Privacy Policy

Effective: October 23, 2026

Studyboard is a planner for courses, deadlines, notes and flashcards, run by Connor Pelkmans, who publishes it as Studyboard ("we"). This page explains, in plain words, what we collect, why, who else handles it, how long we keep it and how to delete it. The short version: without an account your work stays on your device; with a free account it is also kept online so it syncs between your devices. There are no ads, and nothing in Studyboard tracks you or sells your data.

Where your planner is kept

You can use Studyboard without an account. Then your courses, tasks, notes, flashcards, grades and settings are saved only on the device you use (in the browser's storage on the website, or in the app's folder on desktop and phone), and nothing leaves it except through the optional features below. With a free account they are also kept in your account on our servers (see Your account and synced data, below), so they are the same on every device you sign in on, and a copy stays on each device so Studyboard keeps working offline. Either way, what always stays on your device and is never sent to us: your daily backups, your AI keys (unless you choose to share them between your devices, described below), and your school-site connections, including a school calendar link or a Canvas access token. If you turn on folder backups, copies are also written to the folder you pick.

On the website, Studyboard asks your browser to keep its storage permanently, so the browser does not clear it on its own to free up space or after a while without a visit. Most browsers agree once Studyboard is installed as an app or added to the Home Screen, and Settings shows whether yours has. Clearing your browser's site data removes this device's copy and its daily backups. Without an account that is everything, so make an account or export a backup now and then; with one, what is in your account stays and comes back when you sign in again (changes made offline that hadn't synced yet are lost). Access tokens and similar secrets are kept locked (encrypted) in the device's secure storage: the system keychain in the apps, and an encrypted store in the browser on the website.

No analytics, no ads, no tracking

Studyboard has no analytics, advertising or tracking tools, and it sets no tracking cookies. We do not track you across other apps or websites, and we do not sell or share your data for advertising. The only things stored in your browser are the ones needed to work: your data, settings and sign-in. Apart from syncing your planner to your account if you have one, Studyboard sends only two things on its own: anonymous crash reports, described next, and anonymous upgrade counts.

Anonymous upgrade counts

When the free plan shows a Studyboard Pro offer, the app adds one to a daily total for that offer (for example "Insights are part of Studyboard Pro: shown"), and does the same when a price is tapped and when Pro is bought after that. Only the offer's wording and the date are counted, with numbers and names taken out. Nothing identifies you or your device, and nothing is stored per person. It tells us which Pro features people want, and it stops whenever Pro isn't on sale.

Anonymous crash reports

When Studyboard hits an error (a crash, a failed sync or a broken screen), it can send a short report so we can fix the bug. A report holds the kind of error and where in the code it happened, the app version, the platform (website, installed app, desktop or iPhone/iPad app), whether you have a free or paid plan, the theme in use, and the last few actions of the app itself (such as which tab was open). It never contains your tasks, notes, courses, files, email address, account id, AI keys or anything you typed, and it is not linked to you: it carries a random number made on your device that is not your account (deleted when you switch reports off) and a one-way scrambled form of your network address, scrambled with a secret only our server holds together with the date, so it can't be traced back or matched from one day to the next, kept with the report only to stop one device from flooding us with reports. We do not use reports for advertising or tracking and never share them. They are kept for about 30 days. This is on by default (off if your browser sends Do Not Track or Global Privacy Control). Turn it off any time in Settings, Send Anonymous Crash Reports. On iPhone and iPad, Apple may also give us crash logs through App Store Connect if you chose to share app analytics with developers in your device's settings. Reports go to our own Supabase project, and, if we turn it on, to Sentry (Functional Software, Inc.), an error-tracking service that receives the same anonymous report and keeps it for no more than 30 days.

Your account and synced data

If you create an account, we store your email address. Your password is never stored or seen by anyone, including us: our hosting provider, Supabase (Supabase Auth), keeps only a salted hash of it (a one-way code), which can check a password you type but can't be turned back into it. No one can look up your password, so if you forget it you reset it by email. Your planner then syncs between your devices (what you made before signing up comes along), so your courses, tasks, notes, flashcards, settings and file records are stored on our Supabase project, in your account. With Studyboard Pro, a weekly backup copy of your planner is also kept in your account for 30 days, so you can restore an earlier version. Each account can only read its own rows (what you post in a study group is the one exception: the group's members can see it, as described below). We also keep the name and type of each device signed in to your account, how much storage your account uses (for the plan limits), and your plan status. Your AI keys stay on the device unless you turn on AI Keys on All My Devices in Settings (or use Add AI to Another Device, described under AI below): then they are locked on your device with a passphrase only you know, and only the scrambled copy is stored, so we cannot read them. They are always left out of the backup files you export. School calendar links and Canvas access tokens are never synced. Your newest companion chats are also synced to your account. When you make an account we also ask for your birthday, once, to apply age rules: it is never shown to anyone. Students under 13 need a parent or guardian to create the account with the parent's own email and agree on the child's behalf; those accounts can't publish or share with a public link.

Like any online service, the people who run the server can technically reach what is stored on it. We only look at it to keep the service working, fix a problem you ask us to look into, or comply with the law.

Uploaded files

Files you attach (for example PDFs and images) are stored in a private storage area of our Supabase project, in a folder that only your account can open. On the website, attaching files needs an account, and the files are kept there rather than in your browser; the desktop app also keeps a copy in its folder on your computer. Photos you choose for your own theme are stored the same way, so they follow you to your other devices. They count toward your plan's storage limit and are deleted when you delete them or your account.

Optional: AI features, with your own key

AI is off until you add your own key from Google (Gemini), Anthropic (Claude) or OpenAI and agree, in a prompt that names the company, to send content to it. When you use an AI feature, the content it needs (for example task titles, notes, a syllabus or PDF you import, flashcards, your question, or the text of your items when you use search by meaning) is sent straight from your device to the provider you chose, using your key. It does not pass through our servers. If you're signed in and haven't added a key, you can try AI a few times for free: those requests go to Studyboard's trial server, run on Cloudflare, which passes them to an open AI model (Google's Gemma) run by Cloudflare's Workers AI service and sends the answer back, so Cloudflare processes what you send to produce the answer. The trial server keeps only a count of your tries and whether you passed its one-time robot check, under your account id, and deletes both when you delete your account. It never stores what you send. If the robot check (Cloudflare Turnstile) is switched on, Cloudflare sees your network address while it runs. If you use Add AI to Another Device, your keys are locked (encrypted) on your device with a one-time code, and only the locked copy is left with our key relay, which runs on Cloudflare. It is deleted as soon as your other device collects it, or after 10 minutes at most, and we can't unlock it, because the code never reaches our servers. That provider's own terms and privacy policy apply, and they decide how long they keep it. On Google's free tier, Google may use what you send to improve its products, so do not send anything private. You can switch AI off and remove your key at any time. Studyboard never uses what you send, or anything in your planner, to train AI models. AI answers can be wrong, so check dates, grades and facts; a reply to a school message that AI drafted for you is marked as drafted by AI.

Optional: your school's learning platform

If you connect Brightspace, Canvas or Blackboard, the connection stays on your device. In the desktop and phone apps you sign in on your school's own page (Studyboard never sees your password) and the sign-in is kept in a private store on that device. On the website, the Studyboard School Sync browser extension does this instead (below). The apps then read your own school work through the platform's own interface, a few requests at a time, and each request from the desktop app names Studyboard as the app asking, so your school can always tell it apart.

Grades, feedback and messages from your school are private (in the United States they can be protected by FERPA). What Studyboard brings in (your courses, due dates, submission status, grades, feedback and rubrics, announcements, the syllabus and your instructors' names and school email addresses) becomes part of your planner: kept on your device, and stored in your account on our servers (Supabase) if you have one, so it syncs between your devices. Your school Inbox messages are never stored in your account: they are read when you open them, or kept on the device that read them. We never sell this data, share it, publish it or use it for anything except showing your own school work to you, and you can delete it with your account at any time. Studyboard is an independent app: it is not affiliated with, endorsed by or sponsored by Instructure (Canvas), D2L (Brightspace) or Blackboard.

