Privacy Policy

This policy explains what personal data StudyLess collects, why, who else processes it, how long we keep it, and what you can do about it. It covers the StudyLess apps for iOS and Android, the web app at app.studyless.app, this website (including its contact form), and the emails we send you.

We wrote it to be read. If something here does not match what the product does, tell us at support@studyless.app and we will fix the product or the policy, whichever is wrong.

1. Who is responsible, and how to reach us

• Controller (the person responsible for your data): Mingeon Kim, an individual operating the service as "StudyLess", Seoul, Republic of Korea.
• Privacy officer (South Korea's Personal Information Protection Act): Mingeon Kim.
• Email for privacy requests and support: support@studyless.app

We have not appointed a Data Protection Officer under Article 37 GDPR, because our processing does not meet the conditions that require one, and we have not appointed an EU or UK representative under Article 27. Contact us directly at the address above.

The laws that most often apply to how we handle your data are the EU and UK GDPR, the California Consumer Privacy Act (CCPA/CPRA), Brazil's LGPD, South Korea's PIPA and Japan's APPI. Section 3 lists the legal basis we rely on under each.

2. What we collect, and why

The list below follows what you do in the product. Everything in it is stored against your account ID, a random identifier created when your account is made.

2.1 Creating and keeping an account

What:

• Your email address, and a password if you sign up with email. The password is stored only as a hash by our authentication provider; we never see it.
• If you use Sign in with Apple or Google: the identifier the provider gives us for you, the email it shares (for Apple this can be a private relay address), and your name if the provider passes it on.
• For Apple sign-in, an encrypted refresh token, kept only so we can disconnect your Apple ID from StudyLess when you delete your account, as Apple requires.
• Account timestamps, your language and appearance settings, and study preferences such as cards per round.
• If you answer the optional first-run questions: what you are studying for and how you heard about StudyLess, each from a short fixed list, and, if you heard about it on TikTok, Instagram or YouTube, which account (one from a short list, or “someone else”; kept in the acquisition record, 2.6a). The questions about a test date and a study time only fill in your first deck's exam date and your reminder time. Skipping any of them changes nothing.

Why: to sign you in, keep your library the same on every device, and send account emails (password reset, email change). Earlier versions of StudyLess let you start as a guest; if you did, your data is tied to an anonymous account ID until you add an email or provider sign-in.

2.2 Study material and flashcards

What:

• The photos, PDFs and pasted text you add, with the file name, size and page count.
• The text we extract from that material so it stays readable, and the flashcards generated from it.
• Source summaries: a summary our AI provider writes of each source file or recording on its own, kept with that source until you remove the source, its deck or your account.
• Cards you write or edit yourself, and any images you attach to a card.
• Your decks: name, subject category, colour and picture (an icon, emoji or illustration), an optional exam date and per-deck study settings; and your folders: name, colour and picture, an optional exam date, and which decks each one holds.
• If you record a lecture (up to three hours, on the phone or in the browser): the audio, in 30-second parts, which our AI provider transcribes (Section 6); the audio and its transcript are kept privately in your account until you delete the recording, its source or your account. The transcript is also a source on the deck, with the notes and cards written from it. Until a part has uploaded, it is kept on your device for your account only. On the web you can also upload one audio file instead of recording.
• If you send a copy of a deck: an unlisted link, valid for 30 days until you stop it. Anyone who has it and signs in can see the deck's name, icon, colour, subject and number of cards, its first three card fronts and whether it has notes, and add their own copy of its cards and notes — never your reviews, your source files or your name. Pictures inside the cards are the exception: the copy links to the images stored in your account (see below), so the other person can open them for as long as those images exist. We count how many times a link was used.

Why: this is the product. Source files live in a storage folder that only your signed-in account can read. Extracted text and cards live in our database. A copy of your library is also kept on your device (and, in the web app, in your browser) so you can keep studying offline.

Images attached to cards are different. They are stored at long, unguessable web addresses that do not require a sign-in, so anyone who has the exact link can open them. Nothing in StudyLess lists or publishes those links, but please do not attach an image to a card that you would not want reachable that way. We are treating this as a gap to close, not a feature.

2.3 Reviews and scheduling

What:

• Each rating you give a card (Again, Hard, Good, Easy), when you gave it, and how long the card was on screen.
• The scheduling state the algorithm keeps per card (stability, difficulty, next due date) and the scheduler parameters kept for your account.
• Counters such as cards reviewed in total and your last study date.

