Privacy Policy

Current processing clarification — 25 October 2026

StudyBro operates its private SwissQA gateway in Switzerland. SwissQA keeps the AI responses and ingested documents it processes while the account exists until account deletion. Free browser AI instead goes directly from StudyBro’s Firebase backend to OpenRouter, using text extracted in the browser for documents. OpenRouter routes AI requests to inference providers abroad, and input/output logging is enabled in the reviewed workspace. Its logging documentation describes retention of at least three months unless erasure is requested. Other provider retention varies; there is no blanket zero-retention guarantee.

Website account deletion is requested by emailing studybro.ch@gmail.com or using the email-request link in account settings. Initiating a request does not mean deletion is completed. Firebase retains configured backup/recovery copies separately. These facts clarify existing processing; they do not introduce a new use of data or remove your rights. The upcoming text below gives further details.

Upcoming version 3.0

Version 3.0 · Last updated 25 October 2026
Effective date: 8 November 2026, following notice of this update.

1. Who is responsible for your personal data

StudyBro is operated by Léonard Dinichert, operating under the name StudyBro, Chemin Armand Dufaux 48, 1245 Collonge-Bellerive, Switzerland. He is responsible for the personal data described in this Policy. You can contact him at studybro.ch@gmail.com.

This Policy applies to the StudyBro app, website and related services. Some features depend on the device, account, settings and service available to you. A feature-specific notice may explain additional processing before you use that feature.

2. Personal data we use

Depending on how you use StudyBro, we may process:

• Account details: email address, account identifier, name, username, age information, profile photo, biography, education level, subjects, language and time zone.
• Study content and activity: notes, documents, images, audio, flashcards, study sets, folders, quizzes, study guides, prompts, answers, progress and spaced-repetition records.
• AI requests and results: the text and images you submit, relevant study context, generated answers and related conversation records.
• Calendar and reminders: study or exam titles, subjects, dates and notes used by calendar and reminder features.
• Social and shared content: friends, invitations, shared notes, study sets, profile details, leaderboards, scores, duels and presence information when you use those features.
• Device and service information: device and app version, IP address, sign-in and service events, diagnostics, error records, security information and feature or usage counts.
• Enquiries and support: your name, email address and message when you use the website contact form or email us. A support or rights request may also include account or order references and other details you choose to provide. We may request limited information reasonably needed to verify your identity or authority to act for someone else.
• Purchases: transaction and order identifiers, subscription or purchase status, credit balance and use. Apple or another payment provider handles payment-card details for its own transactions.
• Advertising information: advertising identifiers and related signals used by Google Mobile Ads in the iOS app.
• Notification information: a Firebase Cloud Messaging device token when notifications are enabled.

Please do not include passwords, payment-card numbers, government identifiers, health details or another person’s sensitive information in study materials or AI requests unless the feature specifically requires it and you have the right to share it.

3. Why we use personal data

We use personal data to:

• create and manage accounts and provide the study features you request;
• save and retrieve study content, progress and conversations;
• answer interactive AI requests and generate review questions for reminders;
• provide optional sharing, social, calendar and notification features you choose to use;
• process purchases, subscriptions, credit balances, cancellations and customer requests;
• respond to enquiries, provide support, receive and handle privacy-rights requests, and verify the requester where reasonably needed;
• protect accounts and the service, investigate abuse or fraud, fix errors and maintain reliability;
• show and measure advertising in the iOS app where advertising is enabled; and
• meet legal obligations and establish, exercise or defend legal claims.

Where applicable law requires a legal basis, we rely on the basis that applies to the relevant processing, such as providing a feature you request, your consent, our legitimate interests where permitted, or a legal obligation. If a feature requires consent, you may withdraw it for future processing. If you do not provide information that a feature needs, that feature may not work.

4. AI features and study reminders

When you use an interactive AI feature, your prompt, selected attachments and relevant study context are sent to StudyBro’s Firebase backend. Free browser AI goes directly from that backend to OpenRouter. Documents for free browser AI are read in the browser and selected text is included in the prompt; those requests do not use SwissQA document ingestion. Other AI features may use SwissQA, a private gateway operated by StudyBro and hosted in Switzerland, before OpenRouter. OpenRouter selects an inference provider to run the model. The response may also be saved in your account conversation.

Models currently configured in StudyBro include models developed by Anthropic, DeepSeek, Google, OpenAI, Qwen, Xiaomi and Z.ai. A model’s developer is not necessarily the company that processes the request. Recent OpenRouter records show inference through providers including Inceptron, Wafer, DekaLLM, Together, Prime Intellect, Decart, Fireworks, Baidu Qianfan, Baseten, Crusoe and inference.net. Routing and availability can change; OpenRouter’s provider directory describes provider-specific practices.

StudyBro also runs a review-reminder feature. When it needs a review question and cannot use an existing question for a note, note content may be sent through OpenRouter to generate one without a new interactive request at that moment. This background processing is separate from permission for interactive AI on a particular browser. Contact us to exercise rights or request that affected processing stop; disabling a browser choice does not itself change another device or a scheduled service.

SwissQA keeps responses and ingested documents while your account exists, including when it is inactive, until account deletion is completed. Removing an item from a browser or app view should not be assumed to remove every gateway or provider copy. You may also contact us to request erasure of specific personal data.

In the OpenRouter account settings reviewed on 25 October 2026, routing to paid endpoints marked as training on request data is disabled; routing to free endpoints that may train is allowed. The current registered models use paid endpoints, including for StudyBro’s Free plan. Public-prompt publication and OpenRouter’s product-improvement discount are disabled. These settings do not guarantee every provider’s compliance or eliminate provider retention. Zero-data-retention-only routing is not enabled.

OpenRouter input/output logging is enabled in the Default Workspace for private debugging and review. This can retain prompt and response content, with access controlled by OpenRouter’s organization and workspace permissions. Its logging documentation describes retention of at least three months, potentially longer unless deletion is requested. OpenRouter’s commercial DPA says it will delete covered data from its data stores and backups within 30 business days after a customer request. OpenRouter also retains operational metadata such as the model, inference provider, time, token usage and cost. When we handle a verified erasure request, we assess the relevant service-provider copies and submit applicable requests; provider processing and retention rules may affect completion.

The browser app presents a separate AI-sharing permission before its interactive AI tools become available. Declining keeps those tools unavailable on that browser. The account settings let you reset this browser’s permission. This is separate from Terms acceptance, device permissions and rights requests covering other processing or devices. AI outputs may be inaccurate or incomplete and are not professional advice. Do not submit sensitive personal data or material you do not have the right to share.

5. Who may receive personal data

We disclose only data relevant to the feature or purpose. Recipients may include:

• Google and Firebase, for account authentication, database and file storage, browser-app hosting, cloud functions, push notifications and reCAPTCHA Enterprise/App Check technical checks;
• Webflow, for the marketing website and contact form, and Cloudflare Turnstile, for contact-form spam prevention;
• OpenRouter and the inference endpoint provider selected for a request, to process interactive AI requests and generate reminder questions. StudyBro’s current model registry includes models developed by Anthropic, DeepSeek, Google, OpenAI, Qwen, Xiaomi and Z.ai; a model developer may differ from the provider operating the inference endpoint;
• Apple, for App Store purchases and Apple platform features you choose to use;
• Stripe, only if a website purchase or billing-management feature is made available to you;
• Google Mobile Ads, for advertising in the iOS app; and
• other StudyBro users or the public, when you choose to share content or use a feature that displays information to them.

Service providers may process data on StudyBro’s behalf or under their own terms for their services. We may also disclose information to authorities or other parties when required by law or necessary to establish, exercise or defend legal rights. We do not sell personal data for money.

6. Sharing and visibility

Some StudyBro features let you share study sets, notes, profile details, scores or other information with friends, selected recipients or a public audience. The audience depends on the feature and the choices shown when you share. Content made public or shared by link may be copied, downloaded or retained by others. Changing or removing the original does not remove copies another person has already made.

7. Device permissions, advertising and website storage

The app may ask for device access needed for a feature, such as camera or photo access for scans and uploads, calendar access for study events, contacts for friend discovery, or notification permission for reminders. You can manage permissions in your device settings. The feature may be unavailable if you decline or later withdraw a permission.

The iOS app uses Google Mobile Ads. Advertising identifiers and related signals may be processed to show or measure ads. Cross-app tracking is subject to the device permission settings available to you; you can review tracking choices in iOS Settings. The exact effect of each choice depends on the app version and device configuration.

The website uses browser storage for functions such as sign-in, language or display preferences, onboarding state and purchase or return flows. Some storage is kept only for the browser session; other preferences may remain until you clear site data.

8. International processing

StudyBro’s Firebase functions and Firestore database use the Switzerland region europe-west6, and SwissQA is hosted in Switzerland. External services can process data abroad. OpenRouter is based in the United States and its standard infrastructure disclosure identifies US storage. Inference routing is global and provider-dependent; for example, recent records include Baidu Qianfan as well as US-based providers. We do not promise that AI content remains in Switzerland or the EEA. OpenRouter’s subprocessor list and provider directory describe recipients and locations; a provider’s headquarters alone does not establish the location of every request.

OpenRouter’s commercial Terms, Section 10.2, incorporate its Data Processing Agreement. That agreement provides for controller-to-processor terms and international-transfer clauses, including adaptations for Switzerland and the UK. Other providers’ processing is governed by the applicable service and data-processing terms. You can contact studybro.ch@gmail.com for information about recipients and the safeguards relevant to your data. These contractual safeguards do not make all destination countries legally equivalent or guarantee a provider’s conduct.

9. How long data are kept

We keep personal data while needed to provide the service, meet legal obligations, resolve disputes and protect the service. The period depends on the data and purpose.

• Account content is kept while the account is active, unless you remove it or request deletion.
• Purchase, tax, accounting, security and legal-claims records may be retained where required or permitted by law.
• Enquiry, support and privacy-rights correspondence, including information used to verify a requester and records of how a request was handled, is kept for as long as reasonably needed to respond, document the handling, meet legal obligations and establish, exercise or defend legal claims. The period depends on the request and applicable law.
• AI conversations may remain in your account. SwissQA responses and ingested documents remain while the account exists until account deletion, including for inactive accounts. OpenRouter content logging and metadata and inference-provider retention are described in Section 4.
• The current Google Cloud configuration has Firestore backups configured for 90 days, point-in-time recovery for seven days, and seven-day soft deletion for Firebase Storage objects. Cloud Logging is configured for 30 days in the _Default bucket and 400 days in the locked _Required bucket. These are infrastructure settings; they do not establish how long every application record, provider record or log is kept.

To request account deletion, email studybro.ch@gmail.com from your account email address. For a website account, you may also use the email-request link in account settings where available. Sending an email or using that link starts a request; it does not mean deletion has completed. We will review and act on a verified request, subject to information that must or may be retained under law. Copies in backups, point-in-time history, soft-deleted storage or service-provider systems may remain until their applicable retention period ends. A restoration does not cancel a verified erasure request. Our deletion-handling procedure requires previous erasure requests to be checked before restored data are returned to active use.

10. Your privacy choices and rights

Depending on the law that applies to you, you may have rights to request access to, correction of or deletion of personal data, to object to or restrict certain processing, to receive certain data in a portable format, or to withdraw consent. These rights may be subject to legal exceptions. You can make a request at studybro.ch@gmail.com. We may ask for information needed to verify that you are the account holder or are authorized to act for them.

If you are in Switzerland, you may contact the Federal Data Protection and Information Commissioner (FDPIC). If you are in the EU/EEA, you may contact the data-protection supervisory authority responsible for your circumstances.

11. Children and young people

StudyBro is not intended for children under 13. Minimum ages and any parental authorization requirements can differ under local law. A parent or guardian who has a question about a young person’s information can contact studybro.ch@gmail.com.

12. Security and automated decisions

StudyBro uses technical and organizational measures intended to protect personal data. No internet service can guarantee absolute security. We do not use personal data to make decisions solely by automated processing that have legal or similarly significant effects on you.

13. Changes to this Policy

We may update this Policy when our services, data practices or legal obligations change. The current version and effective date will appear at the top of the Policy. If a change requires new consent, we will ask for it separately; reading or accepting this Policy does not itself authorize a separate use that requires consent.

14. Contact

Léonard Dinichert, operating under the name StudyBro
Chemin Armand Dufaux 48
1245 Collonge-Bellerive, Switzerland
Email:studybro.ch@gmail.com