Privacy Policy

Last updated 25 October 2026

This policy explains what StudySquad collects, why, who it is shared with and the choices you have. StudySquad is operated by Daniel Smirnov ("we"). We are the data controller for the personal data described here.

The short version

• We collect what is needed to run StudySquad: your Google name, email and picture, and the study sessions you create or join.
• Your study content is sent to Anthropic's Claude so the AI classmates can research topics and reply.
• No ads, no tracking, no selling of data. One essential cookie keeps you signed in.
• You can download all your data or delete your account at any time in Settings.

What we collect

• Account data from Google when you sign in: your Google account ID, name, email address and profile picture. We never see your Google password.
• Profile and preferences you set: display name, study level, reply language and length, quiz difficulty and appearance settings.
• Study content: groups you create or join, session topics, notes you paste, chat messages, the AI classmates' replies, study briefs and the web sources they cite, quiz answers and scores, and the "weak spots" we derive from missed quiz questions.
• Usage data: how many messages, quizzes and sessions you use per day and how much AI processing they took, so we can apply plan limits and keep costs under control.
• Feedback you send us through the app.
• Technical data: our hosting provider processes IP addresses and request logs to deliver and secure the service.

Why we use it and our legal basis

• To provide StudySquad (sign-in, sessions, groups, AI classmates, quizzes, your settings). Legal basis: performance of our contract with you (GDPR Art. 6(1)(b)).
• To keep the service safe and affordable: preventing abuse, enforcing fair-use limits, fixing bugs and monitoring costs. Legal basis: our legitimate interests (Art. 6(1)(f)).
• To answer you when you send feedback or a request. Legal basis: legitimate interests, or the contract where it concerns your account.

We do not use your data for advertising, we do not sell it, and we do not make decisions about you that have legal or similarly significant effects based solely on automated processing.

How the AI works with your data

The AI classmates are powered by Claude, made by Anthropic. When you start a session or send a message, the session's topic, notes, recent conversation and relevant study preferences are sent to Anthropic's API to generate replies, quizzes and study briefs. To research a topic, Claude may search the web for that topic. Under Anthropic's commercial terms, data sent through the API is not used to train its models by default. AI replies can be wrong; one classmate, Ava, sometimes makes mistakes on purpose as a learning game (you can turn this off in Settings).

Who can see your data

• Other members of your groups can see that group's sessions, including your display name, picture, messages and quiz scores. Solo sessions are visible only to you.
• Service providers that process data for us under data-processing terms:
  • Railway (hosting and database).
  • Anthropic (AI processing).
  • Google (sign-in, only when you choose to sign in with Google).
• Authorities, only where the law requires it.

International transfers

Our hosting and AI providers may process data in the United States. Where data leaves the European Economic Area, transfers rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses.

How long we keep data

• Account, profile and preferences: until you delete your account.
• Study sessions: until you, or the owner of the group they belong to, delete them, or until your account is deleted. Group sessions you started in someone else's group stay with that group after you leave, attributed to "Former member" once your account is deleted.
• Usage counters and AI usage records: up to 13 months, for limits, billing and cost control.
• Feedback: until it is resolved, and no longer than 24 months.
• Hosting logs and backups: for the limited periods set by our hosting provider.

Your rights

Under the GDPR you can access, correct, delete, restrict or object to the processing of your personal data, and receive it in a portable format. Most of this is self-service:

• Download your data as a JSON file in Settings.
• Correct your display name and preferences in Settings.
• Delete your account and its data in Settings.

For anything else, contact us via danielsmirno06@gmail.com. You also have the right to complain to the data protection authority in the EU country where you live or work.

Children and students

You must be at least 13 years old to use StudySquad. If you are under the age of digital consent in your country (between 13 and 16 in the EU), you need permission from a parent or guardian. Parents or guardians who believe a child is using StudySquad without permission can contact us and we will delete the account.

Cookies and local storage

• ss_session: an essential, HttpOnly cookie that keeps you signed in for up to 30 days. Signing out removes it.
• During sign-in, your browser briefly stores a one-time security code in session storage. Your theme choice may be stored in local storage on your device.
• We use no analytics, advertising or tracking cookies. When you sign in, Google may set its own cookies on Google's pages under Google's privacy policy.

Because we only use strictly necessary storage, we don't show a cookie consent banner.

Security

All traffic is encrypted with HTTPS. Session tokens are stored only as hashes, access to group content is checked on every request, and access to production systems is limited to the operator.

Changes

If we change this policy in a meaningful way, we'll update the date above and let you know in the app.

Contact

Questions or requests about privacy: danielsmirno06@gmail.com.