Privacy policy
Last updated 14 September 2026
- We collect what it takes to run a GMAT study app: your email, your answers and how you answered them, your study goal, and your subscription status.
- We don't sell your data, we don't show ads, and we don't run advertising or product-analytics trackers.
- We don't keep your full IP address in our records. Our providers' security and access logs are the exception, and they keep them only briefly.
- You can delete your account yourself, in the app, at any time. It deletes everything we hold about you.
Who we are
StudyBuddy (“we”, “us”) runs the StudyBuddy GMAT study service at studybuddy.llc and in the StudyBuddy apps. We are the controller of the personal data described here. Questions or requests: support@studybuddy.llc.
What we collect
You give us
- Account details: your email address and your password, which our authentication provider stores only as a hash. If you sign in with a one-time email code instead, there is no password at all.
- Profile and goal: the name you'd like us to call you, your test date, target score and weekly study hours.
- Feedback: anything you write when you report a problem, plus the question it's about. If you choose to attach one, we also take a screenshot of the screen you were on.
Created as you study
- Study history: each question you answer, the answer you chose, whether it was right, how long you took, how confident you said you were, and the practice mode. Also session summaries, practice test and section scores, and the study plans generated for you.
- Derived progress: your review schedule, skill and readiness estimates, and the pacing and gate states worked out from your history.
Collected automatically
- Devices: we cap how many devices can use one account. To do that we store a random identifier the app creates for each device, a device name, your browser's user-agent string, the country your connection comes from, and an abbreviated network address. That is the first part of your IP (a /24 for IPv4, a /48 for IPv6) plus a salted hash, never the full address. We use these to enforce the cap and to spot an account being shared. They are not used for anything else.
- Diagnostics attached to a feedback report: the app's build and version, the screen you were on, your platform, screen size, and a short in-memory log of recent app activity. Tokens and email addresses are removed from that log as it is written.
- Error reports: when the app or our server fails, a report of the error with your account's internal ID. Your email and your IP address are stripped before it is sent.
- Page-load measurements: our hosting provider measures how quickly our pages load (see Cloudflare below). As far as we have been able to observe, no cookie is set for this.
What we don't collect
We never see or store your card details, because our payment provider handles them. We don't use advertising cookies, cross-site trackers, or product analytics.
Why we use it, and our legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Running your account and the study service: selecting questions, scheduling reviews, building your plan, showing your progress | Account, profile and goal, study history, derived progress | Performing our contract with you |
| Taking payment and managing your subscription | Email, subscription status and dates | Performing our contract with you |
| Enforcing the device limit and preventing account sharing | Device data | Our legitimate interest in protecting the service |
| Fixing bugs and answering your reports | Feedback, diagnostics, error reports | Our legitimate interest in a working service; for screenshots, your choice to attach one |
| Keeping pages fast and displaying them correctly | Page-load measurements | Our legitimate interest in a working service |
| Keeping records we are legally required to keep | Whatever the law requires | Legal obligation |
AI-generated study plans
Your daily and long-term study plans are written by an AI model from Anthropic. To write one, our server sends Anthropic your goal (test date, target score, weekly hours), a summary of your recent answers and review schedule, counts of patterns in your mistakes, and the study notes we keep for you. It does not send your email address or your name. The request comes from our server, never from your device, so Anthropic doesn't receive your IP address. Under Anthropic's commercial terms, API data is not used to train its models.
Who processes your data for us
We use these service providers. Each acts on our instructions under a data-processing agreement.
| Provider | What they do | What reaches them |
|---|---|---|
| Supabase | Sign-in and our database | Everything described above, apart from the page-load measurements |
| Fly.io | Hosts our server | Requests between the app and our server, and short-lived server logs |
| Cloudflare | Hosts our website and apps, and measures page-load performance (Web Analytics) | Your requests to our website as they pass through, and page-load timings |
| Anthropic | Writes your study plans | The study context described in the section above |
| Sentry | Error reporting | Error details and your internal account ID, with no email and no IP address |
Polar handles checkout and billing as our merchant of record. That means Polar sells you the subscription and is responsible for payment, tax and invoicing, so for your payment details and billing records Polar is a controller in its own right, under its own privacy policy. We receive your subscription's status, plan and dates from Polar, and the email used at checkout. We never receive your card details.
International transfers
Our providers process data in the United States and other countries. Where personal data from the UK, EU or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum where applicable) or the provider's certification under the EU-U.S. Data Privacy Framework.
How long we keep it
- Your account and study data: for as long as you have an account. Deleting your account deletes it.
- Feedback screenshots: deleted when your report is closed, or after 90 days, whichever comes first. The text of the report stays until you delete your account.
- Devices: a device you haven't used for 90 days is released from your account automatically. The history of device changes stays until you delete your account.
- Server logs, sign-in security logs and error reports: these can include your IP address (in sign-in and access logs). They are kept for a short time for security and debugging, according to our providers' retention periods (typically 30 to 90 days).
- Billing records: Polar keeps these for as long as tax and accounting law requires, even after your account is deleted.
Your rights and choices
- Delete your account: in the app, go to Account → Data & Privacy → Delete account. On the web, it's also at studybuddy.llc/account. This ends any subscription immediately and permanently deletes your account, email, study history, plans, devices and feedback. You can't undo it.
- Reset your study data: Account → Data & Privacy → Reset study data erases your history, plans and progress but keeps your account and subscription.
- Correct your details: change your name, goal and settings in the app. For anything else, email us.
- Access or export your data: email support@studybuddy.llc from the address on your account and we will send you a copy within 30 days.
- Object or restrict: you can object to processing we base on legitimate interests, or ask us to restrict processing, by emailing us.
- Complain: if you are in the UK, EU or EEA, you can complain to your local data protection authority.
We will answer any request within 30 days, and we may need to confirm it comes from the account holder first.
California residents
Under the CCPA and CPRA, you have the right to know what personal information we collect, use and disclose. You also have the right to delete it, correct it, and not be discriminated against for using these rights. The categories we collect are listed under “What we collect” above: identifiers, commercial information (your subscription), internet activity within our service, and inferences about your study progress. We collect them for the purposes in the table above. We do not sell or share personal information for cross-context behavioural advertising, and we do not use or disclose sensitive personal information to infer characteristics about you. To make a request, use the in-app deletion or email us.
Storage on your device
The website and apps keep your sign-in session, your settings (such as theme), and any answers or reports that haven't reached our server yet in your browser's local storage or your device's app storage. These are needed for the service to work, not for tracking. Signing out removes your session. Deleting your account also clears any unsent answers and reports from that device.
Security
Data is encrypted in transit. Our database is access-controlled at the row level, and only our server holds the keys to our AI and payment providers. No system is perfectly secure. If a breach affects your personal data, we will tell you and the relevant authorities as the law requires.
Children
StudyBuddy is for people preparing for graduate business school admission, and is not intended for anyone under 16. We don't knowingly collect data from children under 16. If you believe a child has created an account, email us and we will delete it.
Changes
If we change this policy in a way that matters, we will update the date above and tell you in the app or by email before the change takes effect.