Study Flow
Last updated: July 15, 2026
This Privacy Policy explains how Shedulab ("we", "us", or "our") collects, uses, and shares information when you use the Study Flow mobile application ("the App"). Study Flow turns your documents, notes, and recordings into study material such as summaries, flashcards, and quizzes.
Please read this Policy carefully. Where we rely on consent, including for personalized advertising or tracking, we request it separately. Using the App does not by itself constitute consent to personalized advertising or tracking.
When you create an account we collect your email address and the display name you choose. Authentication is handled by Supabase. If you sign in with Apple or Google, we receive a unique identifier and the email address associated with that sign-in (which may be a private relay address if you choose to hide your email).
To generate study material, we process the files and content you upload, including PDF and PPTX documents, pasted text, and audio recordings, along with the text extracted from them and the study sets generated from that content.
We store your learning activity, such as quiz results, flashcard reviews, progress, and reminder preferences, so the App can track your progress and send the reminders you enable.
Purchases and subscriptions are processed by Apple or Google and managed through RevenueCat. We do not receive or store your full payment card details. We receive subscription status (for example, whether you have an active subscription) so we can unlock paid features.
We may collect basic technical information such as device type, operating system version, app version, and diagnostic or crash data to keep the App working reliably. Diagnostic tools may also collect performance data, logs, screenshots, view hierarchy, and masked session replay data when needed to understand and fix crashes or errors.
The App offers an optional, user-initiated rewarded ad through Google AdMob. The advertising SDK is initialized and an ad is requested only after you choose Watch Ad. Where required, the Google User Messaging Platform ("UMP") privacy form and the iOS App Tracking Transparency ("ATT") prompt are presented before the first ad request. An ad is requested only if UMP indicates that ads may be requested.
When you request an ad, the Google Mobile Ads SDK, UMP, and participating advertising partners may collect or receive your IP address, which may be used to estimate general location; device and app information; device or advertising identifiers; advertising data such as ads shown; interactions such as taps and video views; crash, diagnostic, and performance data; and consent selections or other privacy signals. On iOS, the Identifier for Advertisers ("IDFA") is available only if you grant ATT permission.
To verify that an ad was completed and credit the correct account, we send Google an internal Study Flow user identifier and a reward-session verification token. These values do not include your email address or display name. Google sends our backend a signed verification callback containing transaction, ad-unit, reward, and timestamp information. We store the ad session and its status, Google's transaction identifier, points awarded, point balance, and redemption history to operate the rewards feature and prevent duplicate or fraudulent rewards.
We do not send your uploaded files, pasted text, recordings, generated study material, email address, or display name to Google AdMob for ad targeting.
Where laws such as the GDPR, UK GDPR, KVKK, or similar privacy laws apply, we process personal information based on one or more legal bases: to perform our contract with you and provide the App, with your consent where required, for our legitimate interests in operating, securing, and improving the App, and to comply with legal obligations.
For rewarded ads, we process ad-session and reward records to complete the reward transaction you request and for our legitimate interests in maintaining accurate point balances, preventing duplicate rewards, and detecting fraud. We rely on consent where required for personalized advertising, access to advertising identifiers, storage of advertising-related information on a device, or tracking across apps and websites. Points are awarded for completing an ad, never for granting advertising consent or ATT permission.
We do not sell your personal information for monetary consideration. We disclose information to service providers and, when you choose to request a rewarded ad, to advertising providers as described below:
| Provider | Purpose |
|---|---|
| Supabase | Account authentication and database storage |
| OpenAI | Audio transcription and generating summaries, flashcards, quizzes, and answers from your content |
| Cloudflare R2 / Amazon S3 | Storage of uploaded files |
| RevenueCat | Managing subscriptions and entitlements |
| Apple / Google | Processing in-app purchases and subscriptions |
| Google AdMob / Google Mobile Ads SDK / UMP | Delivering optional rewarded ads; managing consent and privacy signals; ad personalization where permitted; advertising measurement and analytics; fraud prevention; and server-side reward verification |
| Sentry | Crash reporting, diagnostics, performance monitoring, logs, and session replay for troubleshooting |
Content sent to OpenAI is used for audio transcription and to generate your study material. We do not authorize these providers to use your content for their own independent purposes beyond providing their service to us. OpenAI states that API inputs and outputs are not used to train OpenAI models by default unless the API customer opts in. OpenAI may generate abuse monitoring logs that can include prompts, responses, and related metadata, and may retain those logs for up to 30 days unless a longer period is legally required.
