StudySurf — Privacy Policy

Last updated: 25 August 2026

This Privacy Policy describes how StudySurf collects, uses and protects your personal data.

Data controller

StudySurf is provided by Mirco Galeotti, Piazza Massimo d'Azeglio 30, 50121 Firenze (FI), Italy, who is the data controller for the personal data described in this policy.

For any privacy request you can write to studysurfsupport@gmail.com.

1. Data we collect

• Account data: email address, display name, and the study level you pick during setup (high school, university or self-study). We do not ask for your age or date of birth.
• Study content you create: tasks, exams, subjects, grades, class schedule, study sessions, timer presets and points. This includes the places you type in yourself — the classroom or address of a lesson, the location of an event, and any extra school or course you add. This content syncs to our database so it is available on all your devices.
• Activity log: when you complete, uncomplete or delete a task we record the action, the task title and the time, so your statistics and streaks stay correct across devices.
• Names of other people, if you choose to type them into your own content (for example a teacher's name on a class). This is yours alone: it is visible only to your account, it is never shown to other users or used by us for any purpose, and it is deleted with your account. The teacher names saved in your class schedule are replaced by neutral labels ("Teacher A", "Teacher B") before your schedule is sent to an AI feature; a name you type yourself into a message, or that appears in the text extracted from a photo, is sent as you wrote it.
• AI requests: the text you submit to the AI features (AI chat, AI quiz, schedule import) is sent to our servers to generate the response, together with an anonymous token count used to enforce usage limits. Photos you select are processed entirely on your device — only the text extracted from them is sent, never the photo itself.
• Subscription status: whether your account has an active premium subscription, and the anonymous Apple transaction identifier used to verify it. Payments are handled entirely by Apple; we never see your payment details.
• School-year Memories: when you finalise a school year, what you wrote in the keepsake syncs to our database so it survives a change of device — your mood rating, what you wrote about the year, your first-day letter and your end-of-year reply, your favourite subject, song and sport, the name you enter as best teacher, and the year's figures (study minutes, tasks completed, top subjects, best grades and average).
• Apple Calendar: if you grant calendar access, the app reads your events only to show them on your device next to your classes and tasks. Those events are never uploaded to our servers and we never see them. The app also keeps a calendar of its own, named "StudySurf", where it mirrors your tasks and classes so they appear in Apple Calendar; it never changes the events in your other calendars. You can turn the mirroring off, or refuse calendar access entirely, and the app still works.
• Memory photos: any photos you add to a school-year Memory (report card, class or cover photo and first/last-day photos) are stored ONLY on your device — they are the one part of a Memory that never leaves it. They are never uploaded to our servers, never synced to other devices and no one but you can see them. If you delete the app or the Memory, these photos are gone.

We never read your device's location: the app does not ask for location access and does not use GPS. The only places we hold are the ones you type in yourself. We do not collect your contacts, advertising identifiers or browsing history, and we show no third-party advertising.

2. Purpose of data processing

The collected data is used exclusively to:

• ensure the proper functioning of the app;
• manage authentication and your account;
• sync your study content across your devices;
• generate the AI responses you request and enforce fair usage limits;
• unlock premium features you have purchased.

Data is not used for advertising, is not used to track you across other apps and is never sold to third parties.

3. Legal basis for processing

If you are in the European Economic Area or the United Kingdom, we process your data on these legal bases:

• Performance of a contract (GDPR art. 6(1)(b)): creating and managing your account, storing and syncing your study content, providing the AI features you request, and unlocking the premium features you have purchased. Without this data the app cannot work.
• Legitimate interests (GDPR art. 6(1)(f)): keeping the service secure, preventing abuse of the AI features and enforcing usage limits, and fixing technical problems. We limit ourselves to what is needed for those purposes.

We do not rely on consent for any of the processing above, and we do not process any special categories of data. Where iOS asks you for a permission (notifications, calendar, camera), that permission is yours to grant or refuse at any time in the system Settings, and the app works without it.

4. Third-party services

To operate the app we rely on these service providers, which process data on our behalf:

• Supabase — authentication, database and AI request handling. All your account and study data is stored here, protected by row-level security so each user can only access their own data.
• OpenAI — when you use an AI feature, the text of your request is forwarded to OpenAI to generate the response. Your name, email and account identifier are never sent. OpenAI does not use data submitted through its API to train its models, and retains it only briefly for abuse monitoring before deleting it.
• Apple — subscription purchases and receipts (StoreKit).
• Google — only if you choose to sign in with Google, which shares your Google account name and email with the app.

International transfers: some of these providers process data outside the European Economic Area, including in the United States. Those transfers rely on the safeguards required by the GDPR — the European Commission's standard contractual clauses and, where applicable, the EU–US Data Privacy Framework — under the data processing terms we have accepted with each provider.

5. Data retention and security

• Account data, study content, activity log and school-year Memories: kept for as long as your account exists. When you delete your account (Profile → Log Out → Delete Account), they are permanently removed from our database, immediately and without a recovery period.
• AI requests: we do not store the text of your requests. It is sent to OpenAI to produce the answer and is retained by OpenAI for up to 30 days for abuse monitoring, then deleted. We keep only the number of tokens each request consumed, so we can enforce the annual limit of your plan.
• Subscription status: kept while your account exists, so premium stays active on your devices.
• Memory photos and other content marked as on-device: never sent to us, and removed when you delete them or uninstall the app.

All communication with our servers uses encrypted HTTPS connections and database access is restricted per-user through row-level security.

6. Your rights

Under the GDPR and similar laws you have the right to:

• access your data and correct it (you can edit your profile and all your content directly in the app);
• delete your account and all your data at any time, directly from the app (Profile → Log Out → Delete Account);
• receive a copy of the data you provided in a portable, machine-readable format;
• ask us to restrict processing, or object to processing based on our legitimate interests;
• lodge a complaint with the data protection authority of your country (in Italy, the Garante per la protezione dei dati personali).

To exercise any of these rights, write to studysurfsupport@gmail.com. We answer within one month.

We do not make automated decisions producing legal or similarly significant effects about you. The AI features only suggest tasks, quizzes and schedules: nothing is decided about you, and every suggestion is yours to accept or discard.

7. Children

StudySurf is intended for high school students and above. It is not directed to children under 13, we do not knowingly collect personal data from them, and the app does not offer them a way to sign up.

If you believe a child has created an account, contact us at studysurfsupport@gmail.com and we will delete the account and its data.

If you are under the age of digital consent in your country, please use the app with the consent of a parent or guardian.

8. Contact

For any privacy request, contact the developer at studysurfsupport@gmail.com.

9. Changes to this policy

This policy may be updated over time. Any changes will be made available within the app.