Privacy Policy

Last updated: November 10, 2026

StudyDuo ("we", "our", "us") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, and safeguard your information when you use our mobile application ("the App") and our website at studyduo.app, where you can use StudyDuo in your browser ("the Website"). Unless a section says otherwise, what it says about the App applies to the Website too.

1. Data Controller

The data controller responsible for your personal data is:

StudyDuo
Email: support@studyduo.app

2. Information We Collect

Account Information

• Email address (for authentication, and for notifications by email if you turn them on)
• Display name and nickname
• Date of birth (asked once during profile setup; never shown to other users)
• Age range shared by Apple or Google — only in regions where an age law requires it, such as some US states and Brazil, and only with your permission where the system asks for it. Used solely to apply age requirements
• Country and city (optional, user-provided)
• Bio, interests, and links to your social media accounts (optional)
• Avatar selection, or a profile photo if you upload one (optional, see Section 3)
• A selfie for photo verification, if you choose to verify your photo (optional, kept only until it is reviewed, see Section 3)

Usage Data

• Focus session records (duration, timestamps, completion status)
• Session ratings and feedback (optional)
• Goals and daily targets
• Achievements and streak data
• Scheduled session details
• Tasks you add, and what you show on your tile in a video room
• The time of your daily study reminder and your phone's time zone, used to send it and your task reminders at the right time
• Your activity in video rooms: time spent, likes, pins, and boosts

Messages

• Chat messages exchanged with focus partners
• Voice messages you record and send in chats (see Section 4)
• Messages you send in the chat of a video room (Focus Room 1, see Section 4)
• Reactions you add to messages in chats and in a room's chat
• Session descriptions and notes

Feed

• Posts, comments, replies, reactions, and photos you publish in the feed

Purchases

• Your Premium subscription status and your Premium and Superboost purchases, received from Apple, Google, and RevenueCat. We do not receive your payment card details

Reports and Blocks

• Reports you send or receive, the people you block, and any moderation action on your account

Device Information

• Push notification tokens (for delivering notifications)
• Device type and operating system (for app compatibility)

Free Trial Protection

Each person gets one free Premium trial and one free hour of video rooms a day, whatever email address they sign up with. To apply this, we use:

• A device identifier: on Android, based on the device's Android ID; on iOS, a random identifier the App creates once and keeps in your device's Keychain. The App sends only a one-way hash of it, never the identifier itself
• The network your device connects from: its IP address (for IPv6, only the network part of the address)
• On our website, when you sign up or log in: a random identifier kept in your browser's local storage

We do not store the identifiers or addresses themselves, only keyed hashes of them, which cannot be turned back into a device, a network, or an address. A new account on a device that had a free trial in the last 12 months starts without a trial. If 3 free trials were started from the same network in the last 30 days, a new account's trial starts once its profile photo is verified (see Section 3). Free accounts on one device share one free hour of video a day, and on our website free accounts on one network share 3 hours a day. Sign-ups with a disposable (temporary) email address are not accepted.

App Analytics

• Screens viewed, app opens, and time spent in the App
• Device model, operating system, app version, language, and timezone
• IP address, used to determine approximate location (country, city)
• Your account ID and a random app-instance identifier (not your name or email)

Website Analytics

• Pages viewed on studyduo.app, the page you came from, and clicks on our public pages (not inside your account)
• Browser, device type, operating system, and language
• IP address, used to determine approximate location (country, city) and then discarded
• If you are logged in, your account ID (not your name or email). Addresses that name a person, such as a profile's, are recorded without the name

Website analytics uses PostHog (hosted in the EU) and stores nothing on your device: no cookies and no local storage. Each visit is counted on its own.

Advertising Measurement

• Device and app events shared with TikTok to measure our ads on TikTok (see Section 15)

3. Profile Photos and Photo Verification

Both are optional: you can keep one of the App's animal avatars and never upload a photo.

Profile photo

• You can upload a photo of yourself in place of an animal avatar. Like the avatar, it is visible to other users.
• Before the photo is saved, we resize it and remove its metadata, such as the place where it was taken.
• Every photo is checked by an automated moderation service, the OpenAI Moderation API, for sexual content, violence, and self-harm. A photo that fails the check is not saved. OpenAI does not use these photos to train its models and does not keep them after the check.
• The photo is stored with our storage provider, Cloudflare. When you upload a new photo, the previous one is deleted. When you switch back to an animal avatar or delete your account, the photo is deleted within 2 days.