Diagnostic events sent to Sentry may include account identifiers, email address, device and app information, error details, logs, screenshots, view hierarchy, masked session replay data, and, where an error involves AI processing, limited prompt, extracted content, or generated-output context needed to investigate and fix the issue. We use this information only to operate, secure, and troubleshoot the App. We may also disclose information if required by law or to protect our rights and users.
Google may process ad-related information and make it available to advertisers or participating ad technology providers for ad delivery, personalization where permitted, measurement, analytics, security, and fraud prevention. Google processes some of this information under its own terms and privacy policy. Depending on applicable law, personalized advertising may be considered targeted advertising, "sharing," or a "sale." We provide consent or opt-out choices where required.
Depending on your choices, applicable law, and ad availability, Google may provide a personalized, non-personalized, or limited ad. Even non-personalized or limited ads may involve limited processing of information such as an IP address or device signals for delivery, frequency controls, aggregate reporting, security, and fraud prevention. For more information, see Google's Privacy Policy and How Google uses information from apps that use its services.
We keep your information for as long as your account is active. You can delete your account at any time from Settings → Delete account in the App. Deleting your account permanently removes your account, uploaded content, and generated study material from our active systems, subject to limited retention required for legal, security, or backup purposes. Note that an active subscription is billed by Apple or Google and must be cancelled separately through your store account.
We keep ad-session, reward-transaction, point-ledger, and redemption records while your account is active and for as long as reasonably necessary to maintain an accurate balance, prevent duplicate or fraudulent rewards, resolve disputes, and comply with legal obligations. When an account deletion request is completed, we delete the related ad-session, reward-transaction, point-ledger, and redemption records from our active systems unless limited retention is required for legal, security, fraud-prevention, accounting, dispute-resolution, or backup purposes.
Advertising consent and ATT choices remain in effect until you change or reset them, or until the relevant platform or provider determines that a new choice is required. Google determines the retention periods for information it processes under its own policies. See Google's data retention practices.
You can also request account and data deletion by emailing info@shedulab.com from the email address associated with your account, or by otherwise providing enough information for us to verify and process your request.
We use reasonable technical and organizational measures to protect your information, including encrypted connections to our services. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
Our service providers may process and store your information in countries other than your own. Where we transfer information internationally, we take steps to ensure it remains protected in accordance with this Policy and applicable law, including by using appropriate contractual or technical safeguards where required.
The App is not directed to children under the age required by your local law to consent to data processing (for example, under 13 in the United States). We do not knowingly collect personal information from children. If you believe a child has provided us information, please contact us so we can remove it.
Depending on where you live, including if privacy laws such as the GDPR, UK GDPR, KVKK, or similar laws apply to you, you may have the right to access, correct, export, or delete your personal information, or to object to or restrict certain processing. You can exercise many of these rights directly in the App, or by contacting us using the details below.
Watching a rewarded ad is optional, and you can use the App's core features without watching one. Where UMP presents a choice, you may choose whether to allow personalized advertising. Refusing or withdrawing advertising consent does not reduce the number of points awarded for an ad you complete, although an ad may not always be available.
When UMP indicates that a privacy-options entry point is required, a Privacy options control appears in the App's Settings. You can use it to revisit and update the advertising choices managed through UMP.
On iOS, you can deny or later change ATT permission in Settings → Privacy & Security → Tracking. If ATT permission is denied or withdrawn, the IDFA is not available for tracking. This choice does not restrict the App's core features and does not change the reward value for a completed ad. Google may still process limited information needed to deliver non-personalized or limited ads, measure performance, and prevent fraud.
To ask questions about your advertising choices, withdraw consent where applicable, or exercise rights available under privacy law, contact us using the details below.
We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above. Material changes will be communicated through the App or other reasonable means.
If you have questions about this Privacy Policy or your data, contact us at info@shedulab.com.