Know what to study next.
Version: privacy-2026-07c
Last updated: 31 July 2026
If the product changes, this document and the version above change with it. Consent records store the version somebody agreed to, so a stale policy would make those records claim something untrue.
Studly is a study app. You photograph or type a problem, we help you solve it, and we keep track of what you have shown you can do so we know what to suggest next.
Studly is operated by Nikhil Pal, Mississauga, Ontario, Canada.
For anything about this policy or your data, contact hello@nikhilailabs.com.
| What | Why | Required? |
|---|---|---|
| A nickname | So the app can address you | Yes — but it does not have to be your real name, and the app says so when it asks |
| Age band | To apply the right protections | Yes. We ask for a band, never your date of birth |
| Country, and sometimes region | To match your curriculum | Yes |
| Curriculum, grade, exam goal | To choose what to teach you | Optional |
| Problems you type or photograph | To answer them | Only when you submit one |
| Photographs of your working | To check your steps | Only when you choose to show your work |
| Feedback you write | To improve the app | Optional, always |
When you report a problem, and only if you leave the technical details switched on, we attach: app version, build number, device type, operating system version, the screen you were on, a recent error code, and your network status.
That list is exhaustive and enforced in code. We cannot attach your notes, your photographs, your AI conversations, your profile, or any credential, because the code that builds it has no field those could occupy.
We do not sell your data. We do not share it for advertising. There is no advertising in Studly.
We use these providers to run the service:
| Provider | What they process | Why |
|---|---|---|
| Supabase | Account, profile, progress, uploaded work | Database, authentication and file storage |
| OpenAI or Anthropic | The text of the problem you submitted, and photographs of problems or working | To read and answer the problem |
| RevenueCat, with Apple or Google | Your subscription status and an anonymous identifier | To sell and manage Studly Plus |
What the AI provider receives. The problem, and any photograph you submit with it. Not your name, your email, your age, your school or your account identifier. They answer a question; they are not told whose it is.
What analytics receives. Codes, counts and enumerated values — that a feature was used, that feedback was rated unhelpful, which reason was chosen. Never free text. Never your email, age band, location, school, or anything you uploaded. The list of permitted fields lives in the code, and anything not on it is discarded before sending rather than merely discouraged.
Studly is for learners aged 13 and over.
We ask your age band before we create an account and before we keep anything about you. If you tell us you are under 13 we do not create an account, we do not store your work, and we keep nothing at all — not the answer you just gave, not an email address, nothing.
We are building a version a parent or guardian can set up with you. It is not open yet, because we want the way we handle a younger learner’s data reviewed properly before we collect any of it. Until then the answer is simply no, and nothing is recorded either way.
Settings → Delete my account, inside the app. You type DELETE to confirm.
It removes your profile and sign-in, every problem you have solved and the work you uploaded, your progress, mastery, streak and XP, and any feedback you sent us. It cannot be undone and we cannot restore it for you.
If you have a subscription, cancel it separately in your Apple ID or Google Play settings — those are managed by the store, not by us, and deleting your Studly account does not cancel a subscription.
Depending on where you live you may have the right to access, correct, export, delete or restrict what we hold, and to object to processing. Contact hello@nikhilailabs.com and we will respond within 30 days.
If you are unhappy with our response you can complain to your data protection authority — in the UK, the Information Commissioner's Office.
If we change this policy we will update the version above and ask you to agree again where the law requires it. Because consent records store the version agreed to, we can always tell which version you saw.
For reviewers and auditors. Not part of the policy as published.
| Promise | Enforced by |
|---|---|
| Free text never reaches analytics | apps/api/src/lib/analytics.ts — property allowlist; comment absent by design |
| Bug reports carry no learner content | apps/mobile/src/feedback/diagnostics-format.ts — field allowlist |
| AI usage records hold no problem text | ai_request_log, standing comment in 20260727000001_initial_schema.sql |
| One student cannot see another's data | Row-level security, migrations 11, 16, 17 |
| Uploaded work is private and ownership-checked | apps/api/src/services/work-image-storage.ts — ownership recoverable from the object path |
| Under-13 data is not kept before consent | apps/api/src/services/age-gate.ts, account-service.ts bootstrap branch |
| Guardians see no per-question detail | apps/api/src/services/parent-dashboard-service.ts — the response shape cannot hold it |
| Feedback is never a learning signal | ADR-0013 §1; no foreign key from feedback tables to evidence |
| No provider key in the app | pnpm check:secrets, run in CI |
| Account deletion removes everything | POST /v1/account/delete, deleteAllForAccount |
| Consent is versioned | privacy_consent table; version stamped from PRIVACY_POLICY_VERSION |