, locations you type, colours and sticker styles), and the rendered wallpaper. For the AI import specifically, see §3.7.

Home themes. Themes you create (colour and pattern definitions and the name you give them), the themes you save to your library, and — only if you explicitly press the share button and confirm — themes you post to the in-app community feed. A posted theme carries your initials only and whether it was made in light or dark mode, plus your account ID stamped on the record for moderation and so that you can delete your own posts. Your full name and email are not shown to other users.

Feedback you submit. Bug reports (see §3.5), localisation feedback (the screen name and your free-text comment), and thumbs-up / thumbs-down on an AI import result.

On-device only. Some things you create never leave your device: your bookshelf wall photo and its appearance settings, your full-screen timer backdrop photo and backdrop choice, your lo-fi music pack and pin preferences, cached widget values in the shared app group, and the local diagnostic log described in §3.5. These are stored in the App's sandbox, in a shared app group container, or in the iOS Keychain.

3.3 Device and technical data

Stored at users/{uid}/devices/{deviceId} — one record per physical device you sign in on:

• A stable device identifier. A random UUID minted by the App on first launch and stored in the iOS Keychain with ThisDeviceOnly protection. It survives deleting and reinstalling the App, and it is deliberately excluded from encrypted backups so a restored or migrated phone mints a new one rather than inheriting yours. It is not Apple's IDFA, it is not the IDFV, and it is never shared with any advertising network.
• Platform (iOS / iPadOS / macOS), hardware model identifier (e.g. iPhone17,2), OS version, and the device name the OS exposes to us (on iOS 16 and later this is generally a generic name such as "iPhone" unless you have named it and granted an entitlement we do not hold).
• App marketing version, build number, and bundle identifier (which distinguishes production from TestFlight and internal builds).
• Locale, preferred language, active keyboard languages, first day of week, and light/dark interface style — used to format the App correctly and to prioritise which languages we translate into.
• Notification state: whether notifications are enabled, and the full authorisation status (not determined / denied / authorised / provisional / ephemeral).
• Which Apple Push Notification service environment this build targets (sandbox or production).
• Your Live Activity "push-to-start" token, if your device issued one, plus the time it was updated.
• Whether an Apple Watch is paired and whether the Estudylog watch app is installed.
• Install history: how many times the App has been installed on this device, the first install date, and the list of install dates. This list lives in the Keychain, so it survives deleting and reinstalling the App. We use it to understand reinstall behaviour and to avoid re-showing onboarding.
• Your App Store storefront country code and storefront ID (from StoreKit, no permission required) and your device's locale region — used for pricing, tax, and understanding where the App is used.
• The device's timezone, and a flag if we detect the device clock is significantly wrong (which would otherwise corrupt session timings).
• Network reachability state (online / offline), used to decide whether a failure is worth reporting.

The App also holds a Firebase Installation ID — an identifier Google's SDKs generate to operate Remote Config and App Check. And to prove that requests genuinely come from a real, unmodified copy of Estudylog, the App uses Apple's App Attest (falling back to DeviceCheck) through Firebase App Check. These produce device attestation tokens; they do not tell us who you are.

3.4 Usage and product analytics (Mixpanel)

We use Mixpanel to understand which features are used and where people get stuck. Mixpanel receives:

An identifier. Before you sign in, a random Mixpanel "distinct ID". After sign-in, we call identify with your Firebase user ID so events link to your account.

Profile properties. Your email address ($email), your name ($name) and your timezone ($timezone) — only if you provided them; plan tier (premium / free); total course count, active course count, and a bucketed course count.

Super properties attached to every event. Environment (production / development), app version, build number, locale, whether you are an anonymous user, whether you are premium, and a set of your in-app preferences (show chart Y-axis, auto-sync calendar, show learning resources, bookshelf customisation choices).

Events. The full list at the time of writing: app_launch, onboarding_continue, sign_up, log_in, session_started, session_completed, course_created, fab_tapped, quick_action_used, setting_changed, university_selected, paywall_viewed, purchase_attempted, purchase_failed, purchase_cancelled, purchase_pending, restore_purchases_attempted, subscription_linked, annual_switch_attempted, annual_switch_success, annual_switch_cancelled, limit_alert_shown, limit_alert_action, account_deletion_requested, anon_auth_success, anon_auth_failed, shelf_customization_opened, shelf_customized, discord_connect_started, discord_connect_succeeded, discord_connect_failed, discord_connect_cancelled, discord_disconnected, discord_disconnect_failed, discord_invite_banner_dismissed, course_wallpaper_hub_viewed, course_wallpaper_manual_selected, course_wallpaper_saved, course_wallpaper_sticker_style_changed, course_wallpaper_ai_image_import_started, course_wallpaper_ai_image_import_completed, course_wallpaper_ai_json_imported, course_wallpaper_ai_feedback_submitted.

