Privacy Policy
Last updated: July 5, 2026
At Studoze, we take the protection of your personal data seriously. This policy describes how we collect, use, store and protect your information when you use our educational platform and related services.
1. Information we collect
We collect different types of information to provide and improve our services: • Registration data: email address, display name and password (or Google identifier if using Google sign-in). • Study content: subjects, topics, flashcards, exams, summaries, image occlusions, study calendar, study sessions and exam results you create or generate. • Uploaded files: documents and images you upload to the platform (maximum 50 MB per file), including original name, MIME type and size. • Usage data: progress statistics, app preferences (theme, language), feature limits used and AI credit balance. • Technical data: IP address, browser user agent, request timestamps, status codes and response times, logged through our audit system. • Device data: device tokens and device name for push notifications. • Payment data: your Stripe customer ID and subscription data. We do not directly store credit card numbers; these are handled securely by Stripe.
2. How we use your information
We use your information for the following purposes: • Providing services: managing your account, delivering study content, processing payments and managing your subscription. • AI features: processing your content through external artificial intelligence services to generate summaries, flashcards, exams, study plans, image analysis and smart chat. • Communications: sending account notifications via email, push notifications (Firebase) and real-time web notifications. • Security: protecting your account, detecting fraud, preventing abuse and maintaining audit logs of activities. • Service improvement: analyzing usage patterns to enhance platform functionality. • Support: managing your support tickets and providing technical assistance.
3. AI processing
When you use AI features, your content is sent to an external AI provider to generate summaries, flashcards, exams, study plans and other functionalities. It is important to know that: • Your content is NOT used to train AI models. • Processing is performed on demand and strictly limited to the requested functionality. • AI features consume credits according to the following approximate table: generate summary (~80 credits), generate flashcards (~80 credits), generate exam (~100 credits), generate study plan (~100 credits), image analysis (~50 credits), AI chat (~30 credits). Actual cost depends on real token usage. • Daily AI credits vary by plan: Free (500/day), Basic (5,000/day), Premium (20,000/day).
4. Storage and security
We implement industry-standard security measures to protect your data: • Passwords are encrypted with bcrypt (salt factor 10) and never stored in plain text. • Authentication is handled via JWT tokens with 15-minute expiration and refresh tokens. • We apply role-based access control (RBAC) to ensure you only access your own data. • Your files are stored in Cloudflare R2 with pre-signed URLs that expire in 1 hour. • The PostgreSQL database is protected with encryption in transit. • We apply rate limiting on all endpoints: 3 requests/second (short), 20 requests/10 seconds (medium) and 60 requests/minute (long). • We use Cloudflare Turnstile as bot protection during registration.
5. Third-party services
To provide our services, we share data with the following trusted providers: • Stripe: payment processing and subscription management. Stripe receives the information necessary to process your payments securely. See Stripe's privacy policy at stripe.com/privacy. • External AI provider: content processing for AI features. Only the content necessary to generate the requested results is sent. Your content is not used to train AI models. • Firebase (Google): sending push notifications to your devices. Device tokens and notification content are shared. • SMTP provider: sending transactional emails (registration confirmation, support tickets, notifications). • Cloudflare R2: secure storage of uploaded files. • Cloudflare Turnstile: anti-bot verification during registration. We do not sell or share your personal data with third parties for advertising or marketing purposes.
6. Data retention
We retain your personal data as long as you maintain an active account on Studoze. Audit logs are retained to ensure service security and integrity. If you delete your account, all associated data will be cascadingly deleted, including: • Study content (subjects, topics, flashcards, exams, summaries, etc.) • Subscriptions and credit balances • Device tokens and notifications • Sent and received invitations • Redeemed coupons • Uploaded files Audit logs and support tickets are anonymized (the reference to your user is removed) but not completely erased for security and system integrity purposes.
7. Your rights
As a Studoze user, you have the following rights: • Access: you can view your personal data at any time from your account settings. • Rectification: you can modify your name, email and password. • Deletion: you can permanently delete your account, which erases all associated data. For password-based accounts, identity verification is required. • Portability: you can request a complete copy of your data. • Notifications: you can manage your notification preferences and disable push notifications. If you are in the European Economic Area (EEA), you can also exercise your rights under the GDPR, including the right to restrict and object to processing.
8. Cookies and local storage
Studoze does not use tracking cookies or third-party cookies for advertising purposes. We use browser local storage (localStorage) exclusively for: • Access token and refresh token (authentication). • Theme preference (light/dark). • Language preference. This data is stored solely on your device and is not transmitted to analytics or advertising services.
9. Minors
Studoze is intended for users aged 16 and older. We do not knowingly collect personal information from children under 16. If we discover that we have collected data from a minor without proper parental consent, we will take steps to delete that information as soon as possible. If you are a parent or guardian and believe your child has provided us with personal data, contact us at [email protected].
10. International data transfers
Studoze operates with infrastructure services that may process data in different geographic locations. By using our services, you agree that your data may be transferred and processed on servers located outside your country of residence. We ensure that all transfers are made with providers that comply with applicable data protection regulations.
11. Changes to this policy
We may update this privacy policy periodically. Significant changes will be notified through the platform or by email. We recommend reviewing this policy regularly. Continued use of Studoze after changes are published constitutes your acceptance of the updated policy.
12. Contact
If you have questions, concerns or requests related to this privacy policy or the processing of your personal data, you can contact us at: • Email: [email protected] • Support: through the integrated support ticket system on the platform.