Privacy Policy
StudyRoom gives a student group project one shared room — chat, video, files, notes, tasks, and deadlines in a single place. This policy explains what we collect, why, who we share it with, and the choices and rights you have. We've tried to write it plainly; where we use a defined term it means what you'd expect.
The short version
- You sign in with your school email and a magic link — we don't ask for or store a password unless you choose to set one.
- What you put in a room (messages, files, notes, tasks) is visible to the members of that room, and to us only as needed to run the service.
- We use a small number of trusted providers (hosting, database/storage, video) to operate StudyRoom. We list them below.
- We do not sell your personal information, and we don't show third-party ads.
- You can access, export, correct, or delete your data — including deleting your account and your rooms.
01 Overview
This Privacy Policy describes how StudyRoom ("StudyRoom," "we," "us," or "our") collects, uses, discloses, and safeguards information when you use our website, web application, and related services (together, the "Service"). It applies to people who create an account, join a project room, are invited to one, or otherwise interact with the Service.
It does not cover third-party websites or services that link to or from StudyRoom, or information you share in places we don't control. By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please don't use the Service.
StudyRoom is a tool intended for use by college and university students for group coursework. If you are using StudyRoom on behalf of, or at the direction of, an institution, additional terms or agreements with that institution may also apply.
02 Information we collect
We collect information in three ways: information you give us, information created as you use the Service, and a limited amount from the providers that help us run it.
2.1 Information you provide
- Account information. Your school email address; a display name; and, optionally, a profile photo and a short role/title. If you choose to set a password (instead of using only magic-link sign-in), we store it in a securely hashed form via our authentication provider — we never see it in plain text.
- Room content. The things you and your group create inside a room: chat messages, uploaded files, notes, tasks and their due dates, calendar entries, and the project room's name and join code. Some items can be marked private to you; others are shared with the room.
- Invitations. When you invite a teammate, you provide their email address so we can send them an invite to the room.
- Communications. If you email us for support or feedback, we keep that correspondence.
2.2 Information collected automatically
- Usage and log data. Basic records of how the Service is used — for example, pages or screens loaded, actions taken, timestamps, and error/diagnostic logs — used to operate, secure, and improve the Service.
- Device and connection data. Information such as browser type, operating system, device type, language, and IP address (from which an approximate, city-level location may be inferred). We do not collect precise GPS location.
- Cookies and local storage. Small amounts of data stored in your browser to keep you signed in and remember preferences (for example, your light/dark theme). See Cookies & local storage.
2.3 Information from service providers
Our authentication, database/storage, and video providers process information on our behalf to deliver their part of the Service (for example, confirming a sign-in link was opened, or hosting an uploaded file). We receive operational and security information from them, but we don't buy personal information about you from data brokers, and we don't enrich your profile with data from third parties.
03 How we use information
We use the information described above to:
- Provide the Service — create and authenticate your account, run your rooms, deliver messages and files, sync tasks and the calendar, and power video meetings.
- Send necessary communications — magic-link sign-in emails, invitations you initiate, and important service or security notices. These are transactional; we are not sending marketing email by default.
- Maintain safety and security — detect, prevent, and respond to abuse, spam, fraud, and security incidents, and enforce our terms.
- Support you — respond to questions, troubleshoot, and fix problems.
- Improve the Service — understand which features are used and where things break, so we can make StudyRoom better. We rely on aggregated or de-identified information for this wherever practical.
- Comply with law — meet legal obligations and respond to lawful requests.
We do not use the content of your rooms to build advertising profiles, and we do not use it to train machine-learning models.
04 Legal bases for processing (EEA/UK)
If you are in the European Economic Area or the United Kingdom, we process your personal data under the following legal bases:
| Purpose | Legal basis |
|---|---|
| Creating your account and operating your rooms | Performance of a contract with you |
| Sending sign-in links and invitations you request | Performance of a contract / your consent |
| Securing the Service and preventing abuse | Legitimate interests in a safe, working product |
| Improving features using aggregated insights | Legitimate interests, balanced against your rights |
| Meeting legal obligations | Legal obligation |
Where we rely on consent, you can withdraw it at any time; where we rely on legitimate interests, you can object (see Your rights & choices).
