Privacy Policy

StudySocial stores what you type in so your schedule, work and friends stay in sync. This page explains exactly what that is, who can see it, and how to delete it.

Version 2026-09-17Effective September 17, 2026Updated October 30, 2026Pending legal review

This document was written by the people who make StudySocial and is waiting for a lawyer's review. It describes how the app really works today; the boxes marked For legal review are open questions, not rules.

1.The short version

What we store: your account details, your classes and commitments, your assignments, study materials and class files, your own to-do list and study plan, your friends and group projects, and anything you import from your school.
Who sees it: friends see your schedule only when you turn sharing on, plus your name, username, picture and any badge you display. People in a group project you joined see that project. Your assignments, notes, files, plan, email and school data are never shown to other users.
No ads, no tracking, no AI: StudySocial has no advertising, no analytics, no tracking pixels, and no AI features. We do not sell your information.
Where it lives: our database is hosted in the United States. The app itself runs on Vercel.
How to delete: delete any item from inside the app and it is gone immediately. Delete your whole account at Settings → Account.
Questions: write to us through the contact form.

2.What we collect

StudySocial only stores information you give it, or that your school sends when you choose to connect it. Nothing here is collected in the background. Each category below says what it is, why we keep it, who can see it, and how you control it.

Account details

What: Your name, username, email address, a hash of your password (never the password itself), an avatar colour, and a profile picture if you upload one (up to 2 MB, images only). If you sign in with Google, your Google account id instead of a password. We also record when you last changed your username or picture, because each may change once every 14 days.
Why: To create your account, sign you in, and show your friends who you are.
Required?: Yes. You cannot have an account without them.
Who can see it: Your name, username, colour and picture: your friends, people in a group project with you, and anyone you send a friend request or invite link to. Your email: only you. Your password hash and Google id: nobody, they stay on the server.
Shared with: Our hosting and database providers process it to run the app (see “Sharing and service providers” below). Google only if you use Google sign-in.
Kept until: You delete your account.
Your controls: Edit your details in Settings, including removing your picture. Change your password (this signs out every session). Delete your account at Settings → Account.

Your profile: school, program, year and bio

What: Anything you choose to add to your profile: your school, your program, your year of study and a short bio. School and program are picked from our lists (Canadian universities and Statistics Canada’s fields of study); year is one you choose. If you pick a school and program while building your week before signing up, they are added to your profile when you save your setup, only where your profile doesn’t already have one.
Self-reported: Your school, program and year are what you tell us. StudySocial doesn’t check them with your school, doesn’t connect to your school account to confirm them, and doesn’t treat them as proof that you’re enrolled.
Why: So friends, and students at your school if you both choose, know who you are.
Required?: No. A field you leave empty isn’t shown.
Who can see it: Your school, program, year and bio: you, your friends, and students at your school who also turned on school matching. Your schedule, classes, contact links, friends and coursework are never shown because you’re at the same school.
Kept until: You change or clear it, or delete your account. If you picked your school and program while building your week before signing up, the setup receipt also keeps them until you delete your account.
Your controls: Change or clear any of it at any time in Settings. Clearing your school also turns school matching off.

Students at your school (school matching)

What: If you turn on school matching, other students at the same school who also turned it on can see your name, picture, program, year of study and bio, and can ask to be your friend. You see them the same way. Each student card also shows how many of your friends are friends with that student too (“campus mutuals”): only friends who also turned on school matching at the same school count, pending requests, people added by hand and anyone involved in a block never count, and it is only ever a number, never names, pictures or other details of those friends.
Required?: No. Off by default. Nothing about your school is shown to students you aren’t friends with until you turn it on, and turning it off hides you again right away and stops you counting toward anyone’s campus mutuals.
Who isn’t included: Anyone you’ve blocked or who has blocked you, and people a student added by hand who don’t have their own account.
What it never shares: Your schedule or free time, classes, contact links, assignments or files, or who your friends are. “At the same school” means you both picked the same school name; it isn’t a verified affiliation.
Your controls: Turn school matching on or off at Settings → School.

Contact links

What: Links to your LinkedIn and Instagram, if you add them. Links are what you typed; StudySocial doesn’t check that the accounts are yours. Phone numbers and text messaging aren’t offered.
Who can see it: Your friends, for each link you leave visible to friends. You can make any link visible only to you.
Kept until: You change or remove it, or delete your account.

Privacy settings

What: Three switches: whether friends can see your schedule, whether they see class details or just “Busy”, and whether people can find you by username.
Why: So the app knows what you have chosen to show.
Required?: They always have a value, but you pick it.
Who can see it: Only you.
Shared with: Nobody beyond the providers that run the app.
Kept until: You change them or delete your account.
Your controls: Change them any time at Settings → Privacy.

