Privacy policy

Who is responsible

StudyHub, Uppsala. Contact: [email protected]. We are the data controller for what's described here.

What we collect

• Your account: email address and your name, so that we can greet you. The name comes from Google when you sign in with Google, otherwise from Studium when you connect Canvas AI. We have no passwords.
• What you do in the courses: which sections you open, how you answer, how long you spend, which mock exams you take.
• The knowledge model: an estimate per concept of how well you know it, plus a profile of which error types are most common for you.
• Your conversations with StudyHub Coach: the question, the answer, and where in the course it was asked.
• Canvas AI: your Canvas token, encrypted, which university and which Canvas account it belongs to, your name in Studium, and what Canvas AI reads in from the courses you've chosen. See the terms for Canvas AI.
• Your profile picture: if you sign in with Google, we show the picture from your Google account. We store the address of the picture, which Google sends when you sign in, but no copy of the picture itself.
• Purchases: amount, VAT, date and Stripe's reference number. We never see your card number.

Why, and on what legal basis

• To deliver the service (contract): without your answer history there is no plan, no repetition queue and no forecast.
• To improve the content (legitimate interest): we count how many people get stuck on a given section. That statistic is aggregated and carries no link to individuals.
• For accounting (legal obligation): purchase records are kept for seven years under Swedish accounting law.

Who else is involved

We don't sell any data on, and we use no advertising or behavioural tracking across other sites.

• Supabase (EU): database and sign-in.
• Vercel: runs the website.
• Cloudflare: routes and protects traffic to the website. From your IP address, Cloudflare or Vercel works out roughly which town you are in. We only use it while the page is shown, so that the colours follow the sun where you are and Canvas AI can suggest the university nearest you, and we never store it.
• Stripe: payments. They handle the card details; we never store them.
• Resend (EU): email delivery.
• OpenRouter: routes StudyHub Coach's and Canvas AI's answers to the language model. Your question, or the answer you ask StudyHub Coach to mark, and the current course section are sent there, and your first name, so the answer can address you. Canvas AI also sends your name in Studium, to find you in lists on the course pages (groups, supervisors, presentation times). We never send your email address.

Payments and subscription

If you pay, your card details are handled by Stripe. They never reach our servers. We store what you paid, when, how much and what it covers, because bookkeeping requires it.

If you have Plus, Pro or Max we also store your Stripe customer and subscription IDs, which level you have, what you pay each month, the subscription's status and when the current period ends. That is what's needed to know whether you have access, and for the customer portal to open for you specifically. The free level requires no payment, and then we store no payment details at all.

The founder price: if you are a founder we store your cohort, your founder number and when you subscribed, so that the price and the number stay with you. A place held while you pay is released after 40 minutes if the payment doesn't go through.

The consent and withdrawals: when you buy, we store that you asked to start right away, with the text you ticked and when, because it decides what is refunded if you withdraw. If you withdraw from a contract we store what you entered in the withdrawal function (name, contract and email address), when the withdrawal was received and what was refunded and deducted. That is the basis for the confirmations and for the accounts.

Passes bought before 16 September 2026 remain valid until their end date, and their records are kept the same way as other purchases.

Cancelling the subscription deletes nothing automatically. Accounting records must be kept for seven years under Swedish law; the rest of your profile is yours to control under Your profile.

The Canvas lock

A Canvas account can belong to one StudyHub account at a time, and the starter questions in Canvas AI and the connection bonus are given once per Canvas account. So that this holds also when an account is deleted, we store a checksum of the university and the Canvas account's number, together with when the Canvas account was first connected and whether the starter questions and the connection bonus have been given. The checksum is computed with a secret key and cannot be turned back into the Canvas account. It contains neither your name, your email nor anything else about you.

The checksum remains for twelve months after you delete your account, and is then deleted. If neither the starter questions nor the connection bonus were given, it is deleted within a day. The reason is our legitimate interest in the free level not being used over and over with new accounts.

For how long

• As long as you have an account. That's when the data is useful to you.
• If you delete your account everything goes immediately, with the exceptions below.
• An account inactive for three years is deleted automatically. We email you first.
• The exceptions: purchase records must be kept for seven years under Swedish accounting law. We anonymise them instead: the link to you is broken, the amount and VAT remain. A withdrawal is kept for seven years with the name and email address from the withdrawal, since it is the basis for the refund, and the consent from the checkout for seven years with the purchase. The checksum for the Canvas lock remains for twelve months (see above).

Your rights

Under Your profile you can, without asking us:

• See what the knowledge model thinks about you, concept by concept.
• Correct it. If you say a judgement is wrong it's reset and measured again.
• Download everything we hold as JSON, in machine-readable form.
• Delete your account and everything belonging to it.

Where the data lives

The database and email delivery are within the EU. Some providers (Vercel, Stripe, OpenRouter) may process data outside the EU/EEA under the European Commission's standard contractual clauses.

You also have the right to object to the processing and to complain to the Swedish Authority for Privacy Protection.

Changes

If we change something that matters to you, we email before it takes effect. We don't change things quietly.