Privacy Policy

hello.study is an educational habit application that teaches students how to study — what matters, what to remember, and how to check themselves — through short daily practice rounds.

hello.study (“we,” “us,” “our”) is an individually operated web application. If you have questions about this policy, email us at [email protected].

hello.study is designed for students in grades 5–10 (approximately ages 10–16). Accounts are created and managed by parents or guardians only. Students do not create their own accounts and do not provide an email address or any contact information directly to us. A parent creates the family account, adds learner profiles, and a student accesses their profile using a device and a PIN set by the parent.

Parent account

• Email address (used for account login and password reset)
• Password (stored as a hashed credential via Supabase Auth — we never store plaintext passwords)
• Subscription plan and billing status

Student (learner) profiles

• Display name chosen by the parent (e.g. a first name or nickname)
• Grade band selected by the parent (e.g. grades 5–10)
• PIN (stored in hashed form — used for device access; never transmitted as plaintext)
• Learning activity records: answers submitted, correct/incorrect outcome, time spent per problem, method progressed, XP earned, badges unlocked, streak count
• Problem reports voluntarily submitted by the student (e.g. flagging a broken question)

What we do not collect from students

• Email address or any contact information
• Real name, school name, or location
• Photos or voice recordings
• Any information beyond what is needed to run the learning session and track progress

• Delivering daily study rounds and tracking a student's progress through the method curriculum
• Generating the parent progress report (weekly snapshot of days studied, methods progressed, and patterns to watch)
• Maintaining streaks, badges, and XP so the habit loop works correctly
• Sending transactional emails to the parent account (password reset, account confirmation) — no marketing email without explicit opt-in
• Diagnosing and fixing bugs reported through in-app problem reports
• Improving the quality and difficulty balance of the question bank

We do not use student learning data for advertising, profiling, or any purpose outside of delivering and improving the educational service.

hello.study is designed to be COPPA-compatible. We do not knowingly collect personal information directly from children under 13. All accounts are created by a parent or guardian, who provides their own email address. Student profiles contain only the information listed above under “Student profiles,” none of which is contact information.

Parental rights: At any time, a parent may:

• Review the information stored in their child's profile
• Correct the display name or grade band
• Delete a student profile — deleting a profile permanently removes all associated learning records (activity, progress, streaks, badges) in accordance with the database cascade rules
• Delete the entire family account and all associated student data

To exercise these rights, email [email protected].

We do not show advertising to students. We do not sell student data. We do not disclose student data to third parties for marketing purposes.

For users in Canada, we also comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) with respect to the personal information of parents and guardians.

We use essential session cookies only:

• hs_kid — httpOnly authentication cookie that identifies which student profile is active on a device
• hs_family — httpOnly authentication cookie that identifies the parent session

These cookies are necessary for the service to function. We do not set advertising cookies, analytics cookies, or third-party tracking cookies. We do not use third-party advertising networks.

hello.study uses the following sub-processors to operate the service. Data may be processed in the United States and other jurisdictions where these providers operate:

• Supabase — database storage and user authentication
• Vercel — application hosting and edge delivery
• Resend — transactional email delivery (authentication and password reset emails sent to the parent email address only)

We do not sell or rent personal information to any third party.

Parent account data is retained for as long as the account is active. Student profile data is retained for as long as the profile exists under the parent account. When a parent deletes a student profile or their account, associated personal data is deleted in accordance with our database cascade rules. Anonymised aggregate usage statistics (e.g. overall question accuracy rates used for content quality improvement) may be retained separately.

We use industry-standard practices: HTTPS for all data in transit, hashed credential storage, row-level security enforced at the database layer, and httpOnly cookies to mitigate XSS risks. No security measure is perfect; if you discover a vulnerability please contact [email protected].

We may update this policy as the product evolves. Material changes will be communicated to the parent account email address at least 14 days before they take effect. Continued use of hello.study after the effective date constitutes acceptance of the updated policy.

For privacy questions, data access requests, or to exercise your rights under COPPA or PIPEDA, contact us at:

hello.study
[email protected]