How we handle your data

StudyIt is operated by Incrypt Solutions, a company registered in the Arab Republic of Egypt (“we”, “us”, “our”). We are the data controller for personal data collected through the StudyIt web application and mobile app (the “Service”).

Questions or requests about this policy can be sent to privacy@studyit.io. For security matters, use security@studyit.io.

EU/EEA Representative (GDPR Art. 27): we are in the process of appointing an EU representative. In the interim, EU/EEA users can reach us at privacy@studyit.io.

A one-page view of what we collect, why, and who we share it with. Full detail follows in the sections below.

We do not sell your personal information. We do not run behavioural advertising. We do not use your uploaded material to train AI models.

• Account data — name, email address, sign-in method, and profile picture, provided during sign-up through our authentication provider (Clerk). If you sign in with Google or Apple, we receive the same fields those providers give any third-party app.
• Profile data you add — country, language, education level, date of birth (used to age-gate accounts — see Section 11), and how you heard about us.
• Study activity — courses you open, lessons you complete, answers you give, streak days, XP earned, review schedule state, and time spent.
• Content you upload — documents, PDFs, images, slides, and notes you upload to generate a course.
• Device data — a mobile push-notification token so we can send you streak reminders (mobile app only; you can turn this off in your device settings).
• Technical logs — request timestamps, error traces, and IP addresses, kept short-term (max 90 days) for debugging and abuse prevention.

We do not collect precise geolocation, contacts, calendars, health or biometric data, or advertising identifiers. We do not currently use analytics or advertising SDKs; if we ever add one we will list it here in Section 8 and update this policy.

• To run the Service — sign you in, keep your courses, track your progress.
• To generate courses from material you upload — the source material is sent to our AI sub-processors listed in Section 8 for parsing, extraction, and lesson generation.
• To personalize your experience — home screen, review queue, streak recovery, leaderboards.
• To send you notifications — streak reminders on mobile, transactional emails on account changes.
• To improve the Service — debugging, performance monitoring, abuse investigation.
• To meet legal obligations and enforce our Terms of Service.

StudyIt uses artificial intelligence to turn your uploaded material into courses, lessons, and questions. This section explains what happens to your data during that process.

• Where it goes: excerpts of your uploaded material are sent to Google Vertex AI (Gemini models) and Google Document AI for processing. Both services operate under Google's Vertex-AI-tier terms.
• No training on your data: per Google's Vertex-AI terms, your prompts and uploaded content are not used to train Google's foundation models. We do not train any of our own models on your uploaded material either.
• Sensitive information: please do not upload material containing sensitive personal data (national ID numbers, health information, financial account details, other people's private data). StudyIt is a learning tool, not a vault.
• Accuracy: AI-generated lessons can be inaccurate, incomplete, or out of date. Do not rely on them as professional advice (medical, legal, financial, or otherwise) — see the corresponding disclaimer in our Terms of Service.

If you are in the EEA or the UK, we rely on the following bases under the GDPR:

• Contract (Art. 6(1)(b)) — running the Service you signed up for.
• Legitimate interest (Art. 6(1)(f)) — securing the Service, preventing abuse, improving product quality.
• Consent (Art. 6(1)(a)) — for optional notifications and, where required, for processing data of minors (parental consent is obtained on their behalf; see Section 11).
• Legal obligation (Art. 6(1)(c)) — to comply with applicable law.

We use a small number of trusted service providers to run StudyIt. Each has a contractual obligation to protect your data and process it only on our instructions.

• Clerk (United States) — user authentication and account management.
• Neon (EU-Frankfurt) — Postgres database hosting.
• Render (EU-Frankfurt) — backend application hosting.
• Vercel (global edge, primary US) — web application hosting and delivery.
• Amazon Web Services (S3) — object storage for uploaded material.
• Google (Vertex AI, Gemini, Document AI) — AI processing of uploaded material for lesson generation and document parsing. Under Vertex-AI terms, this data is not used to train Google's models.
• Expo Push Notification Service — mobile push delivery.

This list is current as of the effective date. If we add or replace a sub-processor, we will update this section and — for material changes — post a notice on this page at least 30 days before the change takes effect.

Analytics: we do not currently run any third-party analytics or session-replay tools (no Google Analytics, no FullStory, no Amplitude). Our only usage signal is derived from our own backend logs.

Cookies: on the web app we use only technical cookies required to keep you signed in (issued by Clerk) and to remember your preferences. We do not use advertising or cross-site-tracking cookies. The mobile app uses device-local storage for the same purposes; no advertising SDKs are included.

Advertising: we do not currently show ads. If we introduce advertising in the future we will update this section and, where required, ask for your consent first.

Most of your data is stored inside the EEA (Frankfurt). Some sub-processors listed in Section 7 are based outside the EEA (typically the United States). When your data is transferred outside the EEA, we rely on the transfer mechanisms required by GDPR — typically the European Commission's Standard Contractual Clauses — and equivalent safeguards.

Egyptian users: cross-border transfers of your personal data are conducted in compliance with Article 14 of the Egyptian Personal Data Protection Law (Law No. 151 of 2020) and its executive regulations, including where required a licence from the Personal Data Protection Center under the Ministry of Communications and Information Technology.

• Account data — for as long as your account is active. Deleted within 30 days of account deletion.
• Uploaded material and generated courses — until you delete them individually or your account is closed; then deleted from active storage within 30 days.
• Study activity (progress, streaks, XP) — until account deletion, then anonymized or deleted within 30 days.
• IP addresses in access logs — no more than 30 days.
• Other technical logs — no more than 90 days.
• Data we are legally required to keep — for the period the law requires (e.g. tax records), then deleted.
• Backups — replaced on their normal rotation schedule; data you delete may persist in backups for up to 90 days before being overwritten.

You have the right to:

• Access the data we hold about you.
• Correct data that is inaccurate or incomplete.
• Delete your account and associated data.
• Restrict or object to certain uses of your data.
• Receive a copy of your data in a portable format.
• Withdraw consent at any time where processing is based on consent.
• Not be subject to solely automated decisions with legal or similarly significant effects.
• Lodge a complaint with your local data-protection authority. In Egypt this is the Personal Data Protection Center under the Ministry of Communications and Information Technology (Law No. 151 of 2020). In the EEA, your national supervisory authority.

To exercise any of these rights, email privacy@studyit.io. We will respond within 30 days. Account deletion can also be requested self-service from your Settings screen.

StudyIt is a learning tool that families and schools may use, and we welcome learners of all ages. Because we collect data from children we take extra care in line with the GDPR (users under 16 in the EEA, or the lower age set by a member state, minimum 13), COPPA-adjacent standards, and Article 11 of Egyptian Law No. 151 of 2020.

Age gate. Sign-up asks for date of birth. We use it to route the account into one of three tiers:

• Child accounts (under 13, or under the applicable age of digital consent): may only be created with verifiable parental or guardian consent, obtained through a parent-email confirmation flow at first launch.
• Teen accounts (13 to 16, or up to the applicable age of digital consent in the EEA): we do not run advertising or interest-based analytics on these accounts and additional social features are locked down by default.
• Adult accounts (16+): full feature set with standard defaults you can adjust in Settings.

Feature restrictions on child and teen accounts (all changeable only by a parent or guardian):

• Public leaderboards outside the user's own class/school are hidden.
• Any direct messaging or profile-comment features are disabled.
• Profile avatars are limited to a curated set — no free-form uploads or display names.
• Third-party analytics and advertising SDKs are never loaded.
• Push-notification prompts are worded for minors and never used for marketing.

Parent controls. A parent or guardian may contact us at privacy@studyit.io at any time to review, correct, or delete their child's data, or to withdraw consent. Where children process personal data at scale, we appoint a Data Protection Officer as required by Article 8 of the Egyptian PDPL executive regulations.

We use industry-standard measures to protect your data — encryption in transit (TLS) and at rest, restricted access, audit logging, and regular reviews.

If we become aware of a breach that affects your personal data, we will notify the competent supervisory authority within 72 hours where required (Article 33 GDPR / the Egyptian PDPL timelines) and notify affected users without undue delay when required by Article 34 GDPR or Egyptian law.

If you believe your account has been compromised, email security@studyit.io immediately.

If you encounter user-uploaded content or user behaviour that violates our Terms of Service, report it to abuse@studyit.io. We aim to respond to abuse reports within 48 hours and, where appropriate, remove content, suspend accounts, or refer matters to law enforcement.

When we make a material change, we will update the effective date at the top and describe the change in the changelog below. For significant changes, we will additionally email registered users at least 30 days before the new policy takes effect. Continued use of the Service after a change means you accept the updated policy.

• 12 August 2026 — Initial version.

Incrypt Solutions
Arab Republic of Egypt
General enquiries: privacy@studyit.io
Security: security@studyit.io
Abuse and moderation: abuse@studyit.io

See also our Terms of Service.