Event properties are structural — a course ID, a session type, a product ID, a price and currency, a grace-day count, a reason code. We do not send your session notes, your course outlines, your course names, your topic names, or your professors' names to Mixpanel.

Mixpanel's SDK also collects standard context of its own — device model, operating system version, app version, and an approximate location derived from the IP address of the request (typically city or region level). Mixpanel does not receive precise GPS location from us.

We may change this event list as the App evolves. The principle stays the same: structural events, not your study content.

3.5 Diagnostics, crash reporting and bug reports

Sentry (crash, error and performance monitoring). The App sends Sentry:

• crash reports and stack traces;
• "app hang" reports, including diagnostics the operating system itself captures during a hang (Apple's MetricKit);
• performance traces — how long app launch and certain database operations take. In production we sample these (100% for app launch, 20% otherwise);
• captured errors with contextual tags: the function that reported them, the error domain and numeric code, an error classification, whether the device was online, and the authentication state;
• breadcrumbs — a short trail of what happened before the problem;
• your Firebase user ID and whether the account is anonymous, so we can tell "one user hit this fifty times" apart from "fifty users hit this".

Session Replay is disabled in the production App (sample rates are set to zero), and the Sentry option that would attach additional personally identifying request data is enabled only in our internal development builds, never in the App Store release.

Sentry receives the IP address the report was sent from, as any internet service does.

The on-device flight recorder. The App keeps a rolling local diary of its own decisions — session lifecycle, sync verdicts, app foreground/background, navigation, data-layer failures, authentication transitions. It is written as JSON lines to two files that rotate at roughly 1 MB each (so about 2 MB total). By design it records identifiers and reasons only — never your notes, never free text, never course names. It stays on your device unless you attach it to a bug report.

Bug reports. If you file a report from inside the App, we receive: the platform, the tab you were on, the complaint category you picked, your message (up to 4,000 characters — whatever you choose to type), the app version and build, the OS version string, your device ID, and — if you leave diagnostics enabled — the last ~200 lines of the flight recorder. Bug reports can only be created by you and are readable only by us.

Localisation feedback. The screen name and the free-text comment you submit when reporting a bad translation.

3.6 Purchases and subscriptions

Estudylog offers auto-renewing subscriptions. All payments are processed by the app store you bought from — Apple on iOS, iPadOS, macOS and watchOS, and Google Play on Android. We never receive, see, or store your card number, bank details, or your Apple Account or Google account password.

From Apple's StoreKit (and, on Android, from Google Play Billing) we receive and process: the product identifier, the transaction identifier, the price and currency shown to you, the subscription period, whether the transaction was a renewal, the environment (sandbox or production), your store storefront or country, and a cryptographically signed transaction blob or purchase token. That signed value is sent to our Cloud Function, which validates it with the store and grants the premium entitlement on your account. We also record purchase-funnel events in Mixpanel as listed in §3.4.

If you request a refund, Apple or Google decides. We may receive a notification that a subscription was refunded or cancelled so we can adjust your entitlement.

3.7 The AI timetable import (optional)

If you choose to import a timetable from a screenshot:

1. The image you pick is uploaded to Firebase Cloud Storage under users/{your uid}/courseWallpaperAI/{requestId}/source.jpg.
2. A request record is created in your own Firestore subtree with the status, timestamps, the storage path, and your quota usage for the rolling 60-day window (currently 2 imports per 60 days).
3. Our Cloud Function reads the image and sends it to a third-party AI model provider (currently OpenAI) to extract the schedule — course names, days, times and locations.
4. The structured result is written back to the request record, and you can accept or discard it.
5. If you leave a thumbs-up or thumbs-down, that rating is stored on the request record.

Please be careful what you upload. A screenshot of a university timetable may contain your name, student number, room numbers, or other people's names. Do not upload images containing information you are not comfortable sending to us and to our AI provider. As of the date of this policy, the provider we use offers an API on terms under which submitted content is not used to train their general models; we cannot guarantee any third party's practices will never change, and we will update this policy if we change provider or if that materially changes.

Our server-side course-outline feature works the same way: text you paste as a course outline may be sent to the same AI provider to extract structured topics. Adding topics manually in the App never involves any AI provider.

3.8 Optional device permissions

Every one of these is off until you turn it on, and iOS will ask you separately.