06 Service providers (subprocessors)
The following providers help us run StudyRoom. Each is bound by contractual obligations to protect your information and to use it only to provide services to us.
| Provider | What it does for us | Data involved |
|---|---|---|
| Supabase | Authentication, database, and file storage | Account details, room content, uploaded files |
| Daily | Real-time video meetings (the Video Room) | Call connection data; audio/video streamed during a meeting |
| Vercel | Website & application hosting and delivery | Request logs, IP address, basic device data |
| Email delivery provider | Sending sign-in links and invitations | Recipient email address, message content |
We review providers before engaging them and keep this list current. If we add or change a provider in a way that materially affects your information, we'll update this page.
07 Cookies & local storage
StudyRoom uses a minimal set of browser storage, and we don't use third-party advertising or cross-site tracking cookies.
- Strictly necessary. Tokens that keep you securely signed in and protect your session. The Service won't work without these.
- Preferences. Small values that remember choices like your light/dark theme.
You can clear or block browser storage in your browser settings, but doing so may sign you out and reset your preferences. Because we don't run advertising trackers, there's no ad profile to opt out of.
08 Data retention
We keep information for as long as it's needed to provide the Service and for the legitimate, lawful purposes described in this policy.
- Account data is retained while your account is active.
- Room content is retained until you or another member deletes it, or until the room is deleted. Deleting a project removes its chat history, tasks, files, notes, and invites for everyone, and this can't be undone.
- Logs and security records are kept for a limited period appropriate to their purpose.
- Backups. Deleted content may persist for a short time in routine encrypted backups before being overwritten.
When information is no longer needed, we delete it or de-identify it. We may retain limited information where required to comply with legal obligations, resolve disputes, or enforce our agreements.
09 Security
We take reasonable technical and organizational measures designed to protect your information, including encryption in transit (HTTPS), access controls, hashed credentials, and reliance on reputable infrastructure providers. Private rooms are restricted to their members, and items you mark private are intended to be visible only to you.
No method of transmission or storage is completely secure, so we can't guarantee absolute security. Please help protect your account: use a device you trust, keep your school email secure, and don't share your room join codes with people who shouldn't have access. If you believe your account has been compromised, contact us right away.
10 Your rights & choices
Depending on where you live, you may have some or all of the following rights regarding your personal information:
- Access — request a copy of the personal information we hold about you.
- Correction — fix inaccurate or incomplete information. You can edit your display name, photo, and role in your profile at any time.
- Deletion — ask us to delete your personal information, or delete your account and your rooms yourself from within the app.
- Portability — receive certain information in a portable, machine-readable format.
- Objection & restriction — object to or ask us to restrict certain processing.
- Withdraw consent — where we rely on consent, withdraw it at any time without affecting prior processing.
- Non-discrimination — we won't deny you service or treat you differently for exercising your privacy rights.
To exercise a right, reach us through our contact form (use the email associated with your account), or use the in-app controls. We'll verify your request and respond within the timeframe required by applicable law. You may also have the right to lodge a complaint with your local data protection authority. If you'd like to authorize an agent to act on your behalf, we may ask for proof of authorization.
11 Students & children
StudyRoom is built for college and university students and is intended for users who are at least 16 years old. The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us personal information, contact us and we will delete it.
Where StudyRoom is used in connection with an educational institution, certain "education records" may be subject to laws such as the U.S. Family Educational Rights and Privacy Act (FERPA). In that context we act as a service provider to the institution and process such information consistent with the institution's instructions and applicable law. Questions about institutional use can be directed to your school or to us.
12 International data transfers
StudyRoom is operated with the help of providers that may store and process information in the United States and other countries. Laws in those countries may differ from those where you live. Where we transfer personal information internationally, we rely on appropriate safeguards (such as the European Commission's Standard Contractual Clauses, or an equivalent mechanism) to protect it. By using the Service, you understand your information may be processed in countries other than your own.
13 Third-party links & content
Files, links, or content shared inside a room may point to third-party websites or services that we don't control. This policy doesn't apply to those third parties. We encourage you to review the privacy policies of any third-party services you open from within StudyRoom.
14 Changes to this policy
We may update this policy from time to time as the Service evolves or the law changes. When we do, we'll revise the "Last updated" date at the top and, for material changes, provide a more prominent notice (such as an in-app message or email). Your continued use of the Service after an update means you accept the revised policy. We encourage you to review this page periodically.
15 Contact us
If you have questions about this policy or how we handle your information, or if you want to exercise a privacy right, reach out through our contact form.
We'll do our best to resolve your concern. If you're in the EEA or UK and we can't, you have the right to complain to your local supervisory authority.