Privacy Policy

Effective date: September 30, 2026
Operator: Dean Concepcion, operating The Study Concept
Contact: deanconcepcion8@gmail.com
Governing law: Ontario, Canada

This Privacy Policy explains how The Study Concept collects, uses, discloses, stores, and protects personal information when you use our websites, study tools, account features, AI features, reminders, documents, cards, schedules, and related services.

1. Scope of this Policy

This Policy applies to The Study Concept services that link to it, including the dashboard, schedule, document tools, content library, flashcards, LYNE assistant features, account pages, notifications, and any related web applications. It does not apply to third-party websites or services that we do not control, even if they are linked from the Services.

2. Personal Information We Collect

Information you provide

Account information, such as name, email address, login provider, profile settings, and subscription or plan information.
Study content, such as notes, uploaded documents, prompts, questions, schedules, to-do items, reminders, cards, highlights, annotations, and saved explanations.
Communications, such as support requests, legal notices, feedback, and other messages you send to us.
Paid checkout is currently disabled. If it launches using Stripe, we expect to process the adult purchaser role and billing email, selected plan, policy and disclosure versions, acceptance time, provider references, billing-event status, and payment-related records. Stripe would handle card details; we do not ask for full card numbers or security codes by email.

Information collected automatically

Device, browser, page, usage, diagnostic, and log information used to operate, secure, debug, and improve the Services.
Local browser storage, including app preferences, cached study state, drafts, reminders, and authentication-related state.
Notification subscription information, timezone information, and schedule metadata when reminder features are enabled.
Approximate analytics and performance information from hosting, database, and analytics providers.

Information processed by AI features

Prompts, selected text, uploaded files, document excerpts, images, audio, transcripts, and context you choose to submit to AI features.
Generated outputs, including summaries, explanations, notes, study cards, practice questions, transcripts, images, and speech.

3. How We Use Personal Information

Provide, maintain, personalize, and improve the Services.
Create and manage accounts, authentication, preferences, subscriptions, and support requests.
Save and display study materials, schedules, documents, tasks, cards, achievements, and progress information.
Operate LYNE, AI-assisted explanations, search, transcription, OCR, text-to-speech, and related study features.
Send service messages, requested reminders, security notices, and support responses. Promotional messages require a lawful consent basis and an unsubscribe method; signing in is not blanket marketing consent.
Detect, prevent, and respond to abuse, fraud, technical issues, security incidents, and violations of our Terms.
Comply with legal obligations, enforce agreements, and protect the rights, safety, and security of users and others.

4. Legal Bases and Consent

We collect, use, and disclose personal information only where we have a lawful basis to do so. Depending on the feature and jurisdiction, this may include consent, performance of a contract, legitimate operational interests, compliance with legal obligations, or another basis permitted by law. Where consent is required, you may withdraw consent, subject to legal or contractual restrictions and reasonable notice.

5. How We Share Information

We do not sell personal information. We may disclose information in the following circumstances:

To service providers that host, secure, authenticate, analyze, store, process, or support the Services.
To AI, transcription, speech, OCR, image, or document-processing providers when you use features that require those providers.
To payment processors if paid plans, subscriptions, refunds, tax, fraud, or billing support are involved.
To a school, parent, guardian, or institution where the account is school-managed or the disclosure is legally permitted or required.
To comply with law, legal process, investigations, safety obligations, or enforceable government requests.
In connection with a merger, acquisition, financing, reorganization, or transfer of assets, subject to appropriate protections.

6. Service Providers and Connected Services

The following describes the current implementation as of the effective date. Providers may change as the service develops; we will update this Policy when material data flows change.

Hosting, accounts, and cloud storage

Vercel: hosts the public site and serverless API routes. Requests can generate ordinary server and security logs, such as IP address, request time, route, user agent, and response status. Vercel Web Analytics and Speed Insights scripts are present on selected pages and are loaded only after analytics consent; not every route uses them.
Supabase: provides authentication and cloud database services. Sign-in/account records include the user ID, email, provider identity, and profile fields returned by the chosen sign-in method. Authenticated sessions use a secure, HttpOnly session cookie; credentials and session tokens are excluded from workspace-content sync.
Workspace storage: study content and app state are first stored in this browser. When signed in, an allowlist of workspace-related local-storage keys (including schedules, documents, notes, cards, progress, and preferences) can sync to Supabase in the learning_assets table. Each synced value is limited by the client to 2 MiB. The sync allowlist excludes authentication tokens, passwords, billing/checkout values, notification subscription secrets, tutorial/onboarding state, and diagnostic data. Push reminder subscriptions, when enabled, are separately stored for delivery. Signing out or clearing this browser does not erase cloud copies.
Google sign-in: when selected, Google supplies the identity information needed for authentication, such as account identifier, email, and profile name/photo if available. Separately, the Schedule page can request the read-only Google Calendar scope (calendar.readonly). If you grant it, the browser reads events from the selected calendar range and imports event titles, organizer, dates/times, location, event link, and description into the local schedule. Schedule state may then sync to Supabase under the workspace-sync behavior above. You can disconnect the Google Calendar connection in the app and revoke access in your Google Account settings.

AI and media processing

When you invoke a feature, the text or media required for it is sent from the app to The Study Concept’s API and then to the configured provider. LYNE chat and card generation use OpenAI-compatible API endpoints (OpenAI by default); the request may include your prompt, conversation history, selected document excerpts, and course/workspace context. Voice transcription sends the audio recording and associated language/options to OpenAI by default. Text-to-speech sends the text to Microsoft Edge TTS first; authenticated fallback routes may use OpenAI, a configured Kokoro service, Replicate-hosted Kokoro, or ElevenLabs. Provider choice depends on server configuration and availability. A separate Notebook LM proof-of-concept page uses Puter when you choose that page. Local-model features may download and cache model files on your device. AI and media providers process submitted content under their own terms and retention settings; do not submit confidential or sensitive material unless you are comfortable with that processing. Outputs may be inaccurate.

Advertising and payments

Google AdSense scripts previously appeared on selected offline and math pages. Those scripts have been removed from those pages; no AdSense tags are currently embedded there. This does not change Vercel’s ordinary processing of connection metadata needed to serve the site. Paid checkout is disabled in the deployed app. The current billing integration code references Lemon Squeezy, not Stripe. If a future release enables Stripe, Stripe would receive payment and transaction details directly, while The Study Concept would receive identifiers and billing status needed to grant access, support the purchase, process refunds, and keep records. We will publish an updated notice before enabling that flow; Stripe is not currently receiving payments through The Study Concept.

Other external libraries and integrations may load when you use a specific feature—for example, Google Identity for sign-in, PDF.js for viewing PDFs, or document parsers for file import. Those services receive the technical requests or files necessary for that feature. Their independent privacy terms apply to their processing.

7. Children, Students, and School Use

Personal accounts are intended for users aged 13 and over. Under-13 accounts are not currently available, and a parent-consent flow is not active. Before sign-in, the account-entry screen asks users to confirm that they are 13 or older. This is a self-reported confirmation, not identity or age verification; The Study Concept does not ask for a birth date. The browser stores the confirmation locally so returning users are not asked again. Do not create an account for a child under 13 until The Study Concept publishes an enabled, verified process. Where a young person cannot provide meaningful consent or enter a binding agreement, a parent or guardian must review and authorize use in accordance with applicable law. A school email address is not proof of parental consent or an institutional agreement. If paid checkout launches, it is planned to record the adult purchaser's role and billing email without asking learners for identity documents; checkout remains disabled today.

If you believe an under-13 child has submitted personal information, contact deanconcepcion8@gmail.com. We will review the report and take appropriate steps to restrict the account and remove information where required. Institutional use requires a separate assessment of the school's authority, consent, and data protection obligations. Students and guardians can also read the Youth Privacy and Parent Notice.

8. Cookies, Analytics, and Local Storage

Essential browser technologies support account sessions, security, consent records, saved drafts, and core workspace functions. Optional preference and analytics technologies are used only according to your cookie choices. The Study Concept does not sell personal information. Advertising scripts are present on selected pages; see Section 6 and our Cookie Notice and reopen at any time.

9. Retention

We retain personal information for as long as reasonably necessary to provide the Services, maintain accounts, comply with legal obligations, resolve disputes, enforce agreements, prevent abuse, and keep business records. Local browser data may remain on your device until you clear it, delete it through the app, or the app overwrites it. When an account is deleted, we remove its information from active systems after verifying the request and checking for records we must preserve. Copies in disaster- recovery backups, security logs, or independent service-provider systems may persist until those systems' configured retention periods expire; those periods vary by provider and account plan. We restrict retained copies and do not restore them for ordinary service use. If a backup is restored, we reapply outstanding deletion requests before returning it to service. We request deletion from a provider where that control is available and applicable.

10. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information. No system is completely secure. You are responsible for protecting your login credentials, using trusted devices, and avoiding the upload of highly sensitive information unless the relevant feature is intended for that use. We investigate suspected security incidents, keep a restricted record of personal-information breaches, and notify regulators and affected individuals when required by law. Where PIPEDA applies, breach records are kept for at least 24 months.

11. Your Privacy Rights and Choices

You may request access, correction, deletion, or portability of personal information where applicable law provides those rights.
You may withdraw certain consents, disable notifications, clear local browser storage, or stop using connected third-party services.
You may contact us about privacy concerns or complaints at deanconcepcion8@gmail.com.
We verify that you control the account or are authorized to act for the person concerned before disclosing or deleting information. If you cannot write from the account email address, contact us and we may use another proportionate verification step. We do not ask for passwords, sign-in codes, full card numbers, or security codes.
Email an access, correction, export, or deletion request to deanconcepcion8@gmail.com and identify the account email and the action you want. We respond within applicable legal deadlines; for access requests subject to PIPEDA, this is normally 30 days, with notice of any lawful extension. If we refuse a request, we explain the reason and available complaint options.
An export can include information in our account and cloud records, but it cannot automatically collect files or study data stored only on your device. Clearing browser storage or signing out does not delete server-held account information. Some records may be retained where required for security, billing, legal compliance, or dispute resolution, and copies may remain temporarily in provider backups or logs under their configured retention periods.
We check the account’s active data stores, disable related reminders, and request provider-side deletion where available. We verify completion and tell you about any limited information retained and why. We do not promise that independent providers or disaster-recovery backups are erased immediately.

12. Canadian and U.S. Regional Privacy Rights

Canada

Canadian residents may request access to or correction of personal information and may withdraw consent where permitted by law. You may also raise a concern with the privacy regulator responsible for your province or territory after contacting us about the issue.

California and other U.S. states

Depending on where you live and whether applicable legal thresholds are met, you may have rights to know, access, correct, delete, or obtain a portable copy of personal information, and to appeal a decision about a privacy request. The Study Concept does not sell personal information or share it for cross-context behavioural advertising. We will not discriminate against you for exercising an applicable privacy right. Submit requests to deanconcepcion8@gmail.com; we may verify your identity and an authorized agent's authority before responding.

13. International Processing

The Services and service providers may process information in Canada, the United States, and other jurisdictions. Those jurisdictions may have privacy laws that differ from the laws where you live, and authorities may obtain lawful access. Where applicable law requires transfer safeguards, those requirements continue to apply; use of the service alone is not a waiver of them.

14. School and Organization Accounts

If a school or organization provides or manages your account, it may control the account, connected content, access settings, and retention requirements under a separate agreement. We will process that information according to the applicable agreement, this Policy, and law. Students should ask their school or organization about institution-specific privacy choices.

15. Changes to this Policy

We may update this Privacy Policy from time to time. The updated version will be posted on this page with a revised effective date. If changes are material, we will provide additional notice where required by law.