3.9 Optional third-party account connections

Discord (optional). If you connect Discord: you are sent to Discord to authorise; our Cloud Function exchanges the code, and stores your Discord user ID, username, global display name and avatar hash so the App can show your connection. We request the identify and role_connections.write scopes, plus guilds.join so we can add you to our community server if you chose that. We then push to Discord, as a "linked role" connection: the platform name "Estudylog", your display name (or the local part of your email if you have no display name), your total study hours and your current streak. Your OAuth tokens are stored in a location that the App is cryptographically forbidden from reading — only our server can. Disconnecting clears the role connection, revokes the token with Discord, and deletes both records.

Govee smart lights (optional). If you choose the Govee backend for ambient lighting, you supply your own Govee API key, which is stored in your device's Keychain. The App then calls Govee's cloud API directly from your device to list your devices and set their colour and brightness during sessions. Your API key and your light commands go to Govee under Govee's privacy policy. We do not receive your API key.

3.10 What we do NOT collect

To be explicit:

• We do not collect your precise or approximate GPS location.
• We do not collect contacts, health data, biometric data, financial account data, or government identifiers.
• We do not use the advertising identifier (IDFA), we do not present an App Tracking Transparency prompt, and we do not track you across other companies' apps or websites.
• There are no advertising SDKs, ad networks, or attribution SDKs active in the production iPhone app.
• Google Analytics for Firebase is not compiled into the App Store build of the iPhone app. It is present only in our internal development build, which is not distributed to the public.
• We do not read your microphone or camera. The App's audio features generate lo-fi audio on your device; they play sound, they never record it.
• We do not scrape your other apps, your browsing history, or your files.

4. Why we process your data, and our legal bases

Where the GDPR or UK GDPR applies, we rely on the following legal bases.

Where we rely on legitimate interests, we have considered your interests and rights and concluded our processing is proportionate — it is limited to what the feature needs, it excludes your study content from analytics, and you can object (see §10).

4A. Aggregated and de-identified data, and machine learning

We create aggregated, anonymised and de-identified data from the study content you create, from how the Service is used, and from the metrics derived from them — and we use it to develop, train, fine-tune, evaluate and improve our own machine learning and statistical models and product features (for example study insights, predictions, recommendations, scheduling help, topic extraction and timetable understanding), to build and secure the Service, and to produce aggregate statistics and research.

What this means in practice.

• Direct identifiers are removed and records are combined or generalised, so the resulting data does not identify you and cannot reasonably be used to identify you.
• We do not attempt to re-identify anyone from this data, and we require anyone we share it with to do the same.
• We do not publish or disclose it in a form that identifies you, and we do not publish your notes, course outlines, course names or other free text as such.
• Once data is genuinely aggregated and de-identified it is no longer personal data, so it may be kept and used indefinitely — including after you delete your content or your account. Deleting your account removes your personal data; it cannot subtract your contribution from a statistic already computed or a model already trained.
• We do not sell this data, and we do not use it for advertising.

Your choice. Where consent or an opportunity to object is required by your local law, we will obtain it or offer it. Regardless of where you are, if you would prefer that your data not be drawn on for this purpose, email support@estudylog.com and we will exclude your account going forward. Excluding yourself does not affect any other part of the Service.

This is separate from third-party AI providers. The AI providers we use for the timetable import and outline extraction (§3.7) receive only the specific input you submit for that feature, and this section gives them no right to train their own general-purpose models on your data.

5. Your choices and controls

• Analytics. If you would prefer that we not process your usage data for product analytics, email support@estudylog.com from your account email and we will suppress and delete your analytics profile. Where local law requires consent for analytics, we will honour that requirement.
• Diagnostics in bug reports. You can file a bug report without attaching the diagnostic diary.
• Every optional permission can be revoked in iOS Settings → Estudylog at any time, and every optional integration can be turned off inside the App.
• Notifications can be turned off in iOS Settings or in the App.
• Calendar sync can be turned off in the App; turning it off stops new events being written. Events already written stay in your calendar until you delete them.
• Community themes you posted can be taken down by you from inside the App.
• Your account can be deleted from inside the App (§9).
• Discord can be disconnected in Settings → Connected Accounts, which revokes our token with Discord and deletes the stored record.

6. Who we share data with

We do not sell personal information, we do not rent or trade it, and we do not share it for cross-context behavioural advertising or targeted advertising. We share it only as described here.

6.1 Service providers (sub-processors)

These companies process personal data on our behalf, under contract, to provide the Service.

If we add or change a sub-processor in a way that materially affects you, we will update this policy and, where required, notify you.

