Privacy Policy

Last updated 26 September 2026

Draft. This policy hasn’t been reviewed by a lawyer or by the school yet. It describes what the software actually does today, in plain language, but it may change before StudyNest is offered more widely. Text marked [placeholder] still needs to be filled in.

The short version

StudyNest stores what you type into it so it can be your study planner.
Your data is used only to run your own planner. It isn’t sold, and it isn’t shown to other students.
You can download all of it, or delete your account and everything in it, from Settings at any time.

If you’re under 18

[Placeholder — confirm wording and any parental-consent requirement before launch] Most people using StudyNest are school students, so here it is plainly: StudyNest keeps your name, email, school and year group, plus your study records, so it can plan your revision. Nobody else can see them, we don’t sell them, and you can delete them whenever you want. If you’re under 18, it’s a good idea to show this page to a parent or guardian before you sign up.

What we store

Account data

Your email address, used to log in.
Your display name (we ask for a first name).
Your school and year group, if you enter them during setup.
Your password, stored only as a salted scrypt hash. We can’t read it.
Settings you choose, such as light or dark theme and your exam dates.

Academic data

The subjects you take, with your level, papers, options, target grades and exam dates.
Your progress on each syllabus topic and subtopic, including confidence ratings.
Past papers you record: marks, dates, time taken and notes.
Your error log: the mistakes you write down, corrections and reattempt dates.
Your study blocks, school timetable, free-time windows and weekly hours target, and which blocks you marked done.
Your tasks and a short activity history (for example “Completed 2.3 Ionic bonding”).

Technical data

A login cookie (sn_session) that keeps you signed in for up to 30 days. The server stores only a hash of it, with your browser’s user-agent string so you can recognise the session.
To slow down password guessing, the server briefly remembers login attempts by IP address, in memory only. This isn’t written to the database.
Your browser stores your theme choice and the date of the last automatic catch-up in local storage. This stays on your device.

StudyNest doesn’t use advertising, third-party trackers or analytics, and every file it loads (including fonts) comes from StudyNest’s own server.

How it’s used

Only to run your own planner: showing your progress, building your weekly plan, reminding you about tasks and reattempts, and letting you export your data. Your data isn’t sold, rented or shared with advertisers, and it isn’t shown to other students.

Possible future: anonymous usage statistics

We may later look at aggregate, non-identifying statistics to improve StudyNest, for example how many students use the week planner or how long planned blocks usually last. If we do:

the numbers will be aggregate and won’t identify you;
they will never be sold or shared outside StudyNest;
anything that compares you with other students (for example “you’re ahead of most people taking 9701 Chemistry”) will need your separate, explicit opt-in first, and will be off unless you turn it on.

None of this exists yet. This policy will be updated before it does.

Who can see your data

You, through your account. The people who run the server can technically access the database to keep it working and fix problems. [Placeholder — name who operates the server once hosting is agreed with the school’s IT department]

Downloading and deleting your data

Download: the Export JSON button in Settings gives you everything in your account as a JSON file.

Delete: the Delete account button in Settings asks for your password and then permanently deletes your account (the DELETE /api/account request). This removes:

your account data (email, name, school, year group, password hash and settings);
all your academic data: subjects, topic progress, past papers, error log, study blocks and their done records, school timetable, schedule preferences, tasks and activity history;
all your login sessions, so every device is signed out.

Deletion happens straight away and can’t be undone. Backup files you downloaded yourself aren’t affected. Copies in server backups, if the host keeps any, are removed when those backups expire. [Placeholder — state backup retention period once hosting is decided]

How long we keep it

For as long as your account exists. Login sessions expire after 30 days.

Security

Passwords are hashed with scrypt, session tokens are stored hashed, and every request that changes data must come from StudyNest itself. No system is perfectly secure, so use a password you don’t use anywhere else.

Changes

If this policy changes in a way that affects how your data is used, we’ll say so in the app before the change takes effect.

Governing law

[Placeholder — fill in once you know]

Contact

Questions or requests about your data: [Placeholder — contact email]