Legal

Privacy Policy

Version 2026-10-23. This policy describes our practices for users in different countries. Mandatory rights under applicable local privacy laws remain protected.

1. Who we are and what this policy covers

NodeStudy is an AI-powered study tutor. This policy explains what personal data we collect, why, how we protect it, how long we keep it, who we share it with, and what rights you have over it. It covers all personal data processed through the NodeStudy service, regardless of your location.

2. What we collect

Account data When you create an account we collect your email address. You may optionally provide a display name and time zone. If you use Google Sign-In, we also receive your Google identity (a stable identifier, your Google-side email, name, and profile photo). We record the version of these terms you accepted and the date you accepted them. We also ask your date of birth, when you create the account or the first time the app asks, and use it for three things only: to apply the minimum age in the Terms, to choose which AI providers may answer you, because one provider's terms serve only people 18 and older (section 9), and to offer the advertising measurement choice below only to adults. We do not verify it and do not show it to anyone; to correct it, contact us. When you create an account after arriving through a link that names a campaign (the utm_source, utm_medium, utm_campaign and utm_content labels an ad or a shared link carries, which the site keeps in that browser tab until then), we record those labels with the account, and whether the link carried an advertising platform's click identifier, to count how many accounts and subscriptions each campaign brought. The identifier itself is not stored in your browser.

Advertising measurement (optional, adults only) If you arrived from a Google ad, the sign-up form may offer a separate box, unticked unless you tick it: "let NodeStudy tell Google Ads that the ad I clicked led to this account". We offer it only when the date of birth you state on that form makes you 18 or older, and only on the sign-up with a password; an account created with an e-mailed code or with Google, whose age we do not know at that moment, never has its identifier kept. Accepting these terms is not this choice, and not ticking it changes nothing about your account or your study. If you tick it, we keep Google's click identifier of that ad with a record of your choice (its purpose, the version of this notice and the time) for 30 days, and use it only to tell Google Ads that the click led to your account, to a trial you used or to a first payment, so that we spend on the ads that work (section 4). You can withdraw at any time under Settings, Data and privacy: the identifier is deleted at once and is in no later report. It is also deleted when the 30 days end or when you delete your account. Your conversations, materials, recordings, scores, e-mail address and date of birth are never part of it, and the identifier of any other advertising platform is never kept. Notice version 2026-10-23.

Study content We store the materials you upload, your conversations with the tutor, tasks, study plans, exam dates and results, flashcards, review history, error notes, handouts, practice-quiz results, and any feedback you submit on tutor responses. We do not detect or specially handle sensitive personal data in the material you upload, such as health data, so do not upload material that identifies a patient or any other third party (name, medical record, ID document, face). The one exception is in the chat: every message you type to the tutor is read, on our own server, by fixed rules that look for statements suggesting a risk of self-harm, and when one matches, the answer opens with how to reach CVV (188), Brazil's free emotional-support line. No record of the check or its result is kept, nothing about it is sent to any third party, and no one is notified (see section 3).

What the tutor remembers about you For an account, the tutor can save short notes from what you tell it, such as exam dates, preferences, constraints, goals and personal context, to use in later conversations. Notes may apply to one course or all your courses. We keep the note, its kind, when it was said and, where available, its source conversation and an expiry date. Earlier wordings of a revised note are also stored. Relevant notes are included in the context sent to the AI provider answering you. Settings, Data and privacy lists these notes and lets you remove one or all of them, including their earlier wordings. The retention table below explains expiry and conversation deletion.

Using NodeStudy without an account (visitors) You can ask the tutor questions without creating an account. To do that, your browser is issued a random session identifier, which is kept in your browser's local storage and sent with each question. On our side a session stores that identifier, the network (IP) address it was created from — used only to limit how many sessions one address may open — and, if you attach a file, the file and its search index. The tutor's working memory for the conversation is kept under that session. A session, everything attached to it, and that working memory expire and are deleted within 24 hours, unless you create an account in the meantime and choose to keep the files, in which case they move into your account. The questions and answers themselves are stored in your browser, not in your account (you have none yet). Each session allows a limited number of questions, and each network address a limited number of sessions per day; the limits are shown in the app when you reach them.

Usage telemetry We record per-turn technical metrics (AI model used, latency, token counts, estimated cost) to operate, monitor, and improve the service. For a visitor's question these rows carry the session identifier and a flag saying no account asked; they never carry the question or the answer. We also record a small set of product events (for example "a question was asked", "a file was uploaded", "a citation was opened") with an account or visitor-session identifier, a coarse screen-size class and, for some events, touch or mouse and whether the browser is embedded in another app. We use these events to compare how devices reach study results.