6.2 Services you connect yourself

Discord, Inc. and Govee (Shenzhen Intellirocks Tech Co., Ltd. / Govee) receive data only if you connect them, and only the data described in §3.9. Once it reaches them they are independent controllers under their own privacy policies.

6.3 Other users

The only thing other users of Estudylog can see is a community theme you deliberately posted, shown with your initials and the light/dark mode it was designed in. Nothing else you store in Estudylog is visible to any other user.

6.4 Legal, safety and corporate transactions

We may disclose personal data if we believe in good faith that it is necessary to: comply with a law, regulation, legal process, subpoena or governmental request; enforce our Terms of Service; detect, prevent or address fraud, security or technical issues; or protect the rights, property or safety of Estudylog, our users, or the public.

If Estudylog is involved in a merger, acquisition, financing, reorganisation, bankruptcy, or sale of all or part of its assets, your data may be transferred as part of that transaction. We will notify you (in-app or by email) if your data becomes subject to a materially different privacy policy as a result.

7. International transfers

Estudylog's infrastructure is hosted in the United States. If you use the Service from Canada, the European Economic Area, the United Kingdom, Switzerland, or anywhere else outside the United States, your personal data will be transferred to and processed in the United States and potentially in other countries where our providers operate.

These countries may not offer the same level of data protection as your home country, and your data may be accessible to authorities in those countries under their laws.

Where the GDPR or UK GDPR applies, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where relevant), or on an adequacy decision where one is available, as the transfer mechanism with our providers. You can request a copy of the relevant safeguards by emailing support@estudylog.com.

8. How long we keep data

Aggregated or de-identified data that can no longer reasonably be linked to you (for example "total sessions logged across all users in August") may be retained indefinitely.

9. Deleting your account and your data

You can request deletion from Settings inside the App.

How it works. Deletion is scheduled, not immediate. When you request it we record a pending deletion with a grace period (7 days by default; the App accepts a range of 1–60 days). During the grace period:

• you are signed out;
• the App wipes this device's local copies — your wallpaper and schedule data, your home theme (applied look, saved library and posts mirror), your bookshelf wall photo and its settings, your timer backdrop photo and choice;
• your community theme posts are unpublished immediately;
• signing back in during the grace period cancels the deletion and restores your account.

After the grace period, our server-side job deletes your user record and its subtrees.

Deletion requires a connection. The App will not schedule a deletion while you are offline, so that you are never left with a deletion pending that you cannot cancel.

What deletion does not reach.

• Data already sent to Sentry and Mixpanel is deleted on our instruction; email support@estudylog.com if you want us to confirm this has been done.
• Apple holds your purchase and subscription records independently. Deleting your Estudylog account does not cancel your subscription — cancel it in the App Store (Settings → your name → Subscriptions), or you will continue to be billed.
• Records we are required to keep for tax, accounting, fraud-prevention or legal-defence purposes are retained as described in §8.
• Data in encrypted backups rolls off within about 90 days.
• The install-date history in your device's Keychain is on your device; erasing the device removes it.
• Anything already delivered to Discord or Govee is subject to their deletion processes.

You may also delete individual courses, sessions, notes, themes and wallpapers at any time from within the App without deleting your account.

10. Your privacy rights

10.1 Everyone

Whatever jurisdiction you are in, you may ask us to: give you a copy of the personal data we hold about you; correct data that is wrong; delete your data; or explain what we do with it. Email support@estudylog.com. We will respond within 30 days, or sooner where the law requires it. We may need to verify your identity — usually by asking you to write from the email address on the account.

We will not discriminate against you for exercising any privacy right. We do not offer financial incentives in exchange for personal data.

10.2 European Economic Area, United Kingdom and Switzerland (GDPR / UK GDPR)

You have the right to: access your data; rectify inaccurate data; erase your data ("right to be forgotten"); restrict processing; data portability (a machine-readable copy of data you provided, and to have it transmitted to another controller where technically feasible); object to processing based on legitimate interests, including profiling; and withdraw consent at any time where we rely on consent, without affecting the lawfulness of processing before withdrawal.

We do not carry out automated decision-making producing legal or similarly significant effects about you within the meaning of Article 22.

You have the right to lodge a complaint with your local supervisory authority. In the UK, that is the Information Commissioner's Office (ico.org.uk). In the EEA, a list is maintained at edpb.europa.eu.

10.3 California (CCPA / CPRA)

In the twelve months before the date of this policy we collected the categories of personal information described in §3, which map to the statutory categories: identifiers; commercial information (purchases); internet or other electronic network activity information (usage of the App); and inferences (derived study metrics). We collected them from you, from your device, and from our service providers, for the business purposes in §4, and disclosed them to the service providers listed in §6.1.

