Privacy policy

1. Who we are

StudyMaze is the data controller for the personal data described in this policy. You can reach us at our support email for any privacy question or request.

2. What we collect

We collect the following kinds of data:

• Account data — the email address and password you sign up with (your password is stored as a salted hash, never in plain text), and whether your account is active or an admin account.
• Content you log — learning paths, subjects and categories, study sessions, resource tags, assessments, and mistake entries (including any freehand notes you write). This is entirely data you type in yourself; StudyMaze doesn't observe or infer anything about you beyond it.
• Referral invites — if you use the "Invite friends" feature, we store the email address you invite so we can send the invite and detect when they sign up. If you're the person being invited, we hold your email for this limited purpose even if you never create an account; contact us using the details below if you'd like it removed.
• Operational logs — our servers briefly log account and login events (including email address and account ID) for security and debugging. These logs rotate automatically and are not used for analytics or marketing.

We do not collect advertising identifiers, device fingerprints, or third-party tracking cookies. The only cookie we set is the session cookie that keeps you logged in, which is essential to the service and stops working the moment you log out. A dark-mode preference is stored in your browser's local storage and never leaves your device. See our Cookie policy for the full list of cookies and similar technology, including the fonts we load from Google.

3. Why we process it, and our legal basis

• To provide the service (Article 6(1)(b) — performance of a contract): creating your account, logging your sessions and mistakes, and computing the analytics we show you.
• To keep the service secure (Article 6(1)(f) — legitimate interest): preventing unauthorized access to accounts, and keeping short-lived operational logs.
• To send referral invites you ask us to send (Article 6(1)(f) — legitimate interest, in fulfilling a request you made) or, for the invited person, in taking steps at your request before they become a data subject with their own account.
• To comply with the law (Article 6(1)(c)), where applicable.

We do not process your data for advertising or profiling, and never rely on your consent as a basis to sell or share it with third parties for their own marketing purposes — we simply don't do that.

4. Who we share it with

We do not sell, rent, or trade your personal data. We share it only with the infrastructure and email-delivery providers that host our application, database, and outgoing mail, strictly so they can provide that service on our behalf, and only where legally required — for example, in response to a valid legal request. The one third party that receives data automatically on every page load is Google Fonts: your browser fetches font files directly from Google's servers, which necessarily exposes your IP address to Google. See our Cookie policy for details. We do not use third-party analytics or advertising services.

5. How long we keep it

We retain your account and logged content for as long as your account is active. If you delete a learning path, study session, or assessment, that record is removed from the service. If you delete your account, or ask us to via our support email, we delete your account data and logged content, other than where we're required to retain limited records for legal or security purposes. Operational logs rotate automatically and are not kept indefinitely.

6. Your rights

Under the GDPR, and depending on where you live, you have the right to:

• Access the personal data we hold about you;
• Correct inaccurate data (most account and content edits you can also make directly in the app);
• Delete your data ("right to be forgotten");
• Restrict or object to certain processing;
• Receive a copy of your data in a portable format ("data portability");
• Lodge a complaint with your local data protection supervisory authority.

To exercise any of these rights, email our support email. We'll respond within the timeframe required by applicable law.

7. Security

Passwords are stored as salted hashes, not in plain text. Access to the application and database is restricted to what's needed to operate the service. No method of storage or transmission is completely secure, but we take reasonable technical and organizational measures to protect your data.

8. Children's privacy

StudyMaze is used by students preparing for exams such as the SAT, PSAT, and ACT, some of whom may be minors. If you're below the age of digital consent in your country, please only use StudyMaze with the involvement of a parent or guardian. We don't knowingly collect more data from a minor than is needed to provide the service described in this policy.

9. Changes to this policy

If we make material changes to this policy, we'll update the "last updated" date above. We encourage you to review this page periodically.

10. Contact us

For any question about this policy or your data, email our support email.