Student OS

1. Who We Are

This Privacy Policy explains how Dan Bokete, operating as Student OS (a sole trader) (“we”, “us”, “our”), the data controller, collects and processes your personal data when you use the Student OS application (the “App”). We are based in Ireland, and you can contact us about privacy matters at [email protected]. A postal address is available on request.

Student OS focuses on understanding study material through questions and feedback, and remembering it through flashcards and spaced repetition. This policy covers the material you provide, your answers, generated study content, and your study activity.

We process your data in accordance with the EU General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018.

2. What Data We Collect

Depending on how you use the App, we may collect:

• Account data: when you sign up, you authenticate through Google. We receive your name, email address, profile picture, and Google account identifier from Google. We do not collect or store a password — sign-in is handled via Google and our authentication provider, Better Auth.
• Study content: the material you upload or add, including PDFs, documents, slides, links, and notes; your flashcards; generated understanding questions and follow-up questions; the answers you submit; and the AI feedback and assessments saved with those answers. Uploaded files and answers may contain personal data you choose to include.
• Supporting content: subjects, tasks, boards, calendar entries, and deadlines you create, along with images and resource clips you add to your notes.
• Study activity data: your question attempts and progress, flashcard review history and ratings, review schedules, and records of study and focus sessions, including their timing, duration, and related material or subject. We use question attempts to show your understanding progress, and flashcard review history and ratings to schedule future reviews. Session records support time tracking and your study analytics.
• AI usage: server-side AI uses an application-funded OpenRouter key. We record operation identifiers, requested and delivered quantities, and provider costs to enforce allowances. Previously stored personal keys remain encrypted and unused during this rollout.
• Optional product analytics and diagnostic data: if you opt in to analytics, PostHog collects information about how you use the App. This can include page views, feature usage, button and link interactions, event timestamps, current and referring URLs, browser, operating system, device type, screen and viewport size, performance measurements, error messages, stack traces, and technical crash context. Automatically captured interactions record the type and position of the interface element involved, but the browser SDK is configured to mask element text and attributes, so the content of your notes, decks, cards, and boards is not sent. When you are signed in, we associate these events with your Student OS user ID and name so we can understand usage across sessions. Your IP address and browser headers reach PostHog in the ordinary course of transmitting data, but PostHog Cloud EU discards the client IP address on ingestion, so it is not stored against your analytics events.

Note: uploads and content may include personal data about you or others. You are responsible for ensuring you have a lawful basis to upload content concerning other people. The App is currently free to use and we do not collect payment information.

3. Signing In With Google

The only way to access the App is by signing in with your Google account. When you do, Google shares certain information with us — typically your name, email address, profile picture, and a unique Google account identifier. We use this solely to create and identify your account. We never receive your Google password, and we do not store one. Your use of Google Sign-In is also subject to Google’s own privacy policy. You can review the permissions you have granted in your Google account settings at any time.

4. AI Features

The App offers two kinds of AI feature, which handle your data differently: a browser-side hand-off and server-side generation. Both rely on third-party AI providers. AI output can be inaccurate or incomplete.

(a) “Explain with AI” hand-off. When you select text (for example, a passage from a PDF) and choose to have it explained, the App opens your own AI assistant — currently Claude, ChatGPT, or Perplexity, whichever you pick — in a new browser tab with the selected text prefilled as a prompt. This happens directly between your browser and the assistant you choose: for this feature we do not send your content to the provider ourselves, we do not receive the assistant’s responses, and the provider is not our sub-processor. The text is processed by that provider under its own privacy policy and terms, using your own account with them. Your choice of preferred assistant is stored locally in your browser, not on our servers.

(b) AI study questions, answer feedback, and flashcards. Within your plan’s allowance, you can ask the App to generate flashcards or understanding questions from your notes or study material, and to assess the answers you submit in your own words. Feedback may include an assessment of the key points you covered, guidance on gaps, and a follow-up question. These requests are processed through our servers: we send relevant source text and, for answer checks, the question, its key points, relevant source context, and your submitted answer to OpenRouter using the application’s key. We receive the generated questions, flashcards, assessments, or feedback and save them to your account. For these features, OpenRouter acts as our sub-processor (see section 6), and OpenRouter processes the data you send under its own privacy policy and terms. The application key is stored only on our servers.