Why: to decide when each card comes back, adapt the schedule to an exam date when you set one, and show you what is due and what you have done. The scheduling section (Section 5) explains what the algorithm does with this.

2.4 Mock exams

What:

• The questions generated for a deck, and the format and difficulty you chose.
• The answers you select or type, the score and feedback for each answer, and when you started and finished.

Why: to run the exam and show you the result. The cards of the deck are sent to our AI provider to write the questions, and your written answers are sent to it to be graded (Section 5). A mock-exam result describes that attempt; it is not a prediction of an exam grade.

2.4a Notes, the deck chat, Ask AI and the Pro tools

What:

• Your notes (earlier called the deck summary): one document per deck (a title, an overview, sections, key terms and a recap) kept with the deck, with the previous version kept so a rewrite can be undone, the change you asked for when you last had them rewritten, and the number of cards and sources it was made from. If you choose “Listen”, the narration's script and its audio file, stored in your account's private storage.
• Your deck chat: one thread per deck with your questions (including those asked with “Explain” on a card), the replies, any change to your cards or notes the chat suggested and whether you applied it, and a line for each notes rewrite you asked for. A thread is kept until you clear it, delete its deck or delete your account; it does not expire on its own.
• When you use “Ask AI” on a card during a review: the question you ask. The replies stay on screen for that card and are not stored.
• Podcast episodes (Pro): the format, length and focus you chose, the script with its timings, and the audio file (MP3), stored in your account's private storage until you delete the episode or your account.
• Visual overviews (Pro): the picture drawn from your notes and the description it was drawn from, stored in your account's private storage. Asking again replaces it.

Why: to write, rewrite, narrate and draw your notes, answer your questions about the deck, and make podcast episodes. For the notes, the deck's sources (text, photos, PDF pages and transcripts) and its cards are sent to our AI provider; for the chat, your question, the recent turns of the thread and the deck's notes, source text and cards; for Ask AI, the card's text and your question; for a podcast episode, the deck's notes, sources and cards, and then the script to be voiced; for a visual overview, the notes (Section 5). The microphone is used only while you record a lecture, and only after you allow it.

2.5 Reminders (mobile apps)

What:

• Whether you turned reminders on, the time you chose, your device's time zone and language, and whether the operating system has granted notification permission.
• A push notification token for your device, stored with the platform and your reminder settings.

Why: the daily reminder is scheduled on your device. The push token exists so that we can also send reminders from our server through Apple's and Google's push services (via Expo) when your device has not opened the app; that server-sent channel is currently switched off, and we will keep this policy current if we turn it on. Reminder text contains counts of due cards, never the content of a card. Turning reminders off in Settings stops both channels.

2.6 How the app is used (product analytics)

What:

• Events such as app opened, screen viewed, deck created, cards generated or saved, review session started and ended, number of cards rated, mock exam started, settings changed, feedback sent, and account deleted (with the reason you picked from a list).
• With each event: your account ID, platform, app version and build, language, whether the account is a guest, your plan (Free, Pro or a trial), and the device model and operating system version the analytics library reads.
• In the web app, the campaign tags of the link you arrived through (utm_source, utm_medium, utm_campaign and the like), which the analytics library adds to events. It is set not to record the page address, the referring page or advertising click identifiers.
• A profile per account with counts, flags and a few answers: platform, language, sign-in method, number of decks and cards, how many decks have an exam date and how many days until the nearest one, whether you have created cards or completed a review and how long ago your first cards were made, your reminder and notification settings, your appearance setting, your plan and where it came from, your answers to the first-run questions about what you study for and how you heard about StudyLess (2.1), and, where known, the campaign tags of the link you first came through (on Android, from Google Play's install referrer).
• Copies of the subscription events in 2.12, keyed to your account ID: RevenueCat sends them to our Mixpanel project for us, and our server records when Pro starts (a trial or a paid subscription, its billing period and the store's platform) and sets your plan on the profile. These are sent from the servers, not your device, so the switch below does not stop them.
• Your IP address at the moment an event is sent, which Mixpanel uses to derive an approximate location (city or region), and a random device identifier the analytics library creates.
• On mobile, Mixpanel's own app-lifecycle events (first open, app updated, session start).

