Privacy

What this is

StudyBuddy is a study tool run by one person, not a company. It takes worksheets a student has already done, pulls the questions out of them, and schedules what to revise. This page says what it stores, where that goes, and how to get rid of it.

What it stores

• Your email address, and a name and username if you set them. If you sign in with a password, we store a bcrypt hash of it, never the password.
• Your date of birth. It is used once, to check you are 13 or older, and then kept so the check does not have to be repeated.
• The worksheets you upload: the page images, the text read off them, the questions, your answers, and the review schedule built from them.
• If you connect your own AI provider, the API key, encrypted with AES-256-GCM. It is decrypted only to make a request you asked for, and it is never shown back to you or sent to your browser.

Where your worksheets go

This depends on which tier you are on, and the difference is the whole point of the tiers:

• Free trial. Page images are read by a vision model on a machine the operator runs at home. They are held only while the job runs. They are not used to train anything.
• Your own API key.Page images and question text go to the provider you chose, under your own account and their terms. Nothing goes to the operator’s machine.
• Your own Ollama. The model runs in your browser against your own computer. Question text does not leave your machine for any model at all.

Page images are stored in Vercel Blob so the app can show you the page a question came from. The database is hosted by Neon. Both are in the United States.

Who else is involved

• Vercel, for hosting, and for page-view analytics that set no cookies.
• Neon, for the database.
• Google, if you choose to sign in with Google.
• An email provider, only to send a password reset link when you ask for one.
• Hugging Face, whose CDN serves the small sorting model your browser downloads once. It sees the request for the file, not your work.

Nothing is sold, and nothing is shared with anyone for advertising. There are no advertising or tracking cookies. The only cookie is the one that keeps you signed in.

Students under 13

Accounts require you to be 13 or older, and the check runs on the server rather than only in the date box. If you believe a younger child has an account, write to vdsupercool@gmail.com and it will be deleted.

Deleting your data

Settings has a delete-account control. It asks you to type your own email address, and then removes the account and everything attached to it: worksheets, page images, questions, attempts, review schedule and any stored API key. It is immediate and cannot be undone. Backups of the database may hold a copy for a short period after that.

Contact

Questions, corrections, or a request for a copy of your data: vdsupercool@gmail.com