Where the browser supports it, we also send one performance report per app page load when the page first becomes hidden or closes. It contains page-load and interaction-response timings (LCP and INP in whole milliseconds), unexpected layout shifts (CLS multiplied by 1000), a coarse screen-size class and the area the app initially opened on, such as chat, planner or settings. A signed-in account is linked through authentication when the report is sent. The report contains no full URL or path, raw browser user-agent string, questions or answers. Moving between app views does not send another performance report or a navigation history. We use the reports to find slow or unstable app experiences; we do not use advertising trackers or fingerprinting.

Our hosting edge (Cloudflare) additionally counts requests by country and device class in aggregate. Local browser storage is used to keep you signed in, to remember UI preferences and, for visitors, to hold the session identifier and the conversations you have on this device.

Billing data (paid plans) If you subscribe, the payment provider identified at checkout (Stripe; Paddle or Asaas when enabled) processes your payment. We exchange account and checkout references, email, selected plan and billing intent, and receive subscription and payment identifiers, status and billing events. We do not store your payment card details.

Referral offers (optional) If you use a referral offer, we store campaign and account identifiers, the link's verification hash, creation and expiry dates, eligibility and redemption status, and payment, subscription, discount and checkout references. The browser keeps the referral code in session storage to carry it into checkout and removes it from the address fragment after capture. The person sharing a link can see aggregate used/remaining places and expiry, not recipients' names, emails, study content or payment details. Paddle receives the redemption reference needed to apply and reconcile the discount. We use these records to administer the offer and prevent duplicate or abusive claims.

Google Calendar (optional) If you connect Google Calendar in the Planner, we ask Google for one Calendar permission (calendar.events.owned), which covers events on calendars you own. We use it for two things, both inside your Planner.

First, keeping your study plan on your calendar. NodeStudy creates an event on your primary calendar for each study task, exam date and flashcard review, with its title and a short description: a session with a start time becomes a timed event shown as busy, anything else an all-day event shown as free. We update or remove that event when the item changes here. From the events we created we take back two things: a new date or time when you move one, which becomes the date or time of the matching item in your Planner and is treated like any you set yourself (including when you ask the tutor about your plan), and the fact that you deleted one, so we do not put it back.

Second, planning around the rest of your day. We read the other events on your primary calendar, from a week ago to about four months ahead (further, up to about a year, when you browse that far in NodeStudy's calendar): each event's title, location, start and end time, whether it counts as busy (Google's free/busy setting, and whether you declined it) and its link in Google Calendar. We use them to show your events, read-only, in NodeStudy's calendar, and to place study sessions only where your day is free, moving a session when a new event lands on it. Planning uses only the start and end times. The titles and locations are shown to you and to no one else, and are never sent to an AI model or to any other third party. We refresh this copy when you open the calendar and when your plan syncs, and each refresh replaces the previous copy.

We keep your Google OAuth tokens encrypted, the identifier, date and time of each event we created, the time of the last sync, and the copy of your calendar events described above. Disconnecting Calendar in Settings deletes the events NodeStudy created, revokes our access at Google and erases those tokens, those records and the copy of your events. Deleting your account does the same. You can also remove our access at any time from your Google Account.

NodeStudy's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, use it for advertising, or use it to develop, improve or train AI or machine learning models. No one at NodeStudy reads it unless you ask us to, it is needed for security or to comply with the law, or it is aggregated for operating the service.

GitHub (optional) If you connect GitHub, an encrypted access token is stored so the tutor can read — and, when you ask it to, change — files in the repositories you authorize. Repository content you point it at is sent to the AI model answering that question, the same as any other material you give it. You can disconnect GitHub at any time from Settings, which deletes the stored token.

Push notifications (optional) If you enable study reminders, your browser's push subscription endpoint is stored to deliver them. You can disable reminders at any time from Settings. Delivery goes through the push service your own browser vendor operates (for example Google, Mozilla, or Apple), which necessarily sees that endpoint.

3. How we use your data

Your content is never used to train AI models. We reach every provider through its paid, commercial API, whose terms exclude training on customer content — this is a different arrangement from the same companies' free consumer or free-tier products, several of which do train on what you submit. Where a provider offers both, we pay for the tier that does not.

What we do with your feedback, precisely. When you rate an answer down and say what was wrong, that pair — your question and your comment — is what tells us the tutor has a problem worth fixing. We turn some of those pairs into test cases that we re-run against the tutor, so that a fix stays fixed. From a rated answer we take only the question, your comment, and which model, specialty and prompt version produced it; we do not take the answer text, your account id, or the conversation it came from. Before a case is stored it is checked for personal data and rejected if it carries any. This is quality testing of our own service and it is not model training, which we do not do.

4. Third parties who receive your data

We do not sell your data, and we never make your materials available to another user.

