Privacy policy

When you use our application (“App”), we appreciate that you are trusting us with your personal information. In this privacy notice, we seek to explain to you in the clearest way possible what information we collect, how we use it, and what rights you have in relation to it.

1. Information we collect

We collect information that you voluntarily provide to us when you set up your profile and interact with the App. The specific data points we collect include:

Personal and academic configuration

• Student name: the name or nickname you enter during onboarding.
• Academic level: your year group or qualification level (e.g. GCSE, A-Level Year 12/13).
• Language preference: your preferred language for study (English or Welsh/Cymraeg).
• Exam boards: the specific boards you are studying under (e.g. AQA, OCR, WJEC/CBAC).
• Subjects and topics: the list of subjects and specific syllabus topics you create or add.
• Exam dates: dates, papers, and times for your upcoming exams.

Account information (optional)

• Email address: if you choose to create a Cloud Account for data backup, we collect the email address and password you provide. This is managed through Firebase Authentication.
• Subscription information: if you subscribe to Premium or Pro, your subscription status is managed by RevenueCat. We store a unique user ID to link your subscription across devices.

Usage and performance data

• Study statistics: total time spent studying, current day streak, and last active date.
• Progress tracking: which flashcards you have viewed, quiz scores, and your “Mastery” level (Standard, Elite, Mastered) for specific topics.
• XP and ranks: experience points earned from study activities and your current rank progression.
• Neural Syncs: a count of your interactions with our AI generation tools.
• Game data: high scores for revision games and results from “Parent vs Student” challenges.

Generated content

• AI tutor history: the text logs of your chat conversations with the OmniStudy AI mentor, including any images you upload for homework help.
• Cached sessions: revision notes, flashcards, quizzes, and exam questions generated by the AI are stored on your device to speed up loading times and allow offline access.
• Source Library documents: notes and past papers you upload are processed to generate practice materials.

2. How we use your information

We use the information we collect or receive for the following purposes:

• To provide the service: to generate accurate, syllabus-specific revision materials (notes, quizzes, exam questions, knowledge organisers) using generative AI.
• To personalise your experience: to tailor the content language (English vs Welsh) and ensure the complexity matches your academic level (GCSE vs A-Level) and tier (Foundation vs Higher).
• To track progress: to visualise your mastery of topics, predict grades, and help you identify areas that need more revision.
• To facilitate AI features: your subject data, questions, and uploaded images are sent to our AI provider (Google Gemini) to generate educational content and chat responses.
• To enable cloud backup: if you create a Cloud Account, your profile data (subjects, progress, settings) is synced to Google Firestore so you can restore it on another device. Tutor chat history and cached sessions are not synced to the cloud.
• To manage subscriptions: to verify your subscription status and provide the appropriate level of access (Free, Premium, or Pro).

3. Third-party AI disclosure

OmniStudy AI uses Google’s Gemini AI to generate study materials, grade your answers, and provide tutoring. When you use these features, your study content (subject names, topics, questions, answers, and any uploaded images) is sent to Google’s servers for processing. No personal information (such as your name or email) is included in these requests. Google’s use of this data is governed by their own privacy policy. These prompts are not used to train public AI models.

4. How we store your data

Local storage priority

To maximise your privacy, OmniStudy AI is designed to store the majority of your personal data (profiles, stats, and revision history) locally on your own device using IndexedDB. This means we do not maintain a central database of your personal study habits unless you opt in to cloud backup.

Cloud backup (optional)

If you create a Cloud Account, your profile data is encrypted in transit and stored securely in Google Firestore. This includes your subjects, progress, settings, and subscription link, but does not include your tutor chat history or cached study sessions.

Cloud processing

When you generate new content (e.g. create a new revision pack or chat with the tutor), specific text prompts are securely transmitted to our backend (hosted on Render) and then to Google’s generative AI API to create the response.

5. Sharing your information

We do not sell your personal information. We only share information with the following third-party service providers as necessary to operate the App:

• Google Gemini (AI provider): we send subject names, topics, chat queries, and uploaded images to Google to generate educational text and images.
• Google Firebase (authentication and cloud storage): if you create a Cloud Account, your email and profile data are stored using Firebase Authentication and Firestore.
• Google Cloud Vision (image processing): used to extract text from uploaded documents in the Source Library.
• RevenueCat (subscription management): manages your subscription status across platforms (web, iOS, Android). RevenueCat receives a unique anonymous user ID, not your personal information.
• Render (hosting): our backend infrastructure processes requests to bridge your app with the AI services.

Subscription reporting for the owner

Existing RevenueCat billing notifications can provide owner-only daily subscription event totals and reported transaction amounts, with production and test purchases kept separate. This reporting does not copy customer identifiers, names, emails, product identifiers or full billing notifications into the analytics database, and does not change your subscription or school access. A hashed notification receipt prevents duplicate counting for 48 hours; daily totals expire after 365 days. Separate hashed billing completion receipts also expire after 48 hours and prevent reporting retries from reapplying a completed access update. These functional safety receipts continue independently of optional analytics. Notifications more than 24 hours old are not added to this reporting, so late deliveries and earlier history may be incomplete. The owner can switch off new reporting writes.

Where separately configured on the server, RevenueCat aggregate reports can also supply current subscription totals and gross revenue. Optional paywall activity is not linked to individual billing records, and we do not infer a personal purchase history or a matched conversion rate from these separate counts. The owner must assess and document the lawful basis and child-specific transparency for this use of billing-derived totals.