What is deliberately not sent: your email, your name, the text of any card or deck name, search terms, file names, or the content of feedback. The analytics code rejects those property names and scans values for anything that looks like an email address, a token or free text before an event leaves the device. Session replay and click recording are off on every platform.

Why: to see where students get stuck (for example, how many people who sign up ever make a first deck) and whether a release made things better or worse. You can turn this off in the app's settings: Settings → Data & privacy → Share usage analytics. The switch is remembered per device and stops events before they leave it; crash reports (2.7) are separate. To have the analytics data already collected deleted, email us (Section 10).

2.6a How you found StudyLess (the acquisition record)

What:

• Written when you sign in and stored with your account (not at Mixpanel): the platform you started on; the campaign tags (source, medium, campaign) of the link you came through, read from the web address in the web app or from Google Play's install referrer on Android, and where they came from; the account you named under “Which account?” (2.1); and your device's language and time zone.
• The first value of each is kept and never overwritten. The record is included in your export and deleted with your account.

Why: to learn which links, videos and creators bring students to StudyLess.

2.7 Errors and crashes

What:

• The error, a stack trace, app version and build, device model and operating system, the screens visited before the error, and your account ID.
• On mobile, a random installation identifier so Sentry can count crash-free sessions per release.

Why: to reproduce and fix bugs. Request bodies, headers, cookies, email addresses and names are stripped before a report is sent, the report is not tagged with your IP address, and session replay is off.

2.8 Support and feedback

What:

• From the in-app feedback form: the category you pick, your message, an optional name, an optional screenshot, the app version, and your account ID and account email so we can reply.
• From the website contact form: the category, your message, the name and email you enter, and an optional screenshot.
• Emails you send to support@studyless.app.

Why: to answer you and fix what you reported. Screenshots are stored where only we can open them.

2.9 Technical, security and usage records

• Server logs kept for a short time by our hosting providers: IP address, request time, endpoint, and result code.
• Rate-limit ledgers: the times your account made an AI request and started each metered use (a deck, notes, a mock exam, a chat question, a podcast episode, a visual overview, a recording), kept for the window each one enforces (Section 8).
• An AI usage ledger per model call: model, timing, token counts, outcome or error category, and provider request IDs. It does not contain your material or the cards.

Why: to keep the service running, to stop abuse, and to know what the AI features cost. Allowances depend on your plan; these records only enforce them.

2.10 This website

studyless.app uses Vercel Web Analytics and Speed Insights, which record page views, the referring site, country or region, device and browser type, and page performance. Vercel describes this as cookieless and does not use it to follow you across other sites. The website sets no advertising or tracking cookies. The contact form is described in 2.8.

2.11 Data from features we removed

Versions of StudyLess before 2.0 (August 2026) had study streaks with a daily goal, a public deck library where you could publish a deck under a display name and username, an onboarding question about how you found the app, and billing scaffolding that never charged anyone. The current apps do not collect any of this, except that they ask the “how did you hear about us” question again as an optional choice from a fixed list (see 2.1) and sell a subscription (see 2.12). Rows that already exist stay in our database until a cleanup migration removes them, and they are deleted with your account. Answer checks, where AI checked an answer you typed or spoke during a review, have also been removed; the current apps no longer send answers for checking, and use the microphone only while you record a lecture.

One consequence needs saying plainly: decks that were published to the old public library are no longer shown anywhere in StudyLess and can no longer be read without a StudyLess sign-in, but until that cleanup completes a signed-in user of an older app version who knows the deck's identifier could still retrieve its cards and the display name it was published under. Deleting the deck from your library removes it immediately; you can also email us to have it removed.

2.12 Subscriptions (StudyLess Pro)

What:

• Your plan (free or Pro), whether it is a paid subscription or a trial, when it expires and where it came from (a store purchase, an earlier invite reward or a grant we made), stored on your account, with a record of any Pro days granted outside a store purchase.
• Subscription events the store reports to us through RevenueCat: the product bought, the period, whether it is a trial, purchase and expiry dates, the store, and RevenueCat's own event and customer identifiers. We keep each event as received until you delete your account.
• Billing emails, while each is switched on: your account email goes to Resend to send one reminder about two days before a free trial ends (on any store), one notice about 30 days before a yearly plan renews (with the date, the price, how to cancel, and two counts from your account: the decks you made and the cards you reviewed in the past 12 months), and one notice when a payment fails (Section 6). We record when each was sent.
• If you take the seven more free days the cancel screen offers on a trial: when, through which store, and the day they run to; for Google Play, also a one-way hash of the store's purchase token (never the token itself), so the days are given once.
• If you took part in the invite programme, which is no longer offered: your invite code, the accounts it brought in and the days of Pro each side received.
• If you made a payment link for someone else to pay (“Someone else paying?”, offered only while Pro is sold on the web, which it is not at the moment): a random link code tied to your account, when it was made and when it stops working (14 days). Anyone holding the link can see whether your account has Pro and can buy Pro for it; the page shows no name, email or study data. Deleted with your account and never included in exports.