5. How and Why We Use Your Data (Legal Bases)

We process your personal data on the following legal bases under Article 6 GDPR:

• Performance of a contract: to create and manage your account and provide study questions, answer assessments and feedback, flashcards, spaced repetition scheduling, and study progress. This also covers the supporting features you use, including uploads, notes, organisation tools, session tracking, and personal study analytics.
• Legitimate interests: to keep the App secure, prevent abuse, debug errors, and improve the service — balanced against your rights.
• Legal obligation: to comply with applicable laws, including responding to lawful requests.
• Consent: for optional PostHog product analytics, error monitoring, performance diagnostics, and the non-essential cookies and similar storage these features use. You can refuse without losing access to the App and withdraw consent at any time under Settings > Privacy.

6. Service Providers and Sub-Processors

We use trusted third-party providers to operate the App. Each processes personal data only on our instructions under a data processing agreement. Our current providers are:

7. International Data Transfers

Some of our providers process data outside the European Economic Area (EEA), including in the United States. Where this happens, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or, where applicable, the provider’s certification under the EU–US Data Privacy Framework. You can request more information about these safeguards using the contact details above.

8. How Long We Keep Your Data

We keep your personal data only as long as necessary for the purposes described in this policy:

• Account and user content: for as long as your account is active.
• After account deletion: removed within 30 days, except where we must retain certain data to meet legal obligations.
• Diagnostic and log data: retained for a limited period for security and debugging, then deleted or anonymised.
• Optional PostHog analytics and diagnostic data: retained only for as long as needed to understand product usage, improve the App, and investigate errors, after which it is deleted or anonymised under our PostHog retention settings.

9. Your Rights

Under the GDPR, you have the right to:

• access the personal data we hold about you;
• request correction of inaccurate data;
• request erasure of your data (“right to be forgotten”);
• restrict or object to certain processing;
• data portability — receive your data in a structured, machine-readable format;
• withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, contact us at [email protected]. You also have the right to lodge a complaint with your local data protection authority — in Ireland, this is the Data Protection Commission (dataprotection.ie).

10. Security

We take reasonable technical and organisational measures to protect your data, including encryption in transit, access controls, and use of reputable infrastructure providers. Because sign-in is handled through Google, we do not store passwords, which removes one common category of security risk. However, no system is completely secure, and we cannot guarantee absolute security. Please keep your Google account secure and enable two-factor authentication where possible.

11. Cookies and Similar Technologies

The App uses strictly necessary cookies and similar technologies to operate — in particular, to keep you securely signed in and to maintain your session (handled by our authentication provider, Better Auth). These essential technologies do not require consent. We do not use advertising or third-party marketing cookies.

We also use your browser’s local storage to remember in-app preferences on your device, such as your preferred AI assistant for the “Explain with AI” feature. This data stays in your browser and is not transmitted to us.

If you opt in, we use PostHog Cloud EU for optional product analytics, error monitoring, and performance diagnostics. PostHog uses first-party cookies, local storage, and session storage to recognise a browser and session, associate events, and remember analytics state. These technologies are not activated for analytics capture or persistence until you consent.

You can accept or decline these optional technologies in the consent banner and change your choice later under Settings > Privacy. Withdrawing consent stops new PostHog collection and clears PostHog analytics storage from this device. It does not affect processing that was lawful before withdrawal. You can also clear browser storage using your browser settings.

12. Children’s Privacy

The App is intended for users aged 16 and over. The age of digital consent varies across EU member states (between 13 and 16). Where a user is below the applicable age, we require verifiable consent from a parent or guardian before processing their personal data. If you believe a child has provided us data without appropriate consent, contact us and we will take steps to delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you (for example, in-app or by email) and update the “Last updated” date above. We encourage you to review this policy periodically.

14. Contact Us

For any questions or requests about this Privacy Policy or your personal data, contact us at [email protected].