Classes and schedule

What: Class names, course codes, professor, the room or location text you type, a colour, and each meeting’s day, time and kind (lecture, lab, and so on).
Why: To draw your timetable and, when you allow it, show friends when you are free.
Required?: No. You can use StudySocial without adding classes, but there is not much to see.
Who can see it: Friends see class names, meeting times and room text on your schedule when sharing is on. If you turn details sharing off, they only see “Busy”. If schedule sharing is off, they see nothing.
Shared with: Nobody beyond the providers that run the app. If you import a schedule from a picture, the picture is read on your own device and never uploaded (see “Sharing and service providers”).
Kept until: You delete the class, which removes it immediately, or delete your account.
Your controls: Edit or delete classes in the app. Control who sees them at Settings → Privacy.

Commitments

What: One-off or repeating events: a title, start and end times, location text, and whether you marked it private.
Why: To block off time on your schedule and show friends when you are busy.
Required?: No.
Who can see it: Friends see the title and location when schedule sharing is on, unless the commitment is private. Private commitments show as “Busy” only. The redaction happens on the server, so the details are not sent to friends at all.
Shared with: Nobody beyond the providers that run the app.
Kept until: You delete the commitment, which removes it immediately, or delete your account.
Your controls: Mark any commitment private. Edit or delete it in the app.

Friends, requests, invite link, groups, and how you arrange friends

What: Who you are friends with, pending friend requests, your personal invite code, any friend groups you make, and how you order or hide friends in your list. A friend group can have one of our icons, or a small picture or drawing you add: your browser redraws it as a small square image (at most 192 × 192 pixels) and only that image is uploaded, never the original photo, and our server checks it and removes any hidden information inside it, such as location. A group picture is visible only to you, and it’s deleted when you replace or remove it, delete the group, or delete your account. You can also add a “managed person” who isn’t on StudySocial: a name plus the classes and commitments you type in for them.
Why: So you can see each other’s availability and keep your friend list tidy.
Required?: No. You can use StudySocial with no friends at all.
Who can see it: A friendship or request is visible to the two people involved, with one exception: on your profile, your friends can see which of their own friends you are also friends with (mutual friends), by name and picture. Anyone who opens your invite link sees your name and colour. Friend groups are visible only to you. How you arrange or hide friends is visible only to you. Managed people are visible only to you and can never sign in.
Shared with: Nobody beyond the providers that run the app.
Kept until: You remove the friend, delete the group or managed person, or delete your account. Removal is immediate.
Your controls: Accept, decline, remove or block anyone. Turn off username discovery at Settings → Privacy.

Assignments, notes, instructions and submission links

What: Each assignment’s title, due date, priority, your time estimate, your notes, whether it is done, any instructions (cleaned of scripts before storage), a submission link, and which part of the course it belongs to.
Why: To keep your work list and help you decide what to do next.
Required?: No.
Who can see it: Only you. Assignments are never shown to friends.
Shared with: Nobody beyond the providers that run the app.
Kept until: You delete the assignment, which removes it immediately, or delete your account.
Your controls: Edit or delete any assignment in the app.

Uploaded files, links, checklists and milestones

What: Files you attach to an assignment (up to 4 MB each, only allow-listed file types), links you save, checklist items, and milestones. The bytes of each file are stored in our database.
Why: So your study materials sit next to the work they belong to.
Required?: No.
Who can see it: Only you. Files are served only to their owner through a signed-in route.
Shared with: Nobody beyond the providers that run the app.
Kept until: You delete the material. The file bytes are deleted with it, immediately. Deleting your account deletes them all.
Your controls: Delete any file, link, checklist item or milestone in the app.

Class files

What: Files you drop into a class: the bytes, the file name, its type and size, the part of the class you filed it under, and the folder path it came from on your computer, kept as a label so you recognise it. Up to 25 MB a file, 300 files a class, and 500 MB in total across your account.
Why: So your course material lives in the app instead of in folders on one computer.
Required?: No.
Who can see it: Only you. Every download link is minted for you, expires, and is never shared.
Shared with: Supabase Storage holds the bytes (see “Sharing and service providers” below). Your folder names are stored as text and are never sent anywhere else.
Kept until: You delete the file or the class, or delete your account.
Your controls: Delete or re-file any file from the class page.