Your uploaded study content leaves NodeStudy in three situations, and only these: the AI provider that answers a specific question of yours receives the passages relevant to it; OpenAI receives file text in order to build and search your private index; and, where reranking is enabled, the reranking provider receives candidate passages in order to order them. Rows above marked "if enabled" describe optional components that a given deployment may not run at all.

5. Data retention

Retention at our AI providers is separate from ours and set by them. Deleting your account removes your content from NodeStudy, but a provider that already received a message in order to answer it may keep its own short-term copy under its own terms — for OpenAI, abuse-monitoring logs retained up to 30 days; for Google's paid tier, logs kept for a limited period solely to detect abuse. These providers do not use that content to train their models (see section 3).

6. Your privacy rights

The tools described below are available regardless of your interface language. Additional statutory rights and their conditions depend on the laws applicable to the processing, including Brazil's LGPD, the EU GDPR, UK GDPR and relevant national or state privacy laws. We do not treat choosing English, paying in a foreign currency or accepting these terms as a waiver of those rights.

Where EU or UK data-protection law applies, you may also request restriction of processing, object to processing based on legitimate interests, withdraw consent without affecting prior lawful processing, and complain to the competent supervisory authority. Requests are handled within the applicable statutory deadlines; lawful extensions or refusals require the corresponding explanation. You do not have to exhaust our support process before contacting a supervisory authority.

Where a US state privacy law applies to us and to your request, its access, correction, deletion, portability, opt-out and appeal rights apply according to that law, including applicable protections against retaliation for exercising them. This statement does not claim that every state statute applies to every business or to every user.

The following tools are available directly in the app today:

• Access and portability (LGPD Art. 18 / GDPR Art. 20): Settings → export a ZIP of everything your account has stored: all study content, billing history, and uploaded files.
• Rectification (LGPD Art. 18 / GDPR Art. 16): Settings → edit your profile to correct your name or time zone. Contact us to correct your email address.
• Erasure (LGPD Art. 18 / GDPR Art. 17): Settings → delete account. This permanently and immediately deletes your uploaded files, vector search indexes, conversations, flashcards, tasks, plans, and all other study data. Security audit log entries (which do not contain your content, only event metadata) are retained separately and aged out on a defined schedule. Copies made before the deletion expire as section 5 says. Once the deletion markers of section 5 are enabled, a marker is kept for each deleted account so that a restored backup cannot bring the account back.
• Withdrawal of consent: disable push reminders or disconnect Google Calendar at any time from Settings.
• Review of automated decisions (LGPD Art. 20): some things here are decided automatically — which AI model answers a given question, how long a task is estimated to take and where it lands in your plan, how far apart the review schedule spaces a flashcard, and what your progress screens infer about a topic from your answers. These shape your study plan inside the app and decide nothing about you outside it. Each one can be changed or overridden in the app, and you can ask us to review any of them.

When the tutor is wrong about a person. The tutor writes by predicting text, so it can state something inaccurate about a real person, including you. We do not build or keep a profile of anyone from what it writes. If you find that NodeStudy has produced inaccurate personal data about you and you want it corrected, contact us with enough detail for us to reproduce it, and we will act as far as the technology allows — which may mean correcting our source material or constraining the tutor, rather than editing a past answer that was never stored as a record about you.

For any right not available in-app (such as objection to processing, restriction, or to reach the data-protection contact), write to support@nodestudy.com.

Privacy requests. Describe the right you want to exercise and provide enough information to locate the relevant account or record. Any identity verification must be proportionate to the request and the risk of disclosing data to the wrong person; do not send a password or a full payment-card number. The export and deletion controls in Settings remain available without sending a support email. For independent guidance or complaints, consult ANPD (Brazil), your EEA supervisory authority, or the ICO (United Kingdom), according to their competence and procedures. These authorities are independent of NodeStudy and do not provide our customer support.

7. Security

Passwords are stored hashed using bcrypt. Sessions use short-lived, signed JSON Web Tokens (access tokens expire after 30 minutes; refresh tokens after 7 days and rotate on use). OAuth tokens are encrypted at rest. Per-user namespace isolation is enforced on every data retrieval request. Data in transit is encrypted via HTTPS. Data at rest is stored on an encrypted volume.

No system is perfectly secure. Please report security vulnerabilities to support@nodestudy.com, the operator contact published on the service.