Photo verification

• If you are 16 or older, based on the date of birth you gave us, you can verify that your profile photo shows you. Verified profiles get a blue checkmark next to the name, and only verified profiles can use 1:1 rooms.
• To verify, you take a selfie in the App with the front camera, showing a hand gesture the App asks for, such as a thumbs up. The gesture shows that the selfie was taken just now and is not an older photo.
• Before the selfie is sent, the App checks that your profile photo and the selfie each contain a face. This check runs on your device with its built-in tools (Apple Vision on iOS, Google ML Kit on Android); the photos are not sent anywhere for it.
• A member of our team compares the selfie with your profile photo by eye and approves or rejects the request. No automated face recognition is used, and no biometric data (facial geometry) is created. If a request is rejected, the App shows you the reason and our comment.
• Tapping "Take selfie" after reading the notice in the App gives your consent to sending the selfie for review. You can withdraw it at any time by contacting us.
• The selfie is stored on our servers (Supabase) only until it is reviewed. It is deleted as soon as the request is approved or rejected, when you upload a new profile photo, or when you delete your account. We keep a record of each request: which photo it was about, the requested gesture, the result, and the reason and comment we gave you.
• We use the selfie only to verify your profile photo and never show it to other users.
• The checkmark stays when you switch to an animal avatar. When a verified user uploads a new photo, a member of our team looks at it: if it shows a face, the checkmark is removed until the new photo is verified with a selfie; any other picture keeps it.

4. Video Rooms and Voice

Video rooms use your camera, and 1:1 rooms also your microphone. Both are optional and need your device's permission.

Live video and voice

• Focus Room and Study Hour share your camera only, with no sound. A 1:1 room shares your camera and your microphone with one other person.
• Your video and voice are streamed live through our own server to the people in the room, along with your name, avatar or photo, and the task or bio on your tile. We do not record or store them.
• In the App, screenshots and screen recording are blocked in video rooms. A browser cannot block them, so on the Website someone could capture their screen; and nothing can stop someone from filming their screen with another device.
• Video rooms are available from age 16, or 18 where an age law applies. Focus Room and Study Hour are shared by everyone aged 16 and older. A 1:1 room is only for people with a verified profile photo (see Section 3); in the United Kingdom, people aged 16 and 17 are paired only with each other in a 1:1 room. Without a known date of birth you can watch, but not show your camera.
• When you report someone in a video room, we receive the report along with what their tile showed. Video is not recorded, so we cannot review a past video. An account we ban cannot enter video rooms, and is removed if it is in one.

Watching as a guest on the Website

• Without an account, you can watch Focus Room and Study Hour on the Website for up to an hour a day. A guest only watches: no camera, microphone, chat or profile, and the people in the room do not see guests.
• Guests see the video only of people whose "Who sees my video" is set to Everyone. Everyone else is hidden from guests.
• Before a guest session starts, Cloudflare Turnstile checks that the browser is not a bot. For this, Cloudflare processes your IP address and information about your browser under its privacy policy.
• To count the free hour, our server gives your browser a random guest identifier, which the browser keeps in its local storage. We store how many seconds of video that identifier watched each day, with no account, name or IP address attached, and delete these records after 30 days.
• To limit abuse, our server also counts new guests and their watching time per network (an IPv4 address, or an IPv6 /64) for the current day. These counts are kept only in the server's memory, not in a database.

Room chat

• Focus Room 1 has a text chat. Everyone in the room sees your messages and reactions, with your name, avatar or photo, and verification checkmark. Writing needs a known date of birth.
• An automated filter replaces rude words with asterisks. Messages with explicit sexual content, links, or @-names are not sent.
• You can report a message or block its author. A report reaches our team with the message's text. Our team can delete messages and ban accounts, and a banned account's messages are hidden from everyone.

Voice messages

• Voice messages are stored with our storage provider, Cloudflare, so the other person can listen to them.
• When you delete a voice message, its recording is deleted. A recording you never send is deleted automatically within about a day.

