Privacy Policy
Study.Buddies is a focused study tool, not an advertising business. We collect only what the platform needs to function, and nothing we'd have to write a paragraph here to justify.
Operated by Abdullah Mahmood (trading as A&M Apps).
Last updated: 18 September 2026
Zero Public AI Training
Your personal notes, audios, and files are never used to train public foundation AI models.
Strict User Isolation
Row-Level Security (RLS) and signed URLs ensure only your account can ever access your data.
Zero Ads or Data Brokers
No ads in the app and nothing sold, ever. Ad measurement only runs on our app download page, never inside your account.
Instant Export & Full Erasure
Export your materials to PDF/Markdown anytime or permanently delete your account in 1-click.
Quick Section Navigation
What we store
- Your account: Email address, display name, and avatar if you choose to add one.
- Your material: Notes, lecture audios, scanned textbook pages, courses, flashcards, and quizzes.
- Your practice: The questions generated for you, your answers (including photos of written working you choose to take) and how they were marked; the questions you save and the mistakes you log.
- Podcasts and past papers: The script and audio of podcasts you make from your notes, and the pages of past papers you upload with a description of each paper's style. The questions on a paper are never reused.
- Your activity: Study sessions, Pomodoro focus blocks, and quiz accuracy for progress analytics.
- Your AI usage: Feature run logs and compute meter records to calculate credit allowances.
- Subscription tier: Store product identifier and active status. We never see or store your credit card numbers.
What we don't do
- No selling data: We never sell, rent, or trade your personal information or notes to third parties.
- No third-party ads: We display zero external ads and never share your study history with advertisers.
- No uninvited reading: We do not inspect your notes for any purpose other than executing features you explicitly trigger.
- No cross-app tracking: We do not build advertising profiles or track your activity across other apps or websites.
2. Where your data lives & security
We employ enterprise-grade storage, strict database partition policies, and zero-trust transport:
🛡️ Database Encryption & RLS
Your account, notes, and activity are stored with Supabase, encrypted in transit (TLS 1.3) and at rest (AES-256). Row-Level Security (RLS) guarantees every database query is cryptographically scoped strictly to your account. Files saved before August 2026 may still sit in Supabase storage, under the same protection.
☁️ Object Storage & Signed URLs
Lecture recordings, scans, imported PDFs, podcast audio, photos of your answers and uploaded past papers are stored in Cloudflare R2 private buckets. Media is never public; it can only be accessed through short-lived signed URLs generated on-demand for authenticated requests. Profile photos are served from a public link, so treat one as public.
3. Who else processes your content
These are the only third-party infrastructure and AI model providers your content reaches, and strictly for the designated technical purpose:
| Processor | What it receives | Technical Purpose |
|---|---|---|
| Supabase | Account credentials, notes, usage records | Hosting, PostgreSQL database, authentication & RLS security |
| Cloudflare (R2) | Lecture recordings, scanned pages, imported files, podcast audio, answer photos, past papers | Private object storage, served strictly through short-lived signed URLs |
| Google (Gemini API) | The page scan, PDF or note text for the active request | Reading scans and PDFs, flashcards, practice questions, marking written answers and answer photos, podcast scripts and voices, reading past papers, search, AI companion |
| xAI (Grok) | The lecture transcript or extracted document text for the active request | Writing structured notes, key terms, practice quizzes and worked problems |
| Anthropic (Claude) | The document or note text for the active request | PDF text extraction, and standby failover when another provider is unavailable |
| Groq | The note text for the active request | Low-latency inference for quizzes and flashcards during heavy load |
| Deepgram | The lecture audio file you explicitly chose to transcribe | High-accuracy speech-to-text transcription of completed recordings |
| Google / Apple Sign-In | Email and full name (only if you choose OAuth sign-in) | Third-party single sign-on authentication |
| Apple / Google Play | Subscription purchase tokens & billing status | Processing, verifying, and renewing subscription payments |
| Vercel Analytics / Google Analytics | Pages visited, device and browser type. No account or note content | Understanding site traffic. Never sold, and never linked to your notes. |
| Meta (Pixel) | Visits to our app download page and taps on its App Store button. Nothing from inside your account | Measuring whether our ads work. Never sold, and never linked to your notes. |
4. Data retention & deletion
Your content stays until you choose to delete it, or until you delete your account. Deleting a note, recording, course, or flashcard deck permanently removes the database record and any associated cloud media files. Deleting a note also deletes its podcasts and their audio, and deleting a past paper deletes its pages. Photos of your answers are kept with your practice history and mistakes, and removed when you delete your account.
AI usage records are retained for up to 24 months solely for billing reconciliation and credit metering. They record which feature was executed and compute cost; they do not store the text of your notes.
5. Your control & GDPR rights
- Instant Export: Export any note to standard Markdown (.md) or PDF formats at any time.
- Permanent Account Deletion: Permanently delete your profile and all associated data instantly in SettingsDelete Account (or from Profile › Delete Account in the mobile app).
- UK / EU GDPR: You have full rights of access, rectification, portability, and erasure under GDPR. Contact us to action any request within 30 days.
6. Children & Young Learners
Study.Buddies is rated 4+ and is suitable for users of all ages. We protect the privacy of all our users, including young learners. If parents or guardians have any questions about data handling, they can contact us by email at abdullahm.apps@gmail.com.
7. Contact & Data Controller
A&M Apps is a trading name of Abdullah Mahmood, acting as Data Controller under UK & EU data protection law. For inquiries regarding data protection: