Privacy Policy

Last updated: October 31, 2026

StudyDuo ("we", "our", "us") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, and safeguard your information when you use our mobile application ("the App").

1. Data Controller

The data controller responsible for your personal data is:

StudyDuo
Email: support@studyduo.app

2. Information We Collect

Account Information

• Email address (for authentication)
• Display name and nickname
• Date of birth (asked once during profile setup; never shown to other users)
• Age range shared by Apple or Google — only in regions where an age law requires it, such as some US states and Brazil, and only with your permission where the system asks for it. Used solely to apply age requirements
• Country and city (optional, user-provided)
• Bio, interests, and links to your social media accounts (optional)
• Avatar selection, or a profile photo if you upload one (optional, see Section 3)
• A selfie for photo verification, if you choose to verify your photo (optional, kept only until it is reviewed, see Section 3)

Usage Data

• Focus session records (duration, timestamps, completion status)
• Session ratings and feedback (optional)
• Goals and daily targets
• Achievements and streak data
• Scheduled session details
• Tasks you add, and what you show on your tile in a video room
• Your activity in video rooms: time spent, likes, pins, and boosts

Messages

• Chat messages exchanged with focus partners
• Voice messages you record and send in chats (see Section 4)
• Session descriptions and notes

Feed

• Posts, comments, replies, reactions, and photos you publish in the feed

Purchases

• Your Premium subscription status and your Premium and Superboost purchases, received from Apple, Google, and RevenueCat. We do not receive your payment card details

Reports and Blocks

• Reports you send or receive, the people you block, and any moderation action on your account

Device Information

• Push notification tokens (for delivering notifications)
• Device type and operating system (for app compatibility)

App Analytics

• Screens viewed, app opens, and time spent in the App
• Device model, operating system, app version, language, and timezone
• IP address, used to determine approximate location (country, city)
• Your account ID and a random app-instance identifier (not your name or email)

Advertising Measurement

• Device and app events shared with TikTok to measure our ads on TikTok (see Section 15)

3. Profile Photos and Photo Verification

Both are optional: you can keep one of the App's animal avatars and never upload a photo.

Profile photo

• You can upload a photo of yourself in place of an animal avatar. Like the avatar, it is visible to other users.
• Before the photo is saved, we resize it and remove its metadata, such as the place where it was taken.
• Every photo is checked by an automated moderation service, the OpenAI Moderation API, for sexual content, violence, and self-harm. A photo that fails the check is not saved. OpenAI does not use these photos to train its models and does not keep them after the check.
• The photo is stored with our storage provider, Cloudflare. When you upload a new photo, the previous one is deleted. When you switch back to an animal avatar or delete your account, the photo is deleted within 2 days.

Photo verification

• If you are 18 or older, based on the date of birth you gave us, you can verify that your profile photo shows you. Verified profiles get a blue checkmark next to the name.
• To verify, you take a selfie in the App with the front camera, showing a hand gesture the App asks for, such as a thumbs up. The gesture shows that the selfie was taken just now and is not an older photo.
• Before the selfie is sent, the App checks that your profile photo and the selfie each contain a face. This check runs on your device with its built-in tools (Apple Vision on iOS, Google ML Kit on Android); the photos are not sent anywhere for it.
• A member of our team compares the selfie with your profile photo by eye and approves or rejects the request. No automated face recognition is used, and no biometric data (facial geometry) is created. If a request is rejected, the App shows you the reason and our comment.
• Tapping "Take selfie" after reading the notice in the App gives your consent to sending the selfie for review. You can withdraw it at any time by contacting us.
• The selfie is stored on our servers (Supabase) only until it is reviewed. It is deleted as soon as the request is approved or rejected, when you upload a new profile photo, or when you delete your account. We keep a record of each request: which photo it was about, the requested gesture, the result, and the reason and comment we gave you.
• We use the selfie only to verify your profile photo and never show it to other users.
• The checkmark stays when you switch to an animal avatar. When a verified user uploads a new photo, a member of our team looks at it: if it shows a face, the checkmark is removed until the new photo is verified with a selfie; any other picture keeps it.

4. Video Rooms and Voice

Video rooms use your camera, and 1:1 rooms also your microphone. Both are optional and need your device's permission.