Your plan and your to-do list

What: Steps you plan for yourself: the words you write, the day you mean to do them, roughly how long you expect to spend, the class and part of the course they are about, the assignment they are for when there is one, and whether they are done. Plus your to-do list: its text, order, and whether each item is done.
Why: So the app can show what you meant to do this week or this month, next to the work that is actually due.
Required?: No.
Who can see it: Only you. Planning steps and to-dos are never shown to friends, and a step is never treated as a deadline set by your school.
Shared with: Nobody beyond the providers that run the app.
Kept until: You delete the step or item, which removes it immediately, or delete your account.
Your controls: Edit, move, tick off or delete any step or item in the app.

Group projects

What: A project you create or are invited to: its title, the class name you type, a due date, who is in it, the tasks and who they are assigned to, and a history of who did what. If you started the project from one of your own assignments, that link is kept privately and is never shown to the other members.
Why: So people working on the same thing can divide it up and see where it stands.
Required?: No. You have no group projects unless you make or accept one.
Who can see it: The people in that project, and nobody else. Someone invited but not yet joined sees only the project name and who is in it. Your own assignment behind the project is never shown to them.
Shared with: Nobody beyond the providers that run the app.
Kept until: The project is deleted, you leave it, or you delete your account.
Your controls: Leave a project, remove someone from one you own, or delete it.

Invites you send, and what you earn

What: Your referral code, who joined through it, whether each of those accounts has genuinely got going yet, and the cosmetic rewards you have earned, along with the theme, ring and badge you have chosen to show.
Why: So invites can be credited to you and so the app knows which cosmetics you own.
Required?: No. You do not have to invite anyone.
Who can see it: The theme, ring and badge you display are visible to people who can see you, the same as your name and picture. Who invited whom, and how many people you have brought in, is visible only to you.
Shared with: Nobody beyond the providers that run the app.
Kept until: You delete your account.
Your controls: Choose what to display, or display nothing. You do not have to share your code.

School connection

What: Which platform you connected (Brightspace, Canvas, Google Classroom, Blackboard, Moodle, Schoology, Sakai, or another that publishes a calendar link), your school’s web address, a label you choose, an encrypted secret (your calendar link, or Brightspace access tokens), and the sync status including any error messages.
Why: So StudySocial can fetch your assignments from your school when you ask it to.
Required?: No. School connections are off unless you set one up.
Who can see it: Only you. The secret is never shown to anyone, including you, after you save it.
Shared with: Your school’s server receives the request to read your calendar or API. Nobody else beyond the providers that run the app.
Kept until: You disconnect, which deletes the connection and its secret immediately, or delete your account.
Your controls: Disconnect at any time from School connections on the Settings page. Details in School Integrations & School Data.

Imported school data

What: Course names and codes, assignment titles, descriptions (cleaned before storage), due dates, points, links, and attachment file names and sizes, as sent by your school. Where your school publishes the shape of the course — its modules, units or weeks — those are kept as parts of the class, with the period they cover and never a due date of their own.
Why: So your school deadlines appear in your work list without retyping them.
Required?: No. Only present if you connect a school.
Does it join your work automatically?: No. What a sync finds waits for you under “New from your school”, and you decide what to keep and which class it belongs to. You can switch a connection to add new dated work automatically in Settings.
Who can see it: Only you.
Shared with: Nobody beyond the providers that run the app.
Kept until: You disconnect the provider, which deletes everything imported. Items you added to your own work list are kept as your own assignments.
Your controls: Disconnect from School connections on the Settings page.

Safety records

What: Reports you make (a reason, an optional description, who you reported, when, and the status), people you block, and consent records showing which version of each policy you accepted and when.
Why: So the operator can review problems, so blocked people stay blocked, and so we can show which policy you agreed to.
Required?: Consent records are created when you accept a policy. Reports and blocks only exist if you make them.
Who can see it: Blocks: only you. The blocked person is not told. Reports: you see the status of your own reports; the operator reviews them. Consent records: you and the operator.
Shared with: Nobody beyond the providers that run the app.
Kept until: Blocks are deleted with your account. Reports are kept after either account is deleted so abuse can still be acted on; they keep the reported username and reason. Consent records are kept after account deletion but lose their link to you.
Your controls: Manage blocks at Settings → Safety. Learn more in the Safety Center.

Contact messages

What: Whatever you write in the contact form.
Why: So the operator can read and act on it.
Required?: No.
Who can see it: The operator.
Shared with: Nobody beyond the providers that run the app.
Kept until: Not defined yet, see the review note below.
Your controls: Use the contact form to ask about a message you sent.

Technical information

What: Standard server request logs kept by Vercel: your IP address, browser (user agent), the URL requested, and timing. One session cookie that keeps you signed in. Two short-lived cookies used only while a sign-in is in progress, and one that remembers an invite code until you finish signing up. A handful of small values in your browser’s localStorage: Light or Dark appearance, whether the sidebar is collapsed, a running focus timer (what you are working on, its class, and your account ID) and where you dragged it, the friends you last picked in Who’s free (their account IDs and yours), the school address you last typed, which parts of a class you left open, and the weekly times you saved as “usual” when pinging particular friends (their account IDs, a weekday and a time). The values tied to your account are only ever shown back to you: if someone else signs in on the same browser they are deleted, and signing out or deleting your account deletes them too.
Why: Logs let the hosting provider run and troubleshoot the service. The session cookie keeps you signed in. Browser storage remembers device preferences. If you build your week before signing up, an ss_week_draft cookie and a matching studysocial_week_draft_v1 browser entry keep your choices for up to 7 days on that browser: your priorities, your progress, your school and program if you picked them, and an optional study time. When you sign in or create your account with a finished setup, it is saved to your account automatically: your priorities are stored on your account, a private calendar block is created if you chose one, and your school and program are added to your profile where it doesn’t already have them. A receipt prevents the same setup from being saved twice; it keeps the priorities, and the school and program you picked during setup, until you delete your account, even if you later change your profile.
Required?: The session cookie is required to stay signed in. The week-setup draft is optional and used only when you choose to build a setup. Hosting logs are part of operating the web server.
Who can see it: Request logs: Vercel, for operations. Cookies: your browser and StudySocial’s server. Every cookie, including the optional ss_week_draft setup draft, is sent to StudySocial’s server with each request to the site while it exists; the server doesn’t read or keep the draft cookie, and your setup is saved only when you sign in or create your account with a finished setup. The setup draft can also be read by this site’s own scripts. Other browser storage stays in your browser.
Shared with: Vercel, as the host.
Kept until: The session cookie lasts 30 days or until you sign out. Sign-in cookies expire after 10 minutes, and the invite-code cookie after 7 days. The optional week-setup draft is accepted for 7 days from when you started it, and is cleared when your setup is saved or when you reset it; if you never come back, your browser keeps the expired entry until you clear site data, and StudySocial ignores it. Saved priorities and the setup receipt stay with your account until you delete it. Logs follow Vercel’s own retention. The browser values tied to your account (the focus timer, your Who’s free pick and your saved Ping usual times) are deleted when you sign out, delete your account, or someone else signs in on the same browser; other browser values stay until you clear your browser data.
Your controls: Sign out, or clear site data in your browser. Details in Cookies & Tracking.

Sign-in with Google

What: If you choose “Continue with Google”, Google tells StudySocial your Google account id, your email, whether that email is verified, and your display name.
Why: To sign you in without a StudySocial password.
Required?: No. It is optional, and only offered when the deployment has Google sign-in configured. Right now it is not configured, and the button says so.
Who can see it: Your Google account id: nobody, it stays on the server. Your name and email: as for account details above.
Shared with: Google receives the sign-in request when you use it. Google’s own privacy policy covers what Google does with that.
Kept until: You delete your account.
Your controls: Choose an email and password sign-up instead.

3.How we use your information

We use what you give us for these purposes and nothing else:

To run the app: sign you in, draw your schedule, keep your work list, and store your materials.
To show your friends your availability, when you have turned sharing on.
To import school data you have chosen to connect.
To run group projects you create or join, and to show the people in them who is doing what.
To credit an invite to the person who sent it, and to unlock the cosmetics that go with it.
To review safety reports and contact messages you send.
To keep the service secure, for example by checking that you own the data you ask for.

We do not use your information for advertising, we do not build profiles of you, and we do not sell it to anyone.

4.Who can see what

The key rule: your assignments, notes, files, plan, email address and school data are never visible to other users. Not to friends, not to anyone. The things another person can see are your name, username, colour, picture and the badge you display; your school, program, year and bio for friends and, if you both turn on school matching, students at your school (with a count of friends in common, never names); the LinkedIn and Instagram links you leave visible to friends; and, for friends, which of their friends you are also friends with, and, if you turn sharing on, your schedule. The one exception you create yourself is a group project: the people in it see the project, its tasks and who did what, and nothing else about you.

The Student & Youth Privacy page walks through exactly what a friend, a stranger with your invite link, and someone searching your username can each see.

5.How friends and discovery work

Username requests. Anyone can send a friend request to your exact username, unless you turn off “discoverable” at Settings → Privacy. Turning it off means people need your invite link to find you.
Invite links. Your invite link shows your name and colour to anyone who opens it, whether or not they have an account. Share it with people you actually want to add.
Requests and friendships are visible only to the two people involved. Nothing about your schedule is shown until a request is accepted and your sharing is on.
Students at your school. If you turn on school matching, students at the same school who also turned it on can see your name, picture, program, year and bio, ask to be friends, and see how many friends you have in common (a number, never names). It’s off by default; turn it off any time at Settings → School.
Blocking. You can block anyone. The blocked person is not told. Manage blocks at Settings → Safety.

7.School integrations

Connecting your school is optional and off by default. StudySocial reads the calendar link your school platform gives you — Brightspace, Canvas, Google Classroom, Blackboard, Moodle, Schoology, Sakai or another that publishes one — or, if your school has issued StudySocial an OAuth client, calls the Brightspace API to fetch your courses, assignment folders and quizzes. It only performs read operations. It never writes anything back, never submits work, never sees grades, and never tells your school you use StudySocial. Nothing a sync finds joins your work until you choose it. Disconnecting deletes the connection, its secret and everything imported.

The full detail, including how often syncs happen, is in School Integrations & School Data.

8.AI

StudySocial has no AI features and sends none of your information to AI providers. The few things that feel automatic, like the order of your work list, are simple rules based on due date, priority and your own time estimate. If that ever changes, we will update the AI Disclosure and this policy first, and ask you before anything is sent to an AI provider.

9.Analytics and tracking

None. StudySocial uses no analytics, no advertising, no tracking pixels, no third-party cookies, and no error-monitoring SDKs. The only cookies are the ones that sign you in, described in Cookies & Tracking.

10.Security

We take reasonable measures to protect your information. In plain words:

Every read and write on the server checks that the signed-in user owns the data, or is an accepted friend with sharing turned on. Private items are removed on the server before anything is sent.
Passwords are stored as scrypt hashes, never as plain text.
School secrets (feed links and tokens) are encrypted at rest with a server-side key.
Uploaded files are limited to allow-listed types and served with headers that stop browsers from guessing their type or caching them. Class files are stored in a private bucket that is never public: every upload and download goes through a short-lived link the server mints for you after checking that the file is yours.
A school address you give us is fetched over https only, and never from an address inside a private network.
Content that arrives from schools is cleaned of scripts before it is stored.
The app sends security headers that prevent it being embedded in other sites and limit what referrer information leaves the page.

No online service can promise perfect security, and we do not. If you think something is wrong, tell us through the contact form.

11.How long we keep things

Your data stays for as long as your account exists.
When you delete an item (an assignment, class, commitment, material, class file, planning step, to-do, friend, group or managed person), it is deleted immediately. File bytes go with it.
When you disconnect a school, the connection, its secret and everything imported from it are deleted immediately. Assignments already on your own work list stay as your own until you delete them.
Server request logs are kept by Vercel, outside our database, and follow Vercel’s retention.
Safety reports are kept after account deletion so abuse can still be acted on. Consent records are kept but lose their link to your account.

12.Deleting your account

You can delete your account at any time at Settings → Account. When you do, this happens immediately:

Your user record and everything it owns are deleted: classes, commitments, assignments, materials and their file bytes, class files, planning steps and to-dos, school connections and imported data, group projects you own, friend groups, and managed people.
Your sessions are ended everywhere, so you are signed out on every device.
Your blocks, friend links and invite code are deleted.
Your consent records lose their link to your account.
Safety reports about you or by you keep the reported username and reason, so the operator can still act on abuse.
Backup copies the operator may have taken are not edited.

There is no recovery once you confirm. If you might want to come back, download or copy anything you need first.

13.Your choices

See and edit everything. All of your data is visible and editable inside the app. There is no hidden profile.
Control sharing. Turn schedule sharing, details sharing and discoverability on or off at Settings → Privacy. Mark any commitment private.
Delete anything. Delete individual items in the app, or your whole account at Settings → Account.
Ask for a copy. There is no automatic export yet. If you want a copy of your data, ask through the contact form.

14.If you are outside the United States

StudySocial’s database is stored in the United States, and the app may be processed wherever Vercel runs its infrastructure. If you use StudySocial from outside the United States, including from Canada, your information is transferred to and stored there. By using StudySocial you accept that transfer.

15.Children and minors

StudySocial is built for students. Today the product has no age gate and does not ask for your age or date of birth. A minimum age is a launch decision that has not been made yet.

If you are a parent or guardian and have a question about a young person’s account, write to us through the contact form.

16.Changes to this policy

Each version of this policy is identified by its date. If we make a material change, we publish a new version and the app asks you to accept it before you continue. Your earlier acceptance records are kept as they were; they are never rewritten.

17.Contact

Questions, requests or concerns about privacy: use the contact form. Messages go straight to the operator.

Questions about this document? Contact StudySocial.