What we never see: your card number or payment details. Pro is bought in the iPhone and Android apps, and Apple or Google handle payment; we receive only the subscription status. Pro is not sold on the web at the moment.

Why: to give a paid account what it paid for, to honour Pro days from earlier invite rewards and grants, and to answer questions about a subscription. These records are deleted with your account. Apple and Google keep their own records of your purchases as the sellers, under their own policies (Section 9).

3. The legal basis for each use

• Your account, study material, cards, reviews, mock exams, reminders and support (2.1–2.5, 2.8): needed to provide the service you asked for. GDPR/UK GDPR Art. 6(1)(b); LGPD Art. 7(V); PIPA Art. 15(1)(4) (necessary to perform the contract with you); CCPA/CPRA business purpose.
• Analytics, the acquisition record, error reports, security and usage records (2.6, 2.6a, 2.7, 2.9, 2.10): our legitimate interest in understanding, improving and protecting the service, weighed against your rights and limited as described above. GDPR/UK GDPR Art. 6(1)(f); LGPD Art. 7(IX); PIPA Art. 15(1)(6); CCPA/CPRA business purposes (analytics, debugging, security). You can object at any time (Section 10).
• Mobile notifications: your choice in the app, plus the permission you grant to the operating system. Withdraw either at any time.
• Legal obligations and claims: where we must keep or disclose data to comply with the law or defend a claim. GDPR Art. 6(1)(c) and (f).

We do not sell personal data, share it for cross-context behavioural advertising, or use it to profile you for marketing. We do not process special categories of data on purpose; do not put health, religious, political or similar information about yourself or others into your cards.

4. Children and teenagers

StudyLess is made for students, and many of them are between 13 and 17. It is not for children under 13, and we do not knowingly create accounts for them. Where your country sets a higher age for using an online service without a parent's consent, that age applies: 14 in South Korea, and up to 16 in some EU countries. We do not currently have a way to collect a parent's consent, so users under those ages cannot use StudyLess.

Because minors use the product, we keep the rules in this policy tight for everyone: no advertising, no sale or sharing of data, no cross-app tracking, study material never used to train AI models, and analytics that cannot carry names, emails or card text.

If you believe a child under the applicable age has an account, email support@studyless.app and we will delete it. A parent or guardian may make any request in this policy on their child's behalf; we may ask for enough information to confirm the relationship.

5. AI features and automated scheduling

5.1 The AI features (OpenAI)

We use the OpenAI API, provided by OpenAI, L.L.C. (United States), to write your notes and rewrite them when you ask, to turn your material into flashcards, to answer the deck chat and Ask AI, to write a summary of each source, to write mock-exam questions from a deck's cards and grade written mock-exam answers, to write podcast scripts and voice them, to narrate notes, to draw visual overviews, and to transcribe lecture recordings. Here is exactly how that works:

• What is sent: the material the feature works from (your sources — photos, PDF pages, pasted text and transcripts, cut into parts when large — a deck's notes and cards, your chat question with the recent turns of the thread, your written mock-exam answers, the text to be spoken for a podcast or narration, and the audio of a recording to be transcribed), and our instructions for the task. A random request ID is included so repeated parts of a request can be cached.
• What is not sent: your name, email address or account ID. Requests go from your device to our own server (from the web app, through the web app's server at Vercel, Section 6), which holds the API key and forwards the request; the key is never in the app.
• Storage at OpenAI: requests that write text (notes, cards, chat and Ask AI replies, source summaries, mock exams, grading and podcast scripts) are sent with storage disabled (store: false), so OpenAI does not keep them as retrievable conversation history. Requests to OpenAI's image, text-to-speech and transcription services (visual overviews, voices and narration, lecture transcripts), and the upload of larger files, carry no such setting. Larger files are uploaded to OpenAI only for the duration of a generation and deleted as soon as it finishes; an hourly job deletes any that were missed, so a file should never persist there beyond about an hour.
• Abuse monitoring: OpenAI states that it keeps abuse-monitoring logs of API usage for up to 30 days, longer only where the law requires it. That retention is OpenAI's, not ours, and store: false does not shorten it.
• Training: OpenAI states that data sent through its API is not used to train or improve its models unless the customer opts in. We have not opted in, and we do not train models of our own on your material.