Optional app activity and reliability counts

App analytics is off by default. Earlier permission for website analytics does not automatically allow app analytics. You can choose to allow website and app counts using the optional analytics control during student setup or in Settings, and reject them at any time. You do not need to agree or sign in to use the app. The choice stays on that device for up to 180 days; browser privacy signals override it.

With your permission, and only while the owner enables collection, web, iOS and Android versions count setup steps, practice starts and outcomes, displayed feedback, later practice after feedback, usage limits, paywall views and purchase attempts. General reliability counts cover interactive login outcomes, cloud-write outcomes and retries, app-ready timing, and controlled client-error categories. Broad subject families, exam boards, qualifications, interface languages and platforms may be counted separately, without pupil or course identifiers. These are event counts, not unique pupils, payment confirmation or evidence of improved results.

App analytics does not include names, emails, account identifiers, school/class codes, questions, answers, marks, prompts, tutor messages, uploads, file names, raw error messages, stack traces or URLs. Tab-local operation receipts and opaque practice handles prevent duplicates. They are not sent as visitor identifiers, are ignored after 24 hours and are removed on subsequent activity, tab closure or rejection. There is no persistent visitor identity, cross-session return tracking or offline analytics queue. Firebase processing, event-receipt retention, daily-aggregate retention and owner-only access follow the limits below.

Public website analytics

Optional first-party website analytics is off by default. You can allow or reject it using “Analytics preferences” on public pages, or the optional analytics control in the app’s Settings. You do not need to agree to use OmniStudy. This choice is stored on that device for up to 180 days and can be changed at any time. Browser Do Not Track and Global Privacy Control signals override an allow choice. Preferences do not sync across devices.

With permission, and only while the owner enables collection, we count public page loads, entry-page categories, broad referring sources, device-size categories, interface language, guide/blog reading engagement, demo outcomes, app-link and App Store clicks, and confirmed school enquiries. We also measure page loading, layout stability and interaction timing where supported. Page loads include repeat loads; clicks are not installs. We do not collect names, emails, account identifiers, school/class codes, question text, answers, marks, tutor conversations, uploaded files, free text, full URLs, query strings or fragments in these analytics.

Google Firebase processes the analytics requests and stores daily aggregate counts. A random event receipt is used only to prevent duplicate deliveries and expires after 48 hours, with scheduled deletion normally within a further hour. It is not a persistent visitor identifier. Abuse prevention uses a keyed, hourly-rotating hash of the connecting IP address, kept for at most two hours plus the scheduled deletion interval. The raw IP is not stored in the analytics database; hosting providers may process IP addresses in their operational logs. Daily aggregates expire after 365 days, with scheduled deletion normally within a further hour. Only authorised owners can retrieve privacy-filtered aggregate reports. Small breakdowns are withheld.

We do not use session replay, heatmaps, advertising integrations, fingerprinting or cross-session visitor tracking. Return rates and cross-session purchase attribution are not configured. There is no analytics history before collection starts. Rejecting stops future optional collection and clears unsent events; previously combined aggregate counts cannot be associated with your account or individually removed. This does not affect your rights over functional account and learning records.

Existing controlled public interaction events may also be sent to Replit’s hosted Umami tracker, if the owner separately enables that platform service and you allow optional analytics. Replit controls any platform-injected automatic pageview tracker. OmniStudy’s preference control cannot retroactively stop a platform script that runs before our code; the owner must leave that automatic collection disabled for a consent-first release. Replit’s own terms and privacy information govern any separate platform analytics.

6. Your data rights

Depending on your location (specifically under the UK GDPR), you have certain rights regarding your personal information:

• Right to access/portability: you can view all your stored data directly within the “Settings” section of the App.
• Right to erase (local data): you may delete all local data at any time by using the “Factory Reset” button in the Settings menu. This will wipe all OmniStudy data stored on your device.
• Right to erase (Cloud Account): if you have created a Cloud Account, you can permanently delete your cloud account and all associated data using the “Delete Account” button in the Cloud Account section of Settings. This removes your authentication record and all synced data from our servers.
• Right to rectification: you can update your name, subjects, and settings at any time within the App.

7. Subscriptions and payments

OmniStudy AI offers Free, Premium, and Pro subscription tiers. Payments are processed securely by Apple (App Store), Google (Google Play), or Stripe (web), depending on your platform. We do not store or have access to your payment card details. Subscription management, including cancellation, is handled through your device’s app store or through the App’s settings.

8. Children’s privacy

We recognise that our users are often students under the age of 18. We take extra precautions to ensure that:

• We do not require personal data (e.g. email addresses or phone numbers) to use the core app. Cloud Account creation is entirely optional.
• We do not use data for targeted advertising.
• We rely on local device storage by default to minimise data exposure.
• The AI disclosure is presented on first use so all users are aware of how their study content is processed.

If you are a parent or guardian and believe we have collected data in a manner not permitted by law, please contact us immediately.

9. Data retention

• Local data: stored on your device until you delete it via Factory Reset or uninstall the App.
• Cloud Account data: stored until you delete your Cloud Account using the in-app Delete Account feature.
• AI processing: prompts sent to Google Gemini are processed in real time and are not retained by OmniStudy after the response is received.
• Optional analytics: daily aggregates expire after 365 days; retry receipts after 48 hours and abuse-prevention keys after two hours, normally deleted within a further hour by the scheduled expiry job. Device preferences expire after 180 days.

10. Changes to this policy

We may update this privacy notice from time to time. The updated version will be indicated by an updated “Last Updated” date and the updated version will be effective as soon as it is accessible.

11. Contact us

If you have questions or comments about this policy, you may email us at support@omnistudy.co.uk. See also our cookies page, safeguarding statement and terms of service.