The short version: Study Flow collects your email address, the study cards you create, and your review history. We use this data solely to power the app. We never sell your data. You can request deletion at any time by emailing [email protected].
1. Who We Are
Study Flow is an AI-powered spaced-repetition study application operated by The Bright Harbor ("we", "us", or "our"). Our registered contact for data matters is [email protected].
This Privacy Policy explains what personal data we collect when you use Study Flow, how we use it, and your rights regarding that data.
2. Who This Service Is For
Study Flow is intended for users who are 16 years of age or older. We do not knowingly collect personal data from anyone under 16. If you believe a person under 16 has provided us with personal data, please contact us immediately and we will delete it.
3. Data We Collect
3.1 Account Data
- Email address — collected when you register for an account or join our waitlist. Used for authentication, transactional emails (review reminders, account confirmations), and support.
3.2 Study Content
- Study cards (flashcards) — the question-and-answer content you create or import. Stored to provide the core study experience.
- Review history — timestamps, ratings (Again / Hard / Good / Easy), and FSRS scheduling parameters for each card review. Used to calculate optimal review schedules.
- Deck and tag metadata — names and organisational structure you apply to your cards.
3.3 Usage Data (collected automatically)
- Log data — IP address, browser type, pages visited, and timestamps. Retained for up to 90 days for security and debugging.
- Device and browser information — operating system, screen resolution, and language preference. Used for compatibility and performance analytics.
3.4 Communications
If you contact us via email, we retain a record of the correspondence to resolve your request.
4. How We Use Your Data
- Providing the service — authenticating your account, syncing cards across devices, scheduling reviews using the FSRS algorithm.
- Improving the product — aggregate, anonymised analytics to identify performance bottlenecks and prioritise features.
- Communications — transactional emails (review reminders, password resets). Promotional emails only with your explicit consent; you may unsubscribe at any time.
- Security and fraud prevention — detecting and blocking abuse.
- Legal compliance — meeting obligations under applicable law.
5. Legal Basis for Processing (GDPR)
For users in the European Economic Area (EEA), the United Kingdom, or Switzerland, our legal bases for processing personal data are:
- Contractual necessity — processing your email, cards, and review history to deliver the service you have signed up for (Article 6(1)(b) GDPR).
- Legitimate interests — log data and usage analytics to maintain security and improve the product (Article 6(1)(f) GDPR).
- Consent — promotional emails and optional analytics features (Article 6(1)(a) GDPR). You may withdraw consent at any time.
- Legal obligation — where required by applicable law (Article 6(1)(c) GDPR).
6. Data Sharing
We do not sell, rent, or trade your personal data. We share data only in the following limited circumstances:
- Service providers — trusted third-party processors (cloud hosting, transactional email, error monitoring) bound by data processing agreements. They may only process your data on our instructions.
- Legal requirements — if required by law, court order, or to protect the rights and safety of Study Flow, its users, or the public.
- Business transfers — in the event of a merger or acquisition, your data may be transferred. We will notify you beforehand and you will have the right to delete your account.
7. Data Retention
We retain your account data and study content for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where retention is required by law (e.g., billing records, which are kept for up to 7 years).
Log data is retained for up to 90 days.
8. Your Rights (GDPR)
If you are located in the EEA, UK, or Switzerland, you have the following rights:
- Access — request a copy of the personal data we hold about you.
- Rectification — request correction of inaccurate data.
- Erasure ("right to be forgotten") — request deletion of your personal data. We will action this within 30 days.
- Restriction of processing — request that we limit how we use your data.
- Data portability — receive your study cards and account data in a machine-readable format (JSON/CSV).
- Object — object to processing based on legitimate interests.
- Withdraw consent — where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, email [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority.
9. Cookies
We use strictly necessary cookies for session authentication. We do not use advertising or tracking cookies. You may disable cookies in your browser, though this will prevent you from logging in.
10. Security
We implement industry-standard security measures including TLS encryption in transit, encrypted storage at rest, and access controls limiting staff access to personal data. No system is completely secure; if you have security concerns, please contact us.
11. International Transfers
Our servers are located in the European Union and the United States. Where personal data is transferred outside the EEA, we ensure appropriate safeguards are in place (e.g., Standard Contractual Clauses).
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify registered users by email at least 14 days before material changes take effect. Continued use of the service after the effective date constitutes acceptance.
13. Contact