Generated notes, cards, answers, questions, grades, summaries, podcasts and pictures can be wrong. Check them against your source, especially before an exam. If we ever change AI provider, we will update this policy before the change takes effect.

5.2 Review scheduling

StudyLess schedules reviews with a spaced-repetition algorithm (FSRS) that uses your ratings to estimate when you are likely to forget each card and, when a deck has an exam date, adjusts the schedule so the material is due before the exam. It decides only the order and timing of your flashcards. Mock-exam grading is also automated. Neither produces legal or similarly significant effects about you, and neither claims to know whether you are ready for an exam.

6. Who processes your data

We do not sell personal data and we have no advertising partners. The companies below process data for us, under contracts that restrict what they may do with it; Apple and Google also handle their part as sellers or sign-in providers under their own policies, as their entries say. For each one: where they are, where your data is kept, what they receive, why, and for how long.

Supabase, Inc. — United States company; our database, file storage and authentication run on its infrastructure in Amazon Web Services' Singapore region (ap-southeast-1).

• Data: everything in Sections 2.1–2.5, 2.6a, 2.8, 2.9, 2.11 and 2.12: account and sign-in data, password hashes, encrypted Apple tokens, study material and extracted text, source summaries, notes, cards, decks, deck chats, podcast episodes, narrations and visual overviews, review history, mock exams, reminder settings and push tokens, the acquisition record, feedback, ledgers, subscription records.
• Purpose: storing and serving the product, sending authentication emails, running our server-side functions.
• When: continuously, as you use the app.
• Retention: until you delete the data or your account; backups expire within 30 days.

OpenAI, L.L.C. — United States.

• Data: the study material, notes, cards, chat questions, written answers and text to be spoken described in 5.1, and the audio of lectures you record or upload (2.2).
• Purpose: writing and rewriting notes, generating flashcards, source summaries and mock exams, answering the deck chat and Ask AI, grading written answers, writing and voicing podcast episodes, narrating notes, drawing visual overviews, transcribing lecture recordings.
• When: at the moment you use one of those features, and as each part of a recording uploads.
• Retention: text requests not stored as conversation history; uploaded files deleted within about an hour; abuse-monitoring logs up to 30 days (Section 5.1).

Mixpanel, Inc. — United States.

• Data: the analytics events, profile and technical data in 2.6, including the subscription events RevenueCat forwards, keyed to your account ID.
• Purpose: product analytics.
• When: as events happen while you use the app.
• Retention: up to 24 months, then deleted; earlier on request.

Functional Software, Inc. (Sentry) — United States.

• Data: the error reports in 2.7, keyed to your account ID.
• Purpose: diagnosing errors and crashes.
• When: when an error occurs.
• Retention: 90 days.

RevenueCat, Inc. — United States; subscriptions.

• Data: your account ID as the subscriber identifier and the subscription events in 2.12.
• Purpose: selling and managing StudyLess Pro on the App Store and Google Play, telling our server when your plan changes, and sending the subscription events to our Mixpanel project (2.6).
• When: in the mobile apps, each time the app starts with your account signed in and each time you sign in; in both apps, when you open the plan page, buy, restore or cancel; and on every renewal.
• Retention: for as long as the subscriber record exists. Deleting your account does not delete it there; we have it deleted when you ask.

Resend — United States; email delivery.

• Data: your account email and the message (2.12).
• Purpose: sending the billing emails in 2.12: the reminder before a free trial ends, the notice before a yearly plan renews and the notice when a payment fails.
• When: about two days before a trial ends, about 30 days before a yearly renewal, and after a failed payment, each only while that email is switched on.
• Retention: Resend's own delivery records, for the period its service keeps them; we keep only when each email was sent.

Vercel, Inc. — United States.

