Privacy Policy

StudyFlow is an independent student productivity tool. References to “we”, “our”, or “us” in this document refer to the StudyFlow team.

Account information. When you sign up we collect your email address and the display name you choose. Authentication is handled by Clerk, our identity provider, which securely stores your credentials. We never see or store your password ourselves.

Signing in with Google. If you choose to sign in with Google, Google shares your name, email address, and profile photo with Clerk to create and verify your account. We do not receive or store your Google password, and we do not access any other Google account data.

Content you create. Tasks, courses, notes (including rich text formatting), flashcard decks, quizzes and quiz results, and focus timer sessions you create in StudyFlow are stored in our database, associated with your account.

Files you upload. When you use the syllabus import feature or attach a file in the Assistant, uploaded files are sent to the OCR Space API for text extraction and are not stored on our servers after processing.

Assistant conversations. Messages you send to the StudyFlow Assistant, along with relevant context from your tasks, notes, and courses needed to answer you, are sent to Mistral AI to generate a response. We do not use your conversations to train AI models.

Your own API keys. If you add a personal Mistral or OCR Space API key under Settings > Integrations, that key is stored encrypted in your account and used only to make requests on your behalf, in place of our shared service key.

Usage analytics. We use PostHog to collect page views and product usage events — for example, when a task is created, a quiz is completed, or a setting is changed — to understand how StudyFlow is used and where to improve it. These events are tied to your account so we can debug issues and measure feature adoption, but are never sold or shared with advertisers.

Error and session data. We use Sentry to capture application errors. Error reports may include your browser type, operating system, the page you were on, and a session replay — a reconstruction of on-screen activity leading up to the error, used solely to diagnose bugs. A small sample of error-free sessions may also be recorded for the same purpose.

The StudyFlow Assistant can read your tasks, courses, notes, flashcards, and quizzes to answer questions, and can take actions on your behalf — creating, updating, or deleting items in your account when you ask it to.

Before the Assistant deletes anything, or performs an action you haven't previously approved, it shows you exactly what it intends to do and asks for your confirmation. You can also choose “Always allow” for specific, non-destructive actions so the Assistant doesn't ask again. You can revoke these standing approvals at any time by clearing your browser data for StudyFlow.

We use your data only to:

• Provide and maintain the StudyFlow service, including the Assistant
• Send transactional emails (e.g. password resets) when you request them
• Send notification emails if you have opted in under Settings
• Debug errors and improve product reliability
• Understand aggregate usage patterns to guide product decisions

We do not sell your data. We do not use it for advertising.

We share data with the following services to operate StudyFlow:

• Clerk (authentication — manages your account, credentials, and login sessions)
• Google (optional sign-in — only if you choose to sign in with your Google account, per section 2 above)
• Supabase (database — stores your tasks, notes, courses, and other content; EU or US region depending on your plan)
• Mistral AI (the Assistant feature — your messages and study context are sent to Mistral to generate responses and take requested actions)
• OCR Space (file text extraction — file contents are processed and immediately discarded)
• Resend (transactional and notification email delivery)
• PostHog (product usage analytics)
• Sentry (error monitoring and session replay for debugging)

Each of these providers has their own privacy policy and data processing terms. We choose partners who take data privacy seriously.

We keep your data for as long as your account is active. If you delete your account from the Settings page, your tasks, courses, notes, flashcards, and quizzes are deleted immediately, and your account and credentials are permanently deleted from Clerk — this is a real, irreversible deletion, not a deactivation. Session replays in Sentry are retained for a limited period before automatic deletion, consistent with Sentry's standard retention policy.

You can access, correct, or delete your personal data at any time from the Settings page. If you would like a full export of your data or have a request we cannot fulfill through the app, contact us at the email below.

If you are located in the EEA or UK, you may also have rights under GDPR, including the right to object to processing and the right to lodge a complaint with your local supervisory authority.

StudyFlow uses a session cookie set by Clerk, our authentication provider, to keep you signed in securely. We do not use third-party advertising or tracking cookies. Analytics events from PostHog are tied to your StudyFlow account rather than persistent cross-site identifiers.

StudyFlow is intended for users aged 13 and older. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

If we make material changes to this policy we will update the date at the top of this page and, where appropriate, notify you by email. Continued use of StudyFlow after changes are published constitutes acceptance of the updated policy.

Questions or requests about this policy can be sent to privacy@studyflow.app.