Privacy Policy
Effective date: September 23, 2026
Who we are: Study Suite is run by Alkarim Billawala, an individual based in Alberta, Canada.
Contact: privacy@studysuite.app
This policy is written to meet Canada's privacy law (PIPEDA), the EU and UK GDPR, and applicable US state privacy laws. Wherever you live, we apply the same standard.
Using Study Suite without an account
We collect nothing. The app runs entirely in your browser. Your study packs, review progress, scores and settings are saved in your browser's own storage on your device, and never leave it. There are no analytics, no ads, no tracking cookies, and no server that receives your study data. The app only talks to our account server if you create an account or sign in.
What this means in practice:
- We can't see, access or recover your study data. Use Backup all to save your own copy.
- The site is hosted as static files on GitHub Pages (GitHub, Inc.). Like any web host, GitHub may log standard technical data (IP address, browser type) to serve and secure the site; see GitHub's privacy statement. We don't receive or use those logs.
- Donations are handled by Buy Me a Coffee on their own site under their own privacy policy. We receive no payment details.
Accounts and sync (optional)
An account lets you keep your study data in sync across your devices. It's optional, and free during the beta. If you create one, we store only what's needed to run it:
| What we store | Why | Lawful basis (GDPR) |
|---|---|---|
| Your email address | Signing in, and account emails: confirming your address, resetting your password, confirming an email change. Never marketing. | Contract |
| Whether your email address is confirmed | Account security | Contract |
| A sign-in credential that your device derives from your password, stored only as a one-way hash. Your password itself never leaves your device. | Signing in | Contract |
| Your encryption key, stored twice: once locked by your password, once locked by your recovery code. We can't unlock either copy. | Letting you unlock your synced data on a new device | Contract |
| Your study data, end-to-end encrypted, plus its size and when it last synced | The sync service | Contract |
| For each device that syncs: a random ID made on that device (it isn't linked to the device or to you), the app version it uses, and when it last synced. Any device names you choose are saved inside your encrypted study data. | Showing you your devices, and fixing sync problems | Contract |
| The access-code groups on your account (for example, your class) — the one you signed up with and any you add later | Early-access eligibility and preventing abuse | Legitimate interest |
| Your account status (for example, "beta") | Running the service | Contract |
| Server request logs (time, request, browser type) | Security, preventing abuse, fixing problems | Legitimate interest |
End-to-end encryption. Your study data is encrypted on your device before it's uploaded. We store only the encrypted version and can't decrypt it — not for support, not for anything — because we never have your key. If you lose both your password and your recovery code, your synced copy can't be recovered by anyone, including us. The data on your own devices, and any Backup all files, are unaffected.
Where your data lives. Account and sync data are stored on a server we operate ourselves in Alberta, Canada. We may move it to a Canadian hosting provider in future; if we do, we'll update this policy first. Canada holds adequacy decisions from both the EU and the UK, which allows EU and UK personal data to be transferred here.
Account emails are sent through Apple's iCloud Mail from support@studysuite.app.
How long we keep things.
- Account data: for as long as your account exists.
- Server request logs: up to 7 days.
- When you delete your account, it and your synced data are removed from our live server immediately. Server snapshots (kept 7 days) and backups (kept 6 months) may still contain them until those expire. Backups are used only to recover from a failure; if we ever restore one, accounts deleted since that backup are removed again before the server goes back online. To do that, we keep a record of each deletion — the date and an internal account number, with no email address — for 6 months.
Your rights.
- Access and portability. Backup all exports your complete study data at any time, in a machine-readable format, with no request needed. Because we can't read your synced data, a data request to us can only return your account details (email, status, dates) — which you can ask for at privacy@studysuite.app.
- Correction. Change your email address from the account menu at the top right of the app.
- Erasure. Delete account in the account menu permanently erases your account and your synced data from our live server, immediately. It's self-serve: type DELETE and your password. No email needed.
- Anything else — a request, question or complaint: privacy@studysuite.app. You can also complain to your local authority: the Office of the Privacy Commissioner of Canada, your EU supervisory authority, or the ICO in the UK.
Service providers. We use only these:
- GitHub, Inc. — hosts the app (GitHub Pages).
- Apple Inc. — iCloud Mail delivers account emails, so it handles your email address and the content of those emails.
- Buy Me a Coffee — only if you choose to donate.
If Study Suite ever adds paid features, we'll add the payment provider here before any payment is taken.
Age. Study Suite is meant for adults. You must be at least 18 (or the age of majority where you live) to create an account.
Browser storage, not tracking. The app sets no tracking cookies. It keeps your study data, your sign-in session and your encryption key in your browser's own storage on your device. These are strictly necessary for the app to work, so no consent banner is needed.
If something goes wrong. If a breach creates a real risk of significant harm, we'll notify affected users and the relevant authorities (the OPC in Canada; EU and UK authorities within 72 hours) and keep records as the law requires. In any breach, your study data stays encrypted.
Changes. We'll announce material changes in the app, with the effective date above updated. Continuing to use an account after that date means you accept the change.