• Data: the web app and this website are served from Vercel, so it sees the IP address and request metadata of every visit in its short-lived logs. The web app's AI requests (the material in 5.1, up to 20 MB each) and their replies pass through the web app's server at Vercel on their way to and from our server; our code there does not store or log them. On the website, the analytics in 2.10.
• Purpose: hosting; relaying the web app's AI requests; website analytics and performance measurement.
• When: on every visit to studyless.app or app.studyless.app, and each time the web app uses an AI feature.
• Retention: request logs for a short rolling window; website analytics as aggregated statistics.

Expo (650 Industries, Inc.) — United States.

• Data: your device's push token and the reminder message, when server-sent reminders are on (2.5).
• Purpose: delivering push notifications to Apple's and Google's push services.
• When: at the moment a reminder is sent. Currently off.
• Retention: transient delivery records.

Apple Inc. and Google LLC — United States.

• Data: if you use Sign in with Apple or Google, the provider handles your sign-in under its own privacy policy and tells us the identifier, email and name described in 2.1. Their push services carry reminder notifications to your device. The App Store and Google Play handle downloads and updates under their own terms, and sell Pro in the apps as the sellers, handling your payment under their own policies.

We may also disclose data when the law requires it (a court order or a lawful request from an authority), to protect the rights, safety or property of StudyLess, its users or others, or to detect and prevent fraud, abuse or security problems. If StudyLess is ever transferred to another operator (for example, a company set up to run it, or a sale), your data would move with it under this policy, and we would tell you before it happens.

7. Where your data goes (international transfers)

We operate from South Korea. Your data is stored in Singapore (Supabase on AWS) and processed by the providers named in Section 6, in the United States. These countries may not offer the same legal protection as your own.

• EEA, UK and Switzerland: transfers rely on the providers' data processing agreements incorporating the European Commission's Standard Contractual Clauses and the UK Addendum or International Data Transfer Agreement, plus encryption in transit and at rest.
• South Korea: the transfers in Section 6 are necessary to provide the service you signed up for and are disclosed here with the recipient, country, timing, data, purpose and retention period, as PIPA Article 28-8 requires. Providers are bound by contract to protect the data.
• Brazil and other countries: the same contractual protections apply, together with any additional safeguards your local law requires.

Email support@studyless.app if you want a copy of the transfer safeguards for a specific provider.

8. How long we keep data

• Account, sign-in data and preferences: until you delete your account.
• Study material, extracted text, source summaries, notes, cards, decks, review history, mock exams: until you delete the item or your account.
• Deck chats: until you clear the chat, delete its deck or delete your account; nothing expires them automatically.
• Podcast episodes: until you delete the episode or your account.
• Visual overviews: until you ask for a new one, which replaces it, or delete your account.
• Narration audio: until you delete your account. Rewriting the notes retires their narration, but today not its audio file.
• Files stored for a deleted deck: deleting a deck removes its records at once, but today not the files stored for it (uploaded files, card images, audio and pictures); they stay in storage until you delete your account.
• Interrupted generation drafts on your device: the source copies expire six hours after the generation started; the cards already produced stay until you save or discard them.
• Reminder settings and push tokens: until you turn reminders off, the token stops working, or you delete your account.
• Feedback and support messages: while we work on them and for up to 24 months afterwards, in case the same issue comes back; deleted with your account when linked to it.
• Analytics (Mixpanel): up to 24 months from collection.
• Error reports (Sentry): 90 days.
• Rate-limit ledgers: for the window each one enforces — an hour, a day, or until the calendar week or month ends — and then removed the next time your account makes a request that checks it, or when you delete your account.
• AI usage ledger: until you delete your account.
• The acquisition record and subscription records (2.6a, 2.12): until you delete your account.
• Server logs at hosting providers: short rolling windows set by the provider.
• Backups: rolling, expiring within 30 days.

Where the law requires us to keep something longer (for example, records of a dispute), we keep only what that obligation covers, for as long as it applies.

9. Deleting your account

Open Settings in the app or the web app, choose Delete account, and confirm by typing the confirmation word the screen shows (DELETE in English). You can also email support@studyless.app from the address on the account. Export your data first if you want to keep it; deletion cannot be undone.

