Privacy Policy

Last updated 18 October 2026 · For StudySpace at studyspaceonline.com

1. Who we are

StudySpace is the study tool at www.studyspaceonline.com. For UK GDPR, the data controller is the operator of that site.

There is no published company number or registered office for this service. Contact: team@studyspaceonline.com. To delete your data, use the button on Profile.

This policy explains what we collect, why, who processes it, and your rights. It is written for how the site actually works today — not as a generic template.

2. Who this is for

StudySpace is aimed at students (including school, GCSE and A-level). You can create an account with an email and password, or use the site as a guest without signing in.

If you are under 13, a parent or guardian should create and look after the account. If you are 13–17, please use the site with a parent or school’s knowledge. We do not offer public profiles, comments, or a friends feed. Your notes are not published to other students.

3. The information we handle

Account

When you sign up we collect your email, password, and optional display name. You can sign in as soon as the account is created. If you forget the password, we send a reset email through our auth provider (Supabase Auth) and mail service (Resend). Passwords are stored as a hash — we do not keep your password in plain text. You may add a profile photo. We also keep a study streak and last-active date on your profile.

Study workspace

Depending on what you use, this can include:

• subjects, topics, colours and icons
• notes (titles and content, including images, tables and handwriting scans you paste in)
• flashcard sets and cards
• tests and questions you create
• planner items, school timetable, homework, deadlines and to-dos
• an optional two-way link with the phone calendar in the iPhone or Android app
• logged study minutes
• a home sticky note

Guest use (no account)

If you continue without signing in, the same kind of workspace is saved in this browser on this device only (local storage). Reloading this browser keeps it. Another device, another browser, or clearing site data does not. Signing in does not automatically copy guest work into an account.

Things that stay in this browser even if you are signed in

Some features are stored locally rather than in the cloud account, including robot chats, essay drafts and marks, oral attempt history, typed-quiz attempt history, theme, the first-visit guide, which study badges you have already been shown, and a light “usual format” profile used to match how you like notes and cards written.

AI chats and generations

When you message the robot, generate notes or flashcards, scan a page, expand a note, mark an essay, or run an oral, we send the prompt plus enough of your study material to do the job. For the main helper, that can include an index of your notes and flashcard sets so it can answer questions such as where a word appears. Images you attach or that already sit in a note may be sent when you ask the AI to read them.

Orals and the microphone

Oral practice can use your microphone and your browser’s speech tools. Speech playback uses the device/browser voice. Speech recognition is provided by the browser. In some browsers (including Chrome) that audio may be processed by the browser vendor, not by StudySpace’s servers. We only keep the transcript and scores the app stores as part of the attempt.

Technical and usage data

The host (Vercel) and our database (Supabase) receive standard server logs such as IP address, browser type and timestamps when you load pages or save work. We use Vercel Web Analytics, which is designed to measure page views without advertising cookies. Google Fonts and Font Awesome are loaded from third-party CDNs, which will see your IP address when a page loads.

4. Why we use it (lawful bases)

Under UK GDPR we rely on:

• Contract — to create your account, save your workspace, and provide the tools you ask for (including AI when you use it).
• Legitimate interests — to keep the site secure, understand which pages are used, remember your theme and guide, and improve the product without using your notes for advertising.
• Consent — where the browser asks you to allow the microphone, or where you choose to paste an API key on your own device (self-hosted setups only).
• Legal obligation — if we must keep or disclose information because the law requires it.

5. Where it is stored

• Signed-in workspace: Supabase (authentication and Postgres, with row-level security so one account cannot read another).
• Guest workspace and the local items listed above: this browser’s local storage.
• The website and AI proxy: Vercel. AI requests are forwarded from our server to OpenAI and/or xAI. We do not put the AI secret in the public site files.

Those providers may process data in the UK, the EEA, the United States, or other countries. Where data leaves the UK, we rely on the provider’s safeguards (such as their terms and standard contractual clauses). OpenAI and xAI process prompts under their own privacy terms. We do not use your study content to train our own models — we do not run our own training.

6. Who we share it with

We share data with processors who run the service, not with advertisers:

• Supabase — accounts and signed-in study data
• Vercel — hosting, the AI proxy, and cookieless web analytics
• OpenAI and/or xAI — when you use AI features
• Google Fonts and cdnjs (Cloudflare) — fonts, icons, and equation formatting on the page
• Your browser vendor — if you use built-in speech recognition

We do not sell personal data. We do not use it to profile you for ads. We would only disclose data if required by law, or to the new operator if the service is transferred, with this policy still applying or with notice.

7. How long we keep it

Signed-in data stays until you delete items in the app or delete the account from Profile. Guest data stays until you clear it from Profile or the browser removes it. Local chats and attempt histories are capped in the app so they do not grow forever. Server logs are kept only as long as the host keeps them for security and operations.

8. Your rights

If UK GDPR applies to you, you can ask to:

• access a copy of the personal data we hold
• correct it
• erase it
• restrict or object to certain processing
• receive workspace data you provided in a portable form where that right applies
• complain to the Information Commissioner’s Office

You can already edit or delete notes, cards, subjects, tests and planner items in the app. Signed-in accounts are deleted from Profile → Delete account. That removes the account and the cloud workspace. Guests can use Profile → Clear data on this device, or the browser’s “clear site data” for studyspaceonline.com.

9. Security

Signed-in rows are isolated with row-level security. The site is served over HTTPS. The AI key stays on the server. No method is perfect: do not put secrets, card numbers, or other people’s private information into notes or chats. School logins and personal passwords should not be stored in StudySpace.

10. Children

We design the product as a private study tool: no public social feed, no advertising, high privacy by default. We still need an email to create an account. Please do not include extra personal details about a child (home address, photos of other pupils, medical information) unless you need them for study. If you can sign in, delete the account from Profile.

11. Cookies and similar storage

We use browser storage more than cookies. Details are in the Cookies policy.

12. Changes

If we change how the product handles data in a material way, we will update this page and the “last updated” date. Keep using the site after a change means you should read the new version. The current policy is always at this URL.

13. Contact

Email team@studyspaceonline.com. To delete an account or guest data, use Profile.