Privacy Policy | Smart Study Lab

This Privacy Policy explains how Smart Study Lab ("Smart Study Lab," "we," "us," or "our") collects, uses, discloses, and protects information when you use our website and related services (collectively, the "Service"). Smart Study Lab is operated by Manishkumar Thakar. By creating an account or otherwise using the Service, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the Service.

1. Information We Collect

1.1 Information you provide directly

Account information: your email address and password (if you sign up with email). If you sign up with Google, Google provides your name, email address, and profile picture; we store only your name and email address and do not keep your profile picture.
Age group: when you sign up we ask for your date of birth to check eligibility. We do not store your birthdate; we keep only your age group (13–17 or 18 and over) and the date and time you confirmed it. We ask once per account, not at every login.
Content you upload or create: documents, notes, text, flashcards, study guides, quiz responses, and other materials you submit to generate AI-assisted study content ("User Content").
AI assistant conversations: messages you send to and receive from our AI study assistant. We do not save your chat history; it exists only in your browser while the page is open. If you use the "Report this response" button, we receive and keep the AI response, the message that prompted it, and any note you add, so we can review your report.
Communications: messages you send us for support, feedback, or other inquiries.

1.2 Information collected automatically

Usage data: pages visited, features used, study activity, session duration, and interaction patterns within the Service, including counters of how many AI requests and PDF uploads your account has made each day (these counters do not include file names or contents).
Device and log data: IP address, browser type, operating system, device identifiers, and access timestamps.
Cookies and similar technologies: used to maintain your session, remember preferences, and understand aggregate usage (see Section 7).

1.3 Information from third parties

If you choose to sign in using a third-party authentication provider (e.g., Google via Supabase Authentication), the provider sends us your name, email address, and profile picture. We store only your name and email address, and we remove everything else, including the profile picture, from your account profile. Our authentication provider, Supabase, may keep the provider's sign-in record as part of operating sign-in.

2. How We Use Information

We use the information we collect to:

Provide, operate, and maintain the Service, including creating and securing your account;
Generate AI-assisted study materials (flashcards, quizzes, summaries) from the content you upload;
Personalize your experience, including spaced-repetition scheduling and progress analytics;
Communicate with you about your account, updates, security alerts, and support requests;
Monitor, analyze, and improve the performance, security, and functionality of the Service;
Detect, investigate, and prevent fraudulent, unauthorized, or illegal activity;
Enforce our age requirement and usage limits, and review reports you send us about AI responses;
Comply with legal obligations and enforce our Terms of Service.

We do not sell your personal information.

3. AI Processing of Your Content

To generate flashcards, quizzes, study guides, and chat responses, your User Content and AI assistant conversations are transmitted to OpenAI's API for processing, along with only the study text, titles, and messages needed for your request. We do not send your name, email address, or other account details to OpenAI. Before processing, we may also send your messages and study text to OpenAI's moderation service to screen for harmful content, and we screen the AI assistant's replies the same way before showing them to you. Under OpenAI's standard API terms, OpenAI does not use data submitted through the API to train its models unless a customer explicitly opts in to that, and we do not. OpenAI typically retains API inputs and outputs for a limited period (OpenAI has described this as up to 30 days) to monitor for abuse, before deleting them, except where longer retention is required by law. We encourage you to review OpenAI's API data usage policies directly for the most current information, and to not upload or type content containing sensitive personal information you would not want processed this way (e.g., government identification numbers, health records, or financial account details).

PDF uploads are handled in two steps. First, we read the PDF in memory on our own servers and extract its text there; the file is not sent to OpenAI or any other AI provider for that step. We do not save the PDF file to storage or disk — it is discarded as soon as extraction finishes, along with any images inside it. Second, only the extracted text is kept as a resource in your account, protected so that only you can access it, and it is deleted when you delete it or your account. That extracted text is sent to OpenAI when you choose to generate flashcards, quizzes, or study guides from it. You can upload up to 3 PDFs per day. Please only upload material you have the right to use, and remove personal information first.

4. How We Share Information

We may share information with:

Service providers who perform functions on our behalf, including hosting (e.g., Vercel), authentication and database services (e.g., Supabase), and AI processing (e.g., OpenAI's API), each bound by contractual obligations to protect your information;
Legal and safety purposes, where we believe disclosure is necessary to comply with a legal obligation, protect the rights, property, or safety of Smart Study Lab, our users, or the public, or investigate potential violations of our Terms of Service;
Business transfers, where information may be transferred in connection with a merger, acquisition, financing, or sale of assets, subject to standard confidentiality obligations.

We do not sell or rent your personal information to third parties for their own marketing purposes.

5. Data Retention

We retain your account information and User Content for as long as your account is active or as needed to provide the Service. If you delete your account, we will delete or anonymize your personal information within 30 days, with any remaining backup copies purged within 90 days, except where retention is required to comply with legal obligations, resolve disputes, prevent fraud or abuse, or enforce our agreements. Reports you submit about AI responses are deleted with your account. Content sent to a third-party AI provider is also subject to that provider's own retention practices, as described in Section 3.

6. Your Rights and Choices

Depending on your location, you may have the right to:

Access, correct, or delete the personal information we hold about you;
Export a copy of your User Content;
Withdraw consent for optional processing (e.g., marketing communications);
Object to or restrict certain processing of your information.

You can access and update most of your account information directly within your account settings. To make a data access, correction, deletion, or export request, contact us using the details in Section 11. We will respond within a reasonable timeframe and in accordance with applicable law.

7. Cookies and Tracking Technologies

We use cookies and similar technologies that are strictly necessary to operate the Service (such as maintaining your login session) and analytics tools, including Vercel Analytics, that help us understand aggregate usage patterns. We also set cookies for our age check: a short-lived one (about one hour) that records that you passed the check so you can finish signing up, and, if the check shows a person is under 13, one that lasts up to 7 days to stop the check from being repeated with a different date. These cookies are not used for tracking or advertising. You can control cookies through your browser settings; disabling strictly necessary cookies may prevent parts of the Service, including sign-in, from functioning correctly. We currently do not respond differently to browser "Do Not Track" signals; our analytics are limited to the aggregate usage patterns described above regardless of that setting.

8. Age Requirement

The Service is intended for users aged 13 and older. We ask for your date of birth at sign-up; users under 13 are blocked and cannot create an account, and users under 18 must confirm that a parent or legal guardian has given them permission to use the Service and agrees to our Terms of Service and this Privacy Policy on their behalf. We do not store your birthdate, only your age group and when you confirmed it. Accounts created before this check existed are asked once, the next time they sign in. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will delete that child's account and associated information promptly. If you believe a child under 13 has provided us with personal information, please contact us using the details in Section 11 so we can remove it.

9. Data Security

We implement reasonable administrative, technical, and physical safeguards designed to protect your information, including encrypted data transmission (HTTPS/TLS) and access controls on our infrastructure providers. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for keeping your password secure. If a data breach affects your personal information, we will notify you and the relevant authorities as required by law.

10. International Users

The Service is operated from, and intended for use by individuals located in, the United States. If you access the Service from outside the United States, you do so on your own initiative and are responsible for compliance with local laws; your information will be transferred to, stored, and processed in the United States or other countries where our service providers operate, which may have data protection laws different from those of your jurisdiction.

11. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact us at aaryanthakar1@gmail.com.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by updating the "Effective date" above and, where appropriate, through additional notice (such as an in-app notification or email). Your continued use of the Service after changes take effect constitutes acceptance of the revised policy.