Deletion runs immediately and removes, in this order:

• your uploaded files, card images, lecture audio, narration and podcast audio, visual overviews and feedback screenshots from storage;
• any file still held at OpenAI on your behalf;
• your ledgers, lecture transcripts, notes, source material and source summaries, deck chats, podcast episodes, mock exams, review history, cards, decks, folders, share and payment links, the acquisition record, your subscription and billing records (plan, Pro-day grants, subscription events, trial reminders and old invite rows), feedback records, push subscriptions, Apple token and profile, including rows left by removed features;
• the account itself. If you signed in with Apple and we hold an Apple token for your account, we ask Apple to revoke the link between your Apple ID and StudyLess before anything is deleted.

What deletion does not reach on its own:

• database backups, which expire on their own within 30 days;
• OpenAI's abuse-monitoring logs, which expire within 30 days (Section 5.1);
• the analytics copy at Mixpanel: your profile (the per-account counts and flags in 2.6) is deleted at once, and we file an erasure request for the events keyed to your account ID in the same step, which Mixpanel completes on its side within about 30 days;
• the error reports at Sentry, which are keyed to your account ID and expire within 90 days (Section 8) — ask us and we will have them deleted sooner;
• the subscriber record at RevenueCat, keyed to your account ID, which we have deleted when you ask (Section 6);
• the purchase records Apple and Google keep as the sellers, under their own policies, and Resend's delivery record of a billing email;
• copies of your decks that other people added from a link you sent, which belong to their accounts (pictures in them that point at your images stop loading);
• emails you sent to support, which we delete on request unless we need them for a dispute.

If a step fails (for example, our storage provider is unreachable), the app tells you the deletion did not complete and you can retry; we never report a deletion as done when it is not. Guest accounts from earlier versions have no email to recover with: once you sign out of a guest account, you cannot reach its data again.

10. Your rights and choices

Wherever you live, you can:

• See and take your data: Settings → Data & privacy → Export my data gives you one JSON file with your decks, cards, notes, folders, sources (their details and extracted text), source summaries, review history, mock exams, deck chats, the scripts of your podcast episodes, the transcripts of your recordings, your acquisition record, your first-run answers and your study counters, plus any work still waiting on that device to upload. It does not contain audio or pictures (uploaded recordings, podcasts, narrations, visual overviews), the bytes of your uploaded files and card images, the changes the chat suggested, or your subscription and billing records; ask us for any of these.
• Correct it: edit cards, decks, your email and your password in the app.
• Delete it: delete individual decks and cards, or your whole account (Section 9).
• Turn off usage analytics: Settings → Data & privacy → Share usage analytics, in the app's settings. To object to crash reporting as well, or to have the Mixpanel and Sentry data already linked to your account ID deleted without deleting the account, email us.
• Control reminders: turn them off in Settings, or revoke the notification permission in your device settings.
• Ask us anything else about how your data is handled, including asking us to restrict a particular use.

Region-specific notes

• EEA, UK, Switzerland: you also have the rights to restriction and portability, to object to processing based on legitimate interests, and to complain to your data protection authority (in the UK, the ICO). We would rather hear from you first, but that is your right.
• California and other US states: you have the rights to know, access, correct and delete, and not to be discriminated against for using them. We do not sell or share personal information as those laws define it, and we do not use sensitive personal information to infer characteristics about you, so there is nothing to opt out of.
• Brazil: you have the rights listed in Article 18 LGPD, including confirmation of processing, access, correction, anonymisation or deletion of unnecessary data, portability, and information about the entities we share data with (Section 6).
• South Korea: you may request access, correction, deletion and suspension of processing under PIPA, and you may contact the Personal Information Protection Commission's report centre (privacy.go.kr, 118) if you believe we have not handled your data properly.
• Japan: you may request disclosure, correction, suspension of use and deletion of your retained personal data under the APPI.

How to exercise a right

Use the in-app features above, or email support@studyless.app from the email address on your account. If we cannot tell it is you, we will ask you to confirm from that address or to send something only the account holder would know. We answer within the time the applicable law allows — normally within 30 days, and sooner when we can. There is no charge.

11. Security

• All traffic between your device, our servers and our providers is encrypted (TLS). Data at rest is encrypted by our hosting provider.
• Every table holding your data has row-level access rules, so a signed-in account can only read and write its own rows. Your source files sit in a folder only your account can read.
• Provider keys (OpenAI, push, Apple) exist only on our server, never in the app. Passwords are stored as hashes; Apple refresh tokens are encrypted.
• Analytics and error reports are scrubbed in code before they leave the device, and the rules are tested on every change.