8. International data transfers

Our AI model providers and infrastructure providers process data outside Brazil. Where they process it:

Transfers require a valid mechanism under LGPD Art. 33 in addition to a legal basis for the processing itself. For backend processing and storage in the Netherlands, and EU-jurisdiction R2 backup storage when enabled, we rely on Art. 33, I and the adequacy recognized by ANPD Resolution 32/2026, within that decision's scope. For transfers to our AI model providers outside that scope, and for the access that the staff and systems of our infrastructure providers outside the European Union (the control planes and support of Fly.io and Cloudflare) have to what they host for us, the service relies on Art. 33, IX for transfers necessary to perform the service requested by you. That exception does not automatically cover every provider or every use: necessity must be assessed for each transfer, including auxiliary services. The European Union's recognition under ANPD Resolution 32/2026 applies within that decision's scope; using a provider with a European presence does not make all its transfers covered. European contractual clauses are not automatically a substitute for a mechanism recognized in Brazil. Stripe, our payment provider, and Google, for its Gemini models, incorporate the ANPD standard contractual clauses into their data processing terms, and for transfers to them we rely on those clauses (LGPD Art. 33, II, b). The other providers do not offer ANPD clauses; for them, and for the access that the staff and systems of our infrastructure providers outside the European Union have to what they host for us, we rely on Art. 33, IX, as described above. Requesting a service or accepting these terms is not a blanket authorization for transfers that lack a valid mechanism. You can request information about the recipients and safeguards through our privacy contact.

Sensitive data. We keep sensitive personal data out of the providers used for semantic reranking. Legitimate interest is not a basis for sensitive data under LGPD Art. 11, and the reranking provider's own contract puts sensitive data outside the scope it describes, so flows that may involve health or safety information are handled locally instead. Using a provider for one feature does not mean everything you write is sent to it.

Transfers subject to European or UK law. A Brazilian transfer basis does not by itself satisfy EU GDPR or UK GDPR transfer rules. Transfers and onward transfers covered by those regimes require a mechanism valid for the relevant jurisdiction, such as an applicable adequacy decision or valid contractual safeguards with required assessments and supplementary measures. EU standard clauses are not automatically a UK mechanism; a valid UK instrument may be required. Accepting this policy is not blanket consent to international transfers. Contact us for the safeguards applicable to a specific transfer; this policy does not certify that all providers or destinations are adequate.

Paddle, where it is the payment provider named at checkout, is different, and worth stating plainly: as our merchant of record it is the legal seller of that subscription, so for the payment relationship it acts on its own behalf rather than on ours, under its own privacy notice. A subscription bought through Stripe or Asaas is sold by us, and that provider processes the payment as our payment service provider.

We do not use any provider that publishes no data processing terms and no transfer mechanism. Our backend refuses to start if a model slot is pointed at one.

9. Children

This service is not directed at children under 13. We do not knowingly collect personal data from children under 13: a date of birth under 13 creates no account and is not stored. An account whose stated age is under 18, or that has not stated one, is never answered by a provider whose terms serve only adults (today Google's Gemini models); every other provider in the list may answer it. If you become aware that a child under 13 has provided us with data, please contact us so we can delete it. Local rules may require additional safeguards for adolescents. Where online-service processing relies on consent under EU law, the age at which a child can give that consent independently varies by country between 13 and 16; this is separate from contractual capacity. A statement in these terms does not replace legally required age or guardian checks.

10. Changes to this policy

We will announce material changes to this policy through the service before they take effect. Each version is dated. This policy provides information about processing; reading it or continuing to use the service does not, by itself, constitute consent to a new purpose or processing operation. Where consent is the applicable legal basis, we will request a separate, specific and informed choice before that processing begins, and you may withdraw it as provided by law.

Two things change at different speeds, so they are kept apart. This policy describes the categories of processing: what is sent, what is never sent, who may receive it and why, the commitments we make about training and location, and the rights you have. Changing any of that changes what you were told, so it moves this policy's version and is announced.

Which specific companies serve those categories is a fact about today rather than a promise, and it is published as a live list at subprocessors and purposes, which forms part of this policy. Replacing a provider with another one doing the same thing, to the same data, for the same purpose, updates that list without changing this policy or asking you to accept anything — because nothing you were told has changed. We publish the change on that list at least 30 days before a new recipient begins processing, and the list keeps a dated record of what changed and when, so you can see its history rather than having to trust that it is current.

What does not qualify. A new kind of processing — sending something this policy does not already describe, or sending it to a kind of recipient it does not already describe — is a change to this policy, not an entry on a list. It is versioned and announced like any other. The list exists so that routine vendor changes stop drowning out real ones; it is not a way to introduce a new purpose quietly. Your rights in section 6 apply either way, and if you would rather your data did not reach a recipient we add, you can export and delete your account at any time from Settings.

11. Contact and data-protection officer

For questions, data requests, or to exercise any of the rights above, write to support@nodestudy.com. A support contact, a data-protection officer and an EU or UK representative are distinct roles. Where a designation or representative is legally required, its identity and contact details must also be made available; these terms do not appoint one.