5. Legal Basis for Processing (GDPR)

We process your personal data on the following legal grounds:

• Contract performance (Art. 6(1)(b)): Processing necessary to provide the App's core functionality — account creation, confirming you meet the minimum age, session management, partner matching, chat, voice messages, video rooms, purchases, and achievements.
• Consent (Art. 6(1)(a)): Push notifications, notification emails, optional profile information (country, city, profile photo), photo verification (see Section 3), calendar sync, and on iOS, advertising measurement (see Section 15). You may withdraw consent at any time.
• Legitimate interest (Art. 6(1)(f)): Content moderation, fraud prevention (including one free trial per person, see Section 2), service improvement, product analytics (understanding how the App is used), and on Android, advertising measurement (see Section 15). We balance our interests against your rights and freedoms.

6. How We Use Your Information

We use your information to:

• Provide and maintain the App's functionality
• Confirm you meet the minimum age and apply age limits to features that need them
• Match you with focus partners based on your location, timezone, and category
• Display your profile to other users (name, avatar or profile photo, country)
• Check uploaded photos for prohibited content and, if you choose, verify that your profile photo shows you
• Send push notifications (session reminders, your daily study reminder and task reminders, chat messages, achievements)
• Email you those notifications instead, if no phone of yours can get them and you turn on "Email them to me" in Settings on the website: at most two a day, never to an Apple "Hide My Email" address, and every email has a link that turns them off
• Generate your personal statistics and analytics
• Track achievement and streak progress
• Stream video and voice between the people in a video room, and deliver voice messages
• Process subscriptions and in-app purchases (handled by Apple/Google and RevenueCat)
• Give each person one free trial and one free hour of video a day, and turn away sign-ups with disposable email addresses (see Section 2)
• Moderate content, act on reports, and ban accounts that break our community guidelines
• Measure how our ads on TikTok perform (see Section 15)
• Improve and develop the App, including product analytics

7. Data Storage & Security

Your data is stored securely using Supabase (hosted on AWS infrastructure in the United States). Photos and voice messages are stored with Cloudflare. We use the following protections:

• All data is encrypted in transit (TLS/SSL) and at rest
• Database-level Row Level Security (RLS) policies
• JWT-based authentication
• Passwords are hashed and never stored in plain text

8. Data Sharing

We do not sell your personal data. We share information only in these limited cases:

• With other users: Your display name, avatar or profile photo, verification checkmark, country, city, bio, social links, feed posts, and online status are visible to other users for partner matching and social features. In a video room, the people there also see your live video and your task, and hear your voice in a 1:1. If "Who sees my video" is set to Everyone, guests watching on the Website see your live video too; any other choice hides it from them. In Focus Room 1's chat, the people in your hall see your messages and reactions
• Service providers: We use the following third-party services that process data on our behalf:
  • Supabase (database hosting, authentication)
  • Resend (transactional emails)
  • PostHog (product analytics, hosted in the EU)
  • Expo Push Notifications (push notification delivery)
  • Cloudflare (hosting of the Website, storage of photos and voice messages, delivery of traffic to our servers, and Turnstile bot checks for guests on the Website)
  • Vultr (hosting of our servers, including video rooms)
  • RevenueCat (subscription and purchase status)
  • Sentry (crash reports)
  • Google Firebase (push notification delivery)
  • OpenAI (automated moderation of uploaded photos)
  • Apple / Google (payment processing, sign-in)
  These providers process data only as necessary to provide their services and are bound by their own privacy policies.
• TikTok: To measure our ads on TikTok, the App shares device and app data with TikTok as described in Section 15
• Legal requirements: We may disclose data if required by law or to protect the safety of our users

9. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access — Request a copy of the personal data we hold about you
• Correction — Correct inaccurate information via Profile settings or by contacting us (your date of birth can only be corrected by contacting us)
• Deletion — Delete your account and associated data (available in Profile → Settings → Manage Account → Delete Account)
• Data portability — Request your data in a structured, machine-readable format
• Restrict processing — Request that we limit how we use your data
• Object to processing — Object to processing based on legitimate interests
• Withdraw consent — Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing
• Opt out of push notifications and advertising measurement via device settings (see Section 15), and of notification emails with the link in any of them or in Settings

To exercise these rights, contact us at support@studyduo.app. We will respond within 30 days.

If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local data protection supervisory authority.

10. California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to know what personal information we collect, use, and disclose
• Right to delete your personal information
• Right to opt-out of sale or sharing — We do not sell personal information. We share device and app data with TikTok to measure our ads, which California law may treat as "sharing". You can opt out as described in Section 15
• Right to non-discrimination — We will not discriminate against you for exercising your privacy rights

Categories of personal information we collect are listed in Section 2 above. We do not sell personal information to third parties. To submit a request, contact us at support@studyduo.app.

