Privacy Policy
Last updated:
This summary is provided for quick student comprehension and does not replace the binding legal text below.
1Introduction & Scope
Welcome to StudySpace (accessible at studyspace4u.vercel.app and our official Android application). StudySpace provides a complete student academic workspace designed to organize timetable schedules, track attendance safety margins, manage coursework tasks, record lecture-anchored notes, store course documents, and facilitate focused study sessions.
We believe educational tools should protect student privacy by default. This Privacy Policy outlines what information we collect, how our backend architecture guarantees strict user isolation, and how you retain full control over your personal academic records.
2Information We Collect
We collect only the minimum data required to power your personal academic workspace:
A. Authentication & Account Profile
When you authenticate using Google OAuth or email sign-in via Supabase Auth, we store your email address, user display name, and avatar URL. We request only standard identity scopes (openid, email, profile) and do not access your Google Drive, emails, or personal files.
B. Academic Records & Workspace Data
We store the courses you configure, weekly timetable slots, attendance marks (present, absent, cancelled), study tasks and deadlines, timestamped notes linked to lectures, Pomodoro focus session durations, and academic files you explicitly upload to your document vault.
C. YouTube API Services
When searching for lectures or importing course playlists, StudySpace interacts with the YouTube Data API v3 to retrieve public metadata (titles, channel names, video durations, thumbnails). StudySpace never accesses or modifies your private YouTube account or playlists.
3Architecture & Data Security (RLS & Cloudflare R2)
Security and tenant separation are enforced programmatically at every level of our technology stack:
- PostgreSQL Row Level Security (RLS): Every table in our database—including subjects, attendance records, timetable slots, study notes, tasks, and document metadata—has strict RLS policies enabled. Database queries authenticate using cryptographic JWTs, guaranteeing that users can only ever select, insert, or update rows matching their own authenticated user ID.
- Cloudflare R2 & Supabase Private Storage: Uploaded syllabus PDFs and study documents are held in private object storage. Document downloads and previews are served exclusively through short-lived, authenticated presigned URLs.
- Encryption in Transit & Rest: All web traffic is encrypted in transit using TLS 1.3 / HTTPS. All backend databases and object stores maintain encryption at rest (AES-256).
4Cookies, Local Storage & Session State
StudySpace uses strictly necessary cookies and browser storage required for core functionality:
- Authentication Cookies: Secure, HTTP-only JWT cookies managed by Supabase Auth to authenticate Next.js Server Components and Server Actions.
- Local Storage: Used locally on your device to store user interface preferences (such as light/dark mode selection) and active Pomodoro countdown state to survive page refreshes.
- Zero Advertising Trackers: We do not load third-party marketing cookies, trackers, or commercial pixels.
5Zero Data Selling & Third-Party Service Providers
We do not sell, rent, or monetize your personal data. Your academic history, lecture notes, attendance patterns, and account information will never be shared with advertisers, data brokers, or marketing networks.
We rely on enterprise cloud infrastructure solely to deliver the service reliably:
- Supabase (PostgreSQL & Auth): User authentication and database hosting with automated daily backups.
- Cloudflare (R2 Storage & CDN): Encrypted private document vault storage and global edge distribution.
- Vercel: Next.js web application hosting and serverless execution.
- Google Cloud / YouTube API: Google OAuth authentication and YouTube Data API v3 lecture metadata queries.
6Data Retention, Export & Permanent Deletion
You maintain full sovereignty over your academic materials. At any time, you may:
- Export Your Entire Workspace: Download a portable JSON archive of your timetable, attendance logs, notes, tasks, and study records from Settings → Export All Data.
- Reset Study Data: Wipe your semester courses and attendance history without closing your account from Settings → Delete My Study Data.
- Permanent Account Deletion: Permanently erase your account, all associated database records, and stored files from our cloud servers via Settings → Delete My Account or through our dedicated deletion portal at /delete-account. Deletion triggers an immediate cascade that purges your profile, notes, documents, and R2 assets.
7Contact Information
If you have questions regarding this Privacy Policy, your rights, or data security practices, please contact our team: