Last updated: April 5, 2026

1. Information We Collect

We collect the following categories of information:

(a) Account Information: name, email address, password (encrypted), date of birth, selected edition (School Age, College Years, or Careers), and profile details such as grade level, school, college, employer, and bio.

(b) User-Uploaded Content: images of study materials that you capture or upload for quiz generation, including compressed and processed versions of those images.

(c) AI Interaction Data: text extracted from your images by AI, AI-generated quizzes, counselor chat messages and responses, and quiz performance results.

(d) Usage Data: feature usage counts (image captures, counselor messages), daily and monthly usage metrics, quiz completion rates, study activity, and app interaction patterns.

(e) Transaction Data: subscription plan details, ad purchase history, payment amounts, and transaction timestamps.

(f) Technical Data: device information, platform (iOS, Android, Web), app version, and local storage preferences such as theme settings.

(g) Cached Data: cryptographic hashes (SHA-256) of compressed images combined with your plan type, cached AI analysis results, and cache expiration timestamps.

(h) Parental Verification Data: parent/guardian email addresses and verification code timestamps for School Age Edition accounts.

(i) Date of Birth Data: your date of birth as provided during registration. This data is stored permanently on your account, displayed on your profile, and cannot be edited after registration. For the School Age Edition, your date of birth is used to calculate your age and determine ongoing eligibility for the edition.

(j) Progress Report Recipient Data: for College Years and Careers edition Pro subscribers, email addresses entered by the user for the purpose of sending progress report emails. These addresses are used solely to deliver the requested report and are not stored permanently or used for marketing.

2. How We Use Your Information

We use your information to: provide and maintain the App and all its features; process and compress uploaded images for AI analysis; generate quizzes from extracted study material; provide AI counselor chat responses; personalize reminder timing and reminder persona wording; enforce usage limits and plan entitlements based on your subscription plan or administrator-granted access status; operate Sparring Partners & Battles, including friend codes, partner requests, battle invitations, answer submissions, score submissions, result displays, and battle history views; process transactions and manage subscriptions via RevenueCat and app stores; honor complimentary or free-access account flags where applicable; display user-purchased banner advertisements to users within the same edition; send push notifications for scheduled quizzes, study reminders, and battles; cache image analysis results to improve performance and reduce redundant AI processing; verify parental consent for School Age Edition users; calculate user age from date of birth to enforce edition eligibility requirements and automatically disable access when age limits are exceeded; send progress report emails to parent/guardian email addresses (School Age Edition) or user-specified email addresses (College Years and Careers editions); personalize your experience and deliver relevant content; analyze usage patterns to improve the App; and comply with legal obligations.

3. AI Data Processing

When you use AI-powered features, your data is processed as follows:

Image Capture: uploaded images are compressed (resized to max 1280px, converted to JPEG at ~75% quality), then sent to third-party AI services (OpenAI) for text extraction and content validation. A SHA-256 hash of the compressed image combined with your plan type is generated and stored for caching purposes.

Quiz Generation: extracted text is sent to AI services to generate quiz questions. The number of questions and output token limits vary by plan (Starter: ~700-900 tokens, up to 7 questions; Pro: ~1000-1300 tokens, up to 10 questions).

AI Counselor: your chat messages are sent to AI services (Rork AI Toolkit) to generate educational guidance responses. Conversation context is maintained during your session.

We do not use your uploaded images or AI interactions to train AI models. However, third-party AI providers may have their own data handling practices, which are governed by their respective privacy policies.

4. Image Caching & Storage

To improve performance and reduce costs, we cache the results of AI image analysis. Cache entries include the image hash, your plan type, the AI analysis result (accepted/rejected status, extracted text), and an expiration timestamp. Successful analysis results are cached for up to 30 days. Rejected image results are cached for up to 2 hours. Cached data is stored in our Supabase database and is automatically purged after expiration. We do not store the original or compressed image files on our servers beyond the duration needed for immediate AI processing.

5. Children’s Privacy (COPPA Compliance)

We take children’s privacy seriously and comply with the Children’s Online Privacy Protection Act (COPPA). For users under 13 using the School Age Edition: (a) we require verifiable parental consent via email verification before granting access; (b) verification codes are sent to the parent’s email and expire after 10 minutes; (c) we collect only the minimum information necessary to provide the service, including date of birth to verify age eligibility; (d) we do not serve targeted or behavioral advertising to children; (e) parents and guardians can review, update, or delete their child’s information at any time by contacting us; (f) we do not knowingly collect personal information from children under 13 without parental consent; (g) if we discover that we have collected information from a child under 13 without proper consent, we will promptly delete that information; and (h) access to the School Age Edition is automatically disabled when a user’s age (calculated from their registered date of birth) exceeds the maximum allowable age, ensuring age-appropriate content and compliance.

6. Advertising & Banner Ad Data

When users purchase banner ads, we collect and store: the achievement text, optional image, target grade level, scheduled display date, purchaser identity, and payment information. Purchased ads are displayed to all users registered to the same edition on the scheduled date. We collect reaction data (emoji reactions and counts) from users who interact with displayed ads. This reaction data is visible to the ad purchaser in their transaction history. Ad content is reviewed before display but Study Bully does not guarantee the accuracy of user-submitted achievement claims.

6A. Reminder Persona, Sparring Partner & Battle Data

We collect reminder settings and interaction data, including quiz schedules, selected reminder persona, snooze activity, and notification preferences, to deliver personalized study reminders. If you use Pro-only Sparring Partners & Battles features, we also collect and store friend codes, incoming and outgoing partner requests, accepted partner relationships, battle invitations, quiz identifiers, participant lists, submitted answers, answer correctness data, submitted scores, win-loss-tie records, battle outcomes, and related timestamps or activity logs. We use this information to operate multiplayer quiz features, display battle activity and history to participants, enforce plan entitlements, prevent abuse, and troubleshoot feature issues.

6B. Subscription Status & Free Access Records

We maintain records about your current plan, entitlement status, billing provider, and whether your account has been granted complimentary, promotional, or administrator-approved free access. We use this information to determine feature availability, prevent duplicate charging where appropriate, support customer service, investigate billing disputes, and enforce plan rules.

7. Data Sharing & Disclosure

We do not sell your personal information. We may share your information with:

(a) AI Service Providers: OpenAI and Rork AI Toolkit receive your uploaded image data and text prompts to provide quiz generation and counselor features.

(b) Payment Processors: RevenueCat, Apple App Store, and Google Play Store process subscription and ad purchase transactions.

(c) Cloud Infrastructure: Supabase provides database hosting, authentication, and data storage services.

(d) Email Services: Resend delivers parental verification emails and progress report emails to parents/guardians and user-specified recipients.

(e) Other Users: if you use banner ads, Sparring Partners, or battles, limited profile and activity data such as your display name, friend code status, battle invitations, participant status, quiz titles, submitted answers, answer correctness, scores, wins, losses, ties, battle history, results, and ad content may be visible to the other users involved in that interaction. Your email address and payment information are not shared with other users unless you include them in submitted content.

(f) Law Enforcement: when required by law, legal process, or to protect our rights, safety, or property.

Each third-party service has its own privacy policy, and we encourage you to review them.

8. Data Storage & Security

We implement industry-standard security measures to protect your information, including: encryption of data in transit (TLS/SSL) and at rest; secure password hashing; row-level security policies on our database; secure API authentication; and encrypted local storage for sensitive tokens. Your data is stored on secure Supabase servers. Image data is processed in memory and not permanently stored on our servers beyond caching as described. While we strive to protect your information, no method of electronic storage is 100% secure, and we cannot guarantee absolute security.

9. Your Rights

Depending on your location, you may have the right to: access and receive a copy of your personal data; correct inaccurate personal data; request deletion of your personal data (including cached image hashes and usage records); object to or restrict processing of your data; data portability; withdraw consent at any time; and opt out of push notifications. To exercise these rights, contact us at studybullysupport@ndstriistudios.com. We will respond to verified requests within 30 days.

10. Cookies, Local Storage & Tracking

We use local storage (AsyncStorage) and similar technologies to maintain your authentication state, theme preferences (light/dark mode), reminder persona preferences, app settings, and session data. We track feature usage in our database, including capture counts, counselor message counts, quiz and schedule activity, reminder interactions, and battle activity, to enforce plan limits, operate premium features, and improve product reliability. We may use analytics tools to understand aggregate App usage patterns. You can manage notification preferences through your device settings and theme preferences through the App’s settings.

11. Data Retention

We retain your personal information for as long as your account is active or as needed to provide services. Specific retention periods: (a) account data, including date of birth, is retained while your account is active; (b) cached image analysis results are retained for up to 30 days (accepted) or 2 hours (rejected); (c) usage tracking data, reminder settings, and battle activity logs are retained for the applicable billing period or for as long as needed to operate the related feature; (d) friend codes and Sparring Partner relationships are retained while those features remain active on your account; (e) transaction records and entitlement history, including complimentary or administrator-approved free-access records, are retained for legal, accounting, fraud-prevention, and support purposes; (f) parental verification records are retained while the child’s account is active; and (g) progress report recipient email addresses (for College Years and Careers editions) are used only for the immediate delivery of the report and are not stored permanently. If you cancel your subscription or delete your account, we will retain your data for a reasonable period (up to 90 days) to allow for reactivation, after which it will be securely deleted. Some data may be retained longer if required by law.

12. International Data Transfers

Your data may be transferred to and processed in countries other than your own, including the United States, where our service providers operate. By using the App, you consent to such transfers. We ensure that appropriate safeguards are in place for international data transfers in compliance with applicable data protection laws.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy within the App. Your continued use of the App after changes are posted constitutes your acceptance of the updated policy. We encourage you to review this policy periodically.

14. Contact Us

If you have questions or concerns about this Privacy Policy, wish to exercise your data rights, or need to report a privacy concern, please contact us at studybullysupport@ndstriistudios.com.

If you want, I can also format both into clean HTML for your website.