Privacy Policy

• We use Google to sign you in. We collect your name, email, avatar, and the username and profile you set up.
• We store the decks, cards, hints, ratings, and tags you create, your study activity, and any images you upload.
• AI features (card generation, hints, tags, cover images) send your input text or PDFs to Google Cloud Vertex AI for processing. We don't use your inputs to train AI models.
• We show ads via Google AdSense. AdSense sets cookies for ad serving and personalization.
• We use Plausible Analytics for aggregate, cookieless statistics — no cross-site tracking, no personal identifiers.
• We do not sell your personal information.
• You can request access, correction, or deletion of your account by emailing privacy@studyspark.io.
• You can opt out of personalized advertising at Google's Ad Settings.

Account information. When you sign in with Google, Auth0 (our authentication provider) passes us your name, email address, avatar URL, and a unique Google account identifier. We store these in our database to identify you across sessions.

Profile content. During onboarding and in settings, you provide a username, an optional bio, and a public-profile toggle. Public profiles are visible to other users and search engines; private profiles are not.

Content you create. We store the decks, cards, hints, ratings, and tags you create, along with any images you upload for cards or deck covers. Card images and deck covers are stored in Google Cloud Storage; we generate short-lived signed URLs on demand to display them.

Study activity. We record your study sessions — when you start them, which deck, and how you rate each card — to power spaced repetition, mastery rings, and progress tracking.

Device and log information. When you sign in or use the app, we log your IP address, browser user agent, and the time of the event. Login events are throttled — we record at most one entry per hour, or whenever your IP or user agent changes. We use these logs for security and abuse investigation.

AI usage records. Each time you use an AI feature (card generation, deck cover, hint, tag suggestion), we record an event with your user ID, the kind of call, and the timestamp. We use these to enforce per-user usage quotas and detect abuse.

Analytics. We use Plausible Analytics to collect aggregate, cookieless statistics about page views, countries, browsers, and referrers. Plausible does not set cookies, does not track you across sites, and we never see your individual visits.

We use the information we collect to:

• Provide and maintain the service: authenticate you, save your decks, run study sessions, show your profile.
• Generate AI features: pasted text and uploaded PDFs are sent to Google Cloud Vertex AI to generate cards, hints, tags, and cover images. We do not use your inputs to train AI models.
• Show ads via Google AdSense, including personalized ads based on your browsing history per your Google Ad Settings.
• Analyze usage with Plausible for aggregate traffic statistics.
• Maintain security: login logs and AI usage events help us detect and respond to abuse and enforce usage quotas.
• Communicate with you about your account or material changes to the service or this policy.

We use the following service providers, and your information may be processed by each of them:

• Google Cloud Platform — hosting (Cloud Run), database (Cloud SQL for PostgreSQL), file storage (Cloud Storage), and AI processing (Vertex AI, which includes Anthropic Claude on Vertex).
• Google AdSense — ad serving and personalization.
• Auth0 (an Okta company) — sign-in. Auth0 receives the account profile data Google passes during sign-in.
• Plausible Analytics (plausible.io) — aggregate, cookieless analytics.

We do not sell your personal information.

We may disclose information when required by law, in response to legal process, or to protect the rights, property, or safety of Study Spark, our users, or others.

We use the following categories of cookies and similar technologies:

Essential. Auth0 sets a session cookie when you sign in. Without this cookie, you can't stay logged in.

Advertising. Google AdSense sets cookies for ad serving and personalization, including cookies named like __gads and __gpi. You can manage personalized advertising at Google's Ad Settings, or learn more at Google's advertising technologies page.

Analytics. Plausible does not use cookies.

Preferences. We store your selected theme (light, dark, or system) in your browser's localStorage. This is not a cookie and is never sent to our servers.

Depending on where you live, you may have specific rights under your local privacy law. To exercise any of these rights, email privacy@studyspark.io. We will respond within 30 days where the law permits.

European Economic Area, the United Kingdom, and Switzerland (GDPR)

You have the right to access, rectify, erase, restrict processing of, port, or object to the processing of your personal data, and to withdraw consent at any time where processing is based on consent.

India (DPDP Act, 2023)

You have the right to obtain information about, correct, or erase your personal data; to grievance redressal (the contact email above is the designated point of contact for our data fiduciary); and to nominate another person to exercise these rights in case of death or incapacity.

California (CCPA / CPRA)

You have the right to know what personal information we collect, how we use it, and whom we share it with; to delete your personal information; to correct inaccurate information; to opt out of any sale or sharing of your personal information (we do not sell, but we disclose this right for completeness); to limit our use of sensitive personal information; and to be free from discrimination for exercising these rights.

We retain your account and profile information for as long as your account is active.

We aim to retain login logs and AI usage events on a rolling 12-month window for security, abuse investigation, and cost auditing, and to delete records older than that window.

When you request deletion of your account, we delete your personal information within 30 days, except where we are required to retain it by law or for a legitimate ongoing purpose (for example, financial records or fraud investigation).

Study Spark is intended for users aged 13 and older. Users between the ages of 13 and 18 should use the service with the supervision and consent of a parent or guardian. For users in India, the DPDP Act requires verifiable parental consent for users under 18.

We do not knowingly collect personal information from children under 13. If we learn that we have, we will delete the account and the associated data.

Study Spark is operated from the United States. Our Cloud Run hosting and the Imagen image-generation model run in Google Cloud's us-central1 region; the Claude-on-Vertex endpoint we use for text generation uses Google's `global` multi-region endpoint.

If you use the service from outside the United States — including India, the European Union, the United Kingdom, or elsewhere — your information will be transferred to and processed in the United States. We rely on Google Cloud's standard contractual clauses and adequacy mechanisms where these are required by your local law.

We may update this policy from time to time. When we do, we will update the “Last updated” date at the top of this page. If a change is material, we will provide more prominent notice — for example, an in-app banner or an email to your account.

Your continued use of the service after a change becomes effective constitutes acceptance of the updated policy.

For privacy-related questions, requests under any of the rights described above, or grievance redressal under India's DPDP Act, contact us at privacy@studyspark.io.

For DPDP purposes, the contact address above is the designated point of contact for the data fiduciary.