Live video and voice

• Focus Room and Study Hour share your camera only, with no sound. A 1:1 room shares your camera and your microphone with one other person.
• Your video and voice are streamed live through our own server to the people in the room, along with your name, avatar or photo, and the task or bio on your tile. We do not record or store them.
• Screenshots and screen recording are blocked in video rooms. This cannot stop someone from filming their screen with another device.
• Video rooms are available from age 16, or 18 where an age law applies. People aged 16 and 17 have a separate hall: adults and teens do not see each other. Without a known date of birth you can watch, but not show your camera.
• When you report someone in a video room, we receive the report along with what their tile showed. Video is not recorded, so we cannot review a past video. An account we ban cannot enter video rooms, and is removed if it is in one.

Voice messages

• Voice messages are stored with our storage provider, Cloudflare, so the other person can listen to them.
• When you delete a voice message, its recording is deleted. A recording you never send is deleted automatically within about a day.

5. Legal Basis for Processing (GDPR)

We process your personal data on the following legal grounds:

• Contract performance (Art. 6(1)(b)): Processing necessary to provide the App's core functionality — account creation, confirming you meet the minimum age, session management, partner matching, chat, voice messages, video rooms, purchases, and achievements.
• Consent (Art. 6(1)(a)): Push notifications, optional profile information (country, city, profile photo), photo verification (see Section 3), calendar sync, and on iOS, advertising measurement (see Section 15). You may withdraw consent at any time.
• Legitimate interest (Art. 6(1)(f)): Content moderation, fraud prevention, service improvement, product analytics (understanding how the App is used), and on Android, advertising measurement (see Section 15). We balance our interests against your rights and freedoms.

6. How We Use Your Information

We use your information to:

• Provide and maintain the App's functionality
• Confirm you meet the minimum age and apply age limits to features that need them
• Match you with focus partners based on your location, timezone, and category
• Display your profile to other users (name, avatar or profile photo, country)
• Check uploaded photos for prohibited content and, if you choose, verify that your profile photo shows you
• Send push notifications (session reminders, chat messages, achievements)
• Generate your personal statistics and analytics
• Track achievement and streak progress
• Stream video and voice between the people in a video room, and deliver voice messages
• Process subscriptions and in-app purchases (handled by Apple/Google and RevenueCat)
• Moderate content, act on reports, and ban accounts that break our community guidelines
• Measure how our ads on TikTok perform (see Section 15)
• Improve and develop the App, including product analytics

7. Data Storage & Security

Your data is stored securely using Supabase (hosted on AWS infrastructure in the United States). Photos and voice messages are stored with Cloudflare. We use the following protections:

• All data is encrypted in transit (TLS/SSL) and at rest
• Database-level Row Level Security (RLS) policies
• JWT-based authentication
• Passwords are hashed and never stored in plain text

8. Data Sharing

We do not sell your personal data. We share information only in these limited cases:

• With other users: Your display name, avatar or profile photo, verification checkmark, country, city, bio, social links, feed posts, and online status are visible to other users for partner matching and social features. In a video room, the people there also see your live video and your task, and hear your voice in a 1:1
• Service providers: We use the following third-party services that process data on our behalf:
  • Supabase (database hosting, authentication)
  • Resend (transactional emails)
  • PostHog (product analytics, hosted in the EU)
  • Expo Push Notifications (push notification delivery)
  • Cloudflare (storage of photos and voice messages, delivery of traffic to our servers)
  • Vultr (hosting of our servers, including video rooms)
  • RevenueCat (subscription and purchase status)
  • Sentry (crash reports)
  • Google Firebase (push notification delivery)
  • OpenAI (automated moderation of uploaded photos)
  • Apple / Google (payment processing, sign-in)
  These providers process data only as necessary to provide their services and are bound by their own privacy policies.
• TikTok: To measure our ads on TikTok, the App shares device and app data with TikTok as described in Section 15
• Legal requirements: We may disclose data if required by law or to protect the safety of our users

9. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access — Request a copy of the personal data we hold about you
• Correction — Correct inaccurate information via Profile settings or by contacting us (your date of birth can only be corrected by contacting us)
• Deletion — Delete your account and associated data (available in Profile → Settings → Manage Account → Delete Account)
• Data portability — Request your data in a structured, machine-readable format
• Restrict processing — Request that we limit how we use your data
• Object to processing — Object to processing based on legitimate interests
• Withdraw consent — Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing
• Opt out of push notifications and advertising measurement via device settings (see Section 15)

To exercise these rights, contact us at support@studyduo.app. We will respond within 30 days.