Two limits are worth knowing. Card images are reachable by anyone with their exact link (Section 2.2). And no system is perfectly secure: if we ever learn of a breach affecting your data, we will tell you and the relevant authorities as the law requires.

12. Cookies and storage on your device

• Web app (app.studyless.app): your sign-in session and analytics identifier are kept in your browser's local storage; a copy of your library and pending changes is kept in IndexedDB so the app works offline; a small cookie remembers your language (studyless-lang). None of these are used for advertising.
• Mobile apps: your session, library, settings and cached source files are stored in the app's own storage on the device and removed when you sign out or uninstall.
• This website: no advertising or tracking cookies; the Vercel analytics in 2.10 are cookieless. The campaign tags of the link you arrived through are kept in the tab's session storage so the site's links can pass them on to the stores and the web app, and the contact form keeps the time you last sent a message in local storage to prevent repeated sends.

Clearing your browser storage or uninstalling the app signs you out and removes the local copy; your account data stays on our servers until you delete it.

13. Links to other services

StudyLess links to our Discord community and to the App Store and Google Play. Those services have their own privacy practices, which we do not control.

14. Changes to this policy

When we change how we handle data, we update this page and its effective date first. For changes that matter to you — a new provider, a new kind of data, a new purpose — we also tell you in the app or by email before the change takes effect, and where the law requires your consent we ask for it rather than assume it. Continuing to use StudyLess after a change does not, by itself, mean you agreed to anything that needed your consent.

Change history

• October 8, 2026: Pro is bought only in the iPhone and Android apps, so Paddle is no longer named (it never took a real payment for StudyLess); the billing emails through Resend now cover every store's trial reminder and add a notice before a yearly plan renews (with two counts from your account) and one when a payment fails; described the record kept when you take the cancel screen's seven more free days; the payment link is offered only while Pro is sold on the web.
• October 2, 2026: stated that our server, as well as RevenueCat, records in Mixpanel when Pro starts and the plan on your profile, and that the usage-analytics switch does not stop these server copies.
• September 26, 2026: corrected descriptions to match the current apps: named Paddle (the seller of Pro bought on the web, which receives the account email) and Resend (the trial reminder email, while it is switched on); described the deck chat and its history, podcast episodes, visual overviews, source summaries, the change you ask for in a notes rewrite, and the acquisition record written at sign-in; listed every purpose we use OpenAI for and which requests carry its storage setting; added the plan and campaign details in analytics and the subscription events RevenueCat forwards to Mixpanel, and removed a profile field that does not exist; stated that the web app's AI requests pass through its server at Vercel and that the phone apps contact RevenueCat at start-up and sign-in; corrected the export (one JSON file, with what it leaves out), the deletion list, the Apple disconnection (when we hold an Apple token), the retention of rate-limit rows, drafts, narration audio and a deleted deck's files, what a sent copy carries, and the billing-records statement; described the website's session and local storage.
• September 24, 2026: corrected descriptions to match the current apps: decks sit in folders instead of inside other decks; the deck summary is now called notes, and a copy of a deck includes them; answer checks and the invite programme are no longer offered; allowances depend on your plan; the deletion list names notes, folders, share and payment links, narration audio and lecture audio; a recorded lecture's audio is kept in your account, in 30-second parts, until you delete the recording, its source or your account (it was described as deleted after transcription), and OpenAI's entry names the lecture audio it transcribes; removed a cookie the web app no longer sets and internal version numbers.
• September 14, 2026: rewritten to match StudyLess 2.0: added mock exams, stored extracted text, reminder settings and push tokens, feedback screenshots, the AI usage ledger and the public-link note for card images; named Vercel and Expo; corrected Supabase's hosting region to Singapore; described immediate account deletion and what it does not reach; removed streaks, daily goals and avatars, which no longer exist; named the privacy officer under PIPA and corrected the legal bases. The same day, feedback screenshots were made private, unauthenticated access to the old public deck library was closed, and the usage-analytics switch was added.
• August 16, 2026: corrected the AI provider from Google (Gemini API) to OpenAI, which it had been in practice, and described retention and training handling.

15. Contact

Questions, requests, or something that looks wrong: support@studyless.app. Postal correspondence can be arranged through that address. For how to delete your account from outside the app, see Delete your account. Our Terms of Service cover the rest of the relationship.