Privacy Policy

Last updated: July 14, 2026

StudyPal ("we", "us", or "our") establishes this Privacy Policy regarding the handling of users' personal information in our web service "StudyPal" ("Service").

1. Information We Collect

We may collect the following information in providing the Service:

Account Information: Name, email address, Google account information (used for OAuth authentication)
Profile Information: Display name, learner names/nicknames, grade levels, preferred languages
Payment Information: Credit card information (processed through Stripe; we do not directly store this information)
Learning History: Study time, answer history, accuracy rates, progress status, learning goal achievements
Usage Data: Access logs, usage dates/times, features used, page browsing history
Device Information: IP address, browser type, operating system, device identifiers
Inquiry Information: Content of inquiries, attached files
AI Usage Data: Input and response content from AI services (used solely for learning support purposes)

2. Purpose of Use

We use collected information for the following purposes:

Provision, operation, and improvement of the Service
User authentication and account management
Recording, analyzing, and providing feedback on learning progress
Providing AI-powered learning support features
Billing and payment processing
Responding to user inquiries
Sending notifications about the Service, including updates and announcements
Addressing violations of the Terms of Service
Statistical analysis of usage (conducted in a non-personally identifiable manner)
Other purposes incidental to the above

3. Disclosure to Third Parties

We will not provide personal information to third parties except in the following cases:

With the user's consent
When required by law
When necessary for the protection of life, body, or property and it is difficult to obtain the user's consent
When particularly necessary for improving public health or promoting the sound development of children
When cooperating with government agencies or their designees in executing legally prescribed duties

4. Third-Party Services

We use the following third-party services in providing the Service. Information may be shared with these services to the extent necessary:

Google (Authentication): Used for login authentication. Subject to Google's Privacy Policy.
Google Analytics (Web Analytics): We use Google Analytics 4, a web analytics tool provided by Google LLC, to understand and improve how the Service is used. Google Analytics uses cookies (such as _ga) to collect access information including pages viewed, referrer, IP address, browser and device information, and access times. This information is transmitted to Google LLC (United States) and is used as statistical information that does not identify individuals. For details on Google's handling of this information, please refer to the Google Privacy Policy and "How Google uses information from sites or apps that use our services". To opt out of Google Analytics data collection, you can use the Google Analytics Opt-out Browser Add-on.
Stripe (Payments): Used for payment processing. Credit card information is managed directly by Stripe; we do not store it. When a user proceeds to checkout from the plan selection screen, Stripe's script (js.stripe.com) is loaded into the user's browser, and Stripe sets cookies (such as __stripe_mid and __stripe_sid) on the user's device for purposes including fraud detection. Information contained in these cookies, along with the user's IP address, browser information, and device information, is transmitted to Stripe, Inc. (United States) and Stripe Payments Europe, Limited (Ireland). For details on Stripe's handling of this information, please refer to the Stripe Privacy Policy.
Anthropic (AI): Used for learning support features. Learning content-related information is sent via API.
Amazon Web Services (Infrastructure): Used for service hosting and data storage.

5. Security Measures

We implement appropriate technical and organizational security measures to prevent leakage, loss, alteration, or unauthorized access to personal information.
We employ encryption (SSL/TLS), access controls, security monitoring, and other protective measures.
We provide necessary and appropriate supervision to employees who handle personal information.

6. Use of Cookies

The Service uses cookies to improve user convenience and enhance the Service.
Cookies set directly by us are limited to purposes necessary for providing the Service, such as maintaining authentication status and storing user preferences (e.g., NextAuth session cookies).
In connection with the payment functionality, when a user proceeds to checkout, Stripe's script is loaded and Stripe sets third-party cookies on the user's device for purposes such as fraud detection. These third-party cookies are managed by Stripe and are subject to Stripe's Privacy Policy.
The Service uses Google Analytics cookies (such as _ga) to understand and improve how the Service is used. See Section 4 for details and opt-out instructions. The Service does not use cookies for behavioral advertising purposes.
Users may refuse cookies through browser settings; however, some features of the Service, including authentication and payment, may not be available in that case.

7. Minors' Personal Information

The Service is intended to be used by minors under parental supervision.
Collection of minors' personal information is premised on parental consent having been obtained.
Upon request from a parent or guardian, we will promptly respond to requests for disclosure, correction, or deletion of a minor's personal information.

8. Data Retention

We retain personal information for the period necessary to achieve the purpose of use.
When a user withdraws from the Service, identifying information such as email address, name, and external authentication IDs is anonymized (irreversibly) immediately at the time of withdrawal. Learning history, progress, and device identifiers are physically deleted via batch processing within 30 days of withdrawal.
For accounts on the free plan (including provisional registration), only the most recent one month of learning data such as learning history and progress is retained; older data is deleted through periodic batch processing. Deleted data is kept as a backup for restoration purposes for up to 180 days, after which it is permanently erased.
Transactional records (payment history, service plan history, etc.) that are legally required to be retained under the Japanese Electronic Books Preservation Act and other tax-related laws are retained for the statutory retention period (up to 7 years). During this period, the data is kept in an anonymized form that does not identify individual users.
Records of consent to the Terms of Service and Privacy Policy are stored on an append-only basis for identity verification and compliance purposes. Identifying information is anonymized at the time of withdrawal, but the consent event records themselves are retained.

9. User Rights

Users may exercise the following rights with respect to us:

Access: Request disclosure of personal information held by us
Correction, Addition, Deletion: Request correction, addition, or deletion when personal information is inaccurate
Suspension or Erasure: Request suspension or erasure of use when personal information is used beyond the scope of the stated purpose
Data Portability: Request provision of learning data (we will respond to the extent technically reasonable)

The above requests can be made through the Service's contact feature. We will respond within a reasonable period after verifying identity.

10. Changes to This Policy

We may change this Policy without notice to users, except as otherwise provided by law or this Policy.
Unless otherwise specified by us, the revised Privacy Policy shall take effect from the time it is posted on the Service.

11. Contact

For inquiries regarding this Policy, please use the contact feature within the Service.

End of Policy