If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local data protection supervisory authority.

10. California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to know what personal information we collect, use, and disclose
• Right to delete your personal information
• Right to opt-out of sale or sharing — We do not sell personal information. We share device and app data with TikTok to measure our ads, which California law may treat as "sharing". You can opt out as described in Section 15
• Right to non-discrimination — We will not discriminate against you for exercising your privacy rights

Categories of personal information we collect are listed in Section 2 above. We do not sell personal information to third parties. To submit a request, contact us at support@studyduo.app.

11. Data Retention

• Account data is retained while your account is active
• When you delete your account, your personal data is removed within 30 days
• Chat messages are deleted when both participants have deleted their accounts
• Upon account deletion, we retain non-reversible cryptographic identifiers: (a) for up to 6 months to restore your conversation history if you re-register, and (b) indefinitely to prevent trial subscription abuse. These identifiers cannot be used to identify you
• Profile photos are deleted within 2 days after you replace or remove them; verification selfies are deleted as soon as they are reviewed (see Section 3)
• Live video and voice in video rooms are not stored. A voice message's recording is deleted when you delete the message (see Section 4)
• Data shared with TikTok is kept according to TikTok's privacy policy
• Anonymized, aggregated analytics may be retained indefinitely
• Product analytics data (PostHog) is linked only to your account ID, never to your name or email. You can request its deletion at any time

12. Children's Privacy

StudyDuo is not intended for children under 13 (or under 16 in the European Economic Area). We ask for your date of birth during profile setup. If it is below the minimum age, the account is locked, the date is not stored, and the account can be deleted from the App. We do not knowingly collect data from children under these ages. Video rooms are available only from age 16, and photo verification only to users aged 18 and over. If we become aware that we have collected data from a child under the applicable age, we will promptly delete it. If you believe a child has provided us with personal data, please contact us at support@studyduo.app.

13. Third-Party Services

The App may integrate with third-party services:

• Apple Sign-In / Google OAuth: Used for optional sign-in (we receive only your email and name)
• Calendar: Optional sync with device calendar (data stays on your device)
• TikTok Business SDK: Used to measure our ads on TikTok (see Section 15)
• Apple Health / Google Fit: Not integrated

14. International Data Transfers

Your data is stored and processed in the United States (via AWS/Supabase). Product analytics data is processed by PostHog in the European Union. Photos checked for moderation are processed by OpenAI in the United States. Video and voice in video rooms pass through our server in the United States. TikTok may process the data it receives outside your country. If you are located outside the United States, your data will be transferred internationally. We protect these transfers using:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data processing agreements with all service providers
• Technical safeguards including encryption in transit and at rest

15. Advertising Measurement, Cookies & Tracking

The App does not use cookies and does not show advertisements. StudyDuo advertises on TikTok, and the App includes the TikTok Business SDK to measure those ads.

• What it sends to TikTok: your IP address, device details (such as model, operating system, and language), device identifiers, an anonymous identifier, and app events: installation, launches, return visits, and in-app purchases. On iOS the identifiers are the identifier for vendor and, only if you allow tracking, the advertising identifier. On Android they include your device's advertising ID.
• What it does not send: we do not give it your name, email address, messages, photos, video, or voice.
• On iOS (from App version 1.1), the SDK starts only if you tap Allow in the system prompt. The App asks once, and you can change your answer at any time in your device's privacy settings.
• On Android, the SDK starts without a prompt. You can delete your advertising ID in your device's settings, and contact us at support@studyduo.app to object.

TikTok handles this data under its own privacy policy.

The App also uses Sentry for crash reporting, Firebase for push notifications, and PostHog for product analytics (how the App is used; not for advertising or cross-app tracking). Our website (studyduo.app) does not use cookies or tracking technologies.

16. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes through the App or via email. The "Last updated" date at the top reflects the most recent revision. Continued use of the App after changes constitutes acceptance of the updated policy.

17. Contact Us

If you have questions or concerns about this Privacy Policy, please contact us:

Email: support@studyduo.app