We have not sold personal information, and we have not shared personal information for cross-context behavioural advertising, in the preceding twelve months. We do not have actual knowledge of selling or sharing the personal information of consumers under 16 years of age.

You have the right to know, to delete, to correct, to opt out of sale or sharing (not applicable, as we do neither), and to limit the use of sensitive personal information (we do not collect sensitive personal information as defined by the CPRA). You may use an authorised agent, with written proof of authorisation.

10.4 Canada (PIPEDA and provincial law)

You may request access to your personal information and challenge its accuracy and completeness. You may withdraw consent, subject to legal or contractual restrictions and reasonable notice — but note that withdrawing consent to the processing needed to run your account means we can no longer provide the Service. You may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca), or to your provincial regulator. If you are in Quebec, you also have rights under Law 25, including the right to data portability and the right to be informed about automated processing.

10.5 Other jurisdictions

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and other US states with comprehensive privacy laws, of Brazil (LGPD), of Australia, and of other jurisdictions with comparable laws, have rights broadly equivalent to those above, including a right to appeal a refused request. Email support@estudylog.com and we will apply your local rights.

11. Children

Estudylog is a general-audience study tool. We do not restrict who may use it by school, subject, level or age beyond the legal minimum described here.

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13 — or under 16, where a higher age of digital consent applies in your country, unless a parent or guardian has consented. This limit exists because laws including the US Children's Online Privacy Protection Act (COPPA), the GDPR, and Canadian federal and provincial privacy law regulate the collection of children's personal data, and Estudylog necessarily collects personal data to run an account.

We do not knowingly build profiles of, or direct marketing to, children.

If you are a parent or guardian and believe your child has provided us with personal information, email support@estudylog.com. We will verify the request, delete the data, and close the account promptly and at no cost to you.

12. Security

We take security seriously, though no system is perfectly secure.

• All traffic between the App and our backend is encrypted in transit (TLS). Data at rest in Google Cloud is encrypted.
• Passwords are stored only as salted hashes by Firebase Authentication. We have no ability to read them.
• Access to your data is enforced by Firestore security rules: a signed-in account can read and write only its own subtree. Derived metrics are read-only to clients. Bug reports can be created by you but read by nobody but us. Your Discord OAuth tokens are in a path that no client can ever read, by rule.
• Requests are gated by Firebase App Check, backed by Apple's App Attest with DeviceCheck as a fallback, so requests from tampered or spoofed clients are rejected.
• Subscription receipts are validated server-side against Apple. The App cannot grant itself premium.
• Sensitive local values (your device identifier, install history, your Govee API key) are held in the iOS Keychain, not in plain preferences.
• We limit internal access to production data to what is needed to operate and support the Service.

If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and affected users as required by applicable law.

You are responsible for keeping your account password secret and your device secure.

13. App store privacy labels

The App Store product page shows Apple's "App Privacy" labels, and the Google Play listing shows Google's "Data safety" section. Both are summaries expressed in that store's fixed categories, and both are constrained by what those categories allow us to say.

This policy is the authoritative and more detailed description. Where a store label and this policy appear to differ, this policy governs, and we will correct the label.

14. Do Not Track

The App is not a web browser and does not respond to browser "Do Not Track" signals. We do not track users across third-party apps or websites in any event. Where we are required to honour a Global Privacy Control signal on our website, we do.

15. Changes to this policy

We may update this policy. When we do, we will change the "Last updated" date at the top and post the new version at https://estudylog.com/privacy.

If a change is material — for example if we begin collecting a new category of data, use your data for a materially new purpose, or add a sub-processor that meaningfully changes where your data goes — we will give you notice in the App or by email before the change takes effect, and where the law requires consent we will ask for it.

Continuing to use the Service after a change takes effect means you accept the updated policy, except where consent is legally required.

16. Contact

Email: support@estudylog.com
Web: https://estudylog.com/contact
Postal: Estudylog Inc., Toronto, Ontario, Canada
Entity: Estudylog Inc., a corporation incorporated federally under the Canada Business Corporations Act

If you are unhappy with our response to a privacy request, you may escalate to your local data protection authority (see §10.2 and §10.4).

Estudylog is a product of Estudylog Inc. It is an independent product and is not affiliated with, endorsed by, or sponsored by Apple Inc., Google LLC, Discord Inc., Govee, OpenAI, Mixpanel, Sentry, or any university named in the App's institution catalogue.