11. Data Retention

• Account data is retained while your account is active
• When you delete your account, your personal data is removed within 30 days
• Chat messages are deleted when both participants have deleted their accounts
• Messages in a room's chat are kept until you or our team delete them, and are deleted with your account. Reactions are deleted with their message or with your account
• Upon account deletion, we retain non-reversible cryptographic identifiers: (a) for up to 6 months to restore your conversation history if you re-register, and (b) indefinitely to prevent trial subscription abuse. These identifiers cannot be used to identify you
• Free trial protection keeps the hash of a device for 12 months after its free trial, the hash of a network for 30 days, and daily counts of free video time for 3 days. These hashes are not tied to your account and are kept after you delete it, so that deleting an account does not start a new trial on the same device. The note of how your account's trial was decided is deleted with your account
• Profile photos are deleted within 2 days after you replace or remove them; verification selfies are deleted as soon as they are reviewed (see Section 3)
• A guest's daily watching time on the Website is deleted after 30 days (see Section 4)
• Live video and voice in video rooms are not stored. A voice message's recording is deleted when you delete the message (see Section 4)
• Data shared with TikTok is kept according to TikTok's privacy policy
• Anonymized, aggregated analytics may be retained indefinitely
• Product analytics data (PostHog) is linked only to your account ID, never to your name or email. You can request its deletion at any time

12. Children's Privacy

StudyDuo is not intended for children under 13 (or under 16 in the European Economic Area). We ask for your date of birth during profile setup. If it is below the minimum age, the account is locked, the date is not stored, and the account can be deleted from the App. We do not knowingly collect data from children under these ages. Video rooms and photo verification are available only from age 16. If we become aware that we have collected data from a child under the applicable age, we will promptly delete it. If you believe a child has provided us with personal data, please contact us at support@studyduo.app.

13. Third-Party Services

The App may integrate with third-party services:

• Apple Sign-In / Google OAuth: Used for optional sign-in (we receive only your email and name)
• Calendar: Optional sync with device calendar (data stays on your device)
• TikTok Business SDK: Used to measure our ads on TikTok (see Section 15)
• Apple Health / Google Fit: Not integrated

14. International Data Transfers

Your data is stored and processed in the United States (via AWS/Supabase). Product analytics data is processed by PostHog in the European Union. Photos checked for moderation are processed by OpenAI in the United States. Video and voice in video rooms pass through our server in the United States. TikTok may process the data it receives outside your country. If you are located outside the United States, your data will be transferred internationally. We protect these transfers using:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data processing agreements with all service providers
• Technical safeguards including encryption in transit and at rest

15. Advertising Measurement, Cookies & Tracking

The App does not use cookies and does not show advertisements. StudyDuo advertises on TikTok, and the App includes the TikTok Business SDK to measure those ads.

• What it sends to TikTok: your IP address, device details (such as model, operating system, and language), device identifiers, an anonymous identifier, and app events: installation, launches, return visits, and in-app purchases. On iOS the identifiers are the identifier for vendor and, only if you allow tracking, the advertising identifier. On Android they include your device's advertising ID.
• What it does not send: we do not give it your name, email address, messages, photos, video, or voice.
• On iOS (from App version 1.1), the SDK starts only if you tap Allow in the system prompt. The App asks once, and you can change your answer at any time in your device's privacy settings.
• On Android, the SDK starts without a prompt. You can delete your advertising ID in your device's settings, and contact us at support@studyduo.app to object.

TikTok handles this data under its own privacy policy.

The App also uses Sentry for crash reporting, Firebase for push notifications, and PostHog for product analytics (how the App is used; not for advertising or cross-app tracking). The Website uses only cookies that are strictly necessary: they keep you signed in. It uses no advertising or analytics cookies and does not include the TikTok SDK. In your browser's local storage it keeps a random identifier used only for free trial protection (see Section 2), a guest identifier if you watch without an account (see Section 4), and small settings, such as where you placed your own video in a room.

16. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes through the App or via email. The "Last updated" date at the top reflects the most recent revision. Continued use of the App after changes constitutes acceptance of the updated policy.

17. Contact Us

If you have questions or concerns about this Privacy Policy, please contact us:

Email: support@studyduo.app