Privacy Policy

When you create an account and use StudyHaul, we may collect:

• Account information: email address, display name, and profile photo (via email/password or Google authentication through Supabase Auth)
• Professional and exam data: your professional field, target exam(s), exam date, and preferred study duration
• Diagnostic and assessment results: answers, scores, and performance data from diagnostic exams, practice exams, progress checks, and weakness-targeted drills
• Question Bank data: practice exam responses, per-question timing, scores, and mode selection (mock, custom, missed questions, quick drills)
• Study session history: topics studied, time spent, study material interactions, and learning progress
• Flashcard usage data: deck access, card review responses, spaced repetition progress, field masking preferences, and study mode selections
• Practice Lab data: text prompts you submit for custom session generation, generated session content, and quality ratings (Bad/So-So/Good) you provide as feedback
• Payment information: billing details processed securely through Stripe (we do not store full credit card numbers on our servers)
• Credit usage data: credit balance, purchase history, consumption records for AI features, and flashcard deck purchase records
• Content protection data: the platform implements digital watermarking using your account email and may log content access patterns to detect unauthorized copying or scraping
• Referral data: referral codes and associated referral activity
• Waitlist information: email, profession, target exam(s), and study timeline provided during waitlist registration
• Testimonial submissions: if you choose to share your story, the experience text you write, an optional star rating, an optional indication of whether you passed your exam, and an optional exam name

If you consent to advertising cookies, we use Google Ads and Meta (Facebook) conversion tracking to measure the effectiveness of our ad campaigns. This may set cookies on your device (such as _ga, _gcl_*, _fbp, and _fbc). These cookies are only loaded after you provide consent through our cookie banner, and only on our public marketing pages — never on your study, exam, or dashboard pages.

Only if you have consented to advertising cookies, we send Meta a one-way (SHA-256) hashed version of your email address at two points, through Meta's Conversions API, so we can measure which ads are working: when you complete a purchase, alongside the purchase amount; and when you finish setting up your account, alongside the profession you selected (for example "pharmacy"), so we can tell whether our ads are reaching the fields we build for. Both are sent from our server, not your browser. We never send your name, your school, your study activity, your exam content, or your scores to Meta.

We use the information we collect to:

• Create and manage your user account
• Generate personalized study plans based on your diagnostic results and knowledge gaps
• Produce AI-generated study content, flashcards, practice questions, and custom study sessions tailored to your weak areas
• Filter content by your stated profession so you see only relevant materials
• Track your study progress, flashcard mastery, and question bank performance to provide personalized analytics
• Identify missed questions and weak domains to power targeted practice modes
• Process payments, manage your credit balance, and track flashcard deck purchases
• Send you account and license notifications, study and exam reminders, onboarding guidance, and occasional product updates
• Improve our AI algorithms, content quality, and generation accuracy using anonymized usage data and session quality feedback
• Protect platform content through digital watermarking and access pattern monitoring
• Publish and promote testimonials and success stories you choose to submit, as described in our Terms of Service
• Provide customer support

We will never sell, rent, or share your personal information with third parties for marketing purposes.

We use the following third-party services to operate:

• Supabase for user authentication (email/password and Google OAuth), database hosting, and file storage.
• Stripe for secure payment processing. When you make a purchase, your payment details are handled directly by Stripe, and we share your name and email address with Stripe so it can create and manage your customer and payment records. Their privacy policy is available at stripe.com/privacy.
• Anthropic (Claude AI) for generating personalized study content, practice questions, flashcard decks, custom study sessions, and educational materials. When generating content tailored to your learning needs, we may send your exam performance data (such as domain scores and identified weak areas) and your Practice Lab prompts to Anthropic's API. We do not send your name, email, or other personally identifiable information. Anthropic's data usage policy is available at anthropic.com/privacy.
• Google (Gemini AI) may be used for certain content generation tasks including flashcard creation and question generation. The same data protections apply — we do not send personally identifiable information to Google's AI APIs. Google's privacy policy is available at policies.google.com/privacy.
• Replit for web application hosting. Replit's privacy policy is available at replit.com/site/privacy.
• Cloudflare for DNS and email routing. We do not use Cloudflare for analytics or for serving website content.
• PostHog for first-party product analytics — to understand how our public pages and signup flow are used so we can improve them. We run PostHog without cookies (no cross-session tracking identifier is stored on your device), we capture only specific page and conversion events (never your study activity, exam content, answers, or scores), and we honor Do Not Track and Global Privacy Control signals. This data is ours alone and is never shared with any advertising network. PostHog's privacy policy is available at posthog.com/privacy.
• Resend for delivering transactional emails — such as license expiration warnings, license activation reminders, referral notifications, and exam-eve reminders. We share your email address and first name with Resend solely so these messages can be delivered. Resend's privacy policy is available at resend.com/legal/privacy-policy.
• Loops for delivering onboarding and lifecycle emails — such as welcome messages and study nudges. We share your email address, first name, and limited activity signals (whether you have completed a diagnostic, your most recent exam name, and whether you joined through a referral) so these emails can be timed and personalized. You can unsubscribe from these emails at any time using the link in each message. Loops's privacy policy is available at loops.so/privacy.
• Google Ads for measuring the effectiveness of our advertising campaigns. Advertising cookies are loaded only if you opt in through our privacy banner. When you consent, Google may place cookies on your device to measure ad conversions. Google's privacy policy is available at policies.google.com/privacy. You can opt out at any time using the "Your Privacy Choices" link in the footer of any page.
• Meta Platforms (Facebook/Instagram) for measuring the effectiveness of our advertising campaigns. The Meta Pixel loads only if you opt in through our privacy banner, and only on our public marketing pages — never on your study, exam, or dashboard pages. We run the pixel with Advanced Matching disabled, which means it does not collect information you type into forms. The only personal information we send Meta is a one-way hashed email, the purchase amount for a completed purchase, and the profession you select when setting up your account (all via Meta's Conversions API, server-side, with your consent) so we can measure ad conversions. We never share your school, study activity, exam content, or scores with Meta. Meta's privacy policy is available at facebook.com/privacy/policy. You can opt out at any time using the "Your Privacy Choices" link in the footer of any page.

StudyHaul uses artificial intelligence to generate study materials, practice questions, flashcard decks, case-based study sessions, and explanations. Your exam data, diagnostic results, study history, and Practice Lab prompts may be processed by our AI systems to personalize content to your learning needs.

• We do not use your personal data to train third-party AI models
• Admin-curated content (knowledge modules, standard flashcard decks, exam questions) is reviewed by professionals before publication but may still contain errors
• User-prompted content (Practice Lab sessions, custom flashcard decks) is AI-generated and is NOT reviewed by professionals — accuracy is not guaranteed
• Session quality ratings you provide are collected anonymously to improve AI generation quality

To protect our intellectual property and the investment of our content creators, StudyHaul implements technical content protection measures on all authenticated pages:

• Digital watermarking: Your account email is embedded as a subtle watermark in displayed content. This watermark is used solely to identify the source of any unauthorized content distribution and is not used for advertising or tracking.
• Access monitoring: We may monitor for developer tools usage and automated scraping patterns. This data is used exclusively for content protection and is not shared with third parties.
• Copy prevention: Text selection, right-click, and keyboard copy shortcuts are disabled on content areas. These measures do not affect your ability to use input fields or interact with the platform normally.

We retain your account information and study data for as long as your account is active. If you delete your account, we will remove your personal data within 30 days, except where we are required by law to retain certain records (such as payment transaction records). Waitlist data is retained until you are onboarded or request deletion. You can request deletion of your data at any time by emailing us.

We implement industry-standard security measures to protect your data, including encrypted connections (HTTPS), secure authentication through Supabase, and PCI-compliant payment processing through Stripe. However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

You have the right to:

• Access the personal data we hold about you
• Request correction or deletion of your data
• Export your study data and score reports
• Opt out of non-essential cookies and tracking at any time using our cookie preferences banner
• Unsubscribe from non-essential email communications at any time
• Delete your account and all associated data

If you are a California resident, you have the right to know what personal information we collect, request its deletion, and opt out of any sale or sharing of personal information.

We do not sell your personal information. Google Ads and Meta (Facebook) conversion tracking, when active with your consent, may constitute "sharing" of personal information under the CCPA. This sharing is limited to advertising measurement: identifiers (such as cookie IDs), a one-way hashed email, the purchase amount for a completed purchase, and the profession you select when setting up your account. We never share your school, study activity, exam content, scores, or in-app behavior with Meta or Google. You can opt out at any time using the privacy banner on our site or the "Your Privacy Choices" link in the footer of any page.

We honor Global Privacy Control (GPC) signals. If your browser sends a GPC signal, we will not load non-essential tracking cookies and we will not transmit any purchase data to advertising partners.

To exercise your other California privacy rights, contact us at the email below.

We may use essential cookies for authentication session management. These do not require consent.

With your consent, we use Google Ads conversion tracking (tag ID AW-581393377) and the Meta (Facebook) Pixel to measure the effectiveness of our advertising campaigns. When enabled, these services may set the following cookies on your device:

• _ga — Distinguishes unique visitors (expires after 2 years)
• _gcl_* — Stores ad click information for conversion measurement (expires after 90 days)
• _fbp — Meta browser identifier used to attribute ad conversions (expires after 90 days)
• _fbc — Stores Meta ad click information for conversion measurement (expires after 90 days)

These cookies are only loaded after you provide consent through our privacy banner. The Meta Pixel additionally runs only on our public marketing pages — never on your study, exam, or dashboard pages — and we run it with Advanced Matching disabled, so it does not collect information you type into forms. You can change your preference at any time by clicking "Your Privacy Choices" in the footer of any page. If your browser sends a Global Privacy Control (GPC) signal, non-essential cookies are automatically disabled.

We do not sell your personal information. Google Ads and Meta (Facebook) conversion tracking, when enabled with your consent, may constitute "sharing" of personal information under certain state privacy laws. That sharing is limited to advertising measurement, and we never share your study activity, exam content, or scores. You can disable this tracking at any time through our cookie consent preferences or by enabling Global Privacy Control in your browser.

StudyHaul is intended for users who are at least 18 years of age. We do not knowingly collect information from anyone under 18. If we learn that we have collected data from a person under 18, we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify registered users of significant changes via email or through in-app notifications. Continued use of StudyHaul after changes constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or want to exercise your data rights, email StudyHaul.