The Studyboard School Sync browser extension (for Chrome, Edge and Firefox) reads your school site by itself. It can read only the school site you connect in it, and only after your browser asks you and you allow it; you can remove that permission any time, in the extension or in your browser. About every hour, and when you open that site, it reads your courses, due dates, submission status, grades, feedback and rubrics, announcements, the names and school email addresses of your instructors and teaching assistants, the course syllabus and, for Canvas, your Inbox messages, with the sign-in your browser already has. It only reads: it never submits, posts or changes anything on your school site, and it never sees your password. What it reads is kept in your browser's storage for the extension and handed to Studyboard when you open studyboardapp.com in the same browser; the extension itself sends nothing to Studyboard's servers or to anyone else, and it has no analytics or tracking. Once Studyboard brings it into your planner, it is treated like everything else in your planner: kept on your device, and in your account if you have one (above). Removing a school in the extension, or uninstalling it, deletes what it kept. We do not sell this data, use it for advertising or credit decisions, or use it for anything except showing your own school work in your planner. Studyboard School Sync's use of information it receives complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.

If you paste a calendar link instead, it is saved on that device only. It works like a password to your calendar, so it is never synced to your account and never put in a backup or export. On the website and phone the link is passed through a small function on our server that fetches the calendar for you and stores nothing. Studyboard does not ask for or use Canvas access tokens. A token an earlier version saved on a device is deleted from it, and you can also delete it in Canvas (Account, Settings). Studyboard only reads from your school's site. What it brings in (due dates, grades, announcements) becomes part of your planner and syncs to your account like everything else if you have one.

Optional: reminders, calendar link, study groups

Phone and desktop reminders need your device's push address and your upcoming reminders (task titles and times for the next two weeks) to be stored on our server so a notification can arrive when Studyboard is closed. The notification itself is delivered by your browser or phone maker's push service (Google, Apple or Mozilla). Calendar Sync stores a private link token and your choices so your calendar app can fetch your deadlines. Study groups, shared decks and Study Together rooms share the display name and the decks, deadlines and messages you choose to share with the people in that group. Members of a group can see what is posted in it and who posted it, including messages, shared tasks, quiz scores, check-ins and focus time. Someone with a group's invite code can see only its name, course, member count and owner's name before joining. If you report something in a group, the report keeps a short copy of what was reported so we can review it. Turn any of these off, or leave a group, and it stops. Voice and shortcut capture (optional, for example "Hey Siri, add a task") stores a private capture token (only a hash of it, shown to you once) and the short notes you send, in an inbox on our server until your app collects them; you can revoke the token any time, and everything is deleted with your account. Email to Studyboard (Pro, optional) gives you a private email address. An email you forward to it passes through our email service (Cloudflare) and waits in the same inbox on our server, as its subject, the sender's address and up to 6,000 characters of its text, until your app collects it (it is then deleted within 7 days, and after 30 days at the latest). Your app reads it, with your AI provider if you have agreed to that, and shows you what it found before anything is added. You can make a new address or turn it off at any time. Two-way calendar sync (Pro, optional) connects your Google or Outlook calendar when you ask it to. We keep that account's sign-in, encrypted, so Studyboard can keep a calendar called Studyboard up to date there; it only ever writes to that calendar. For Outlook, if you choose, it also reads your other events (with their titles, or as busy times only); for Google Calendar it doesn’t read your other events so your plan can work around them, and they are saved in your planner like your other events. Disconnect any time, which also removes our access; it is deleted with your account. Record a Lecture (Pro, optional) uses your microphone only while you are recording. Live captions use your browser's own speech service, which may send the audio to the browser's maker (Google, in Chrome). A recording you choose to keep is stored with your files, and Transcribe with AI sends the audio to Google with your own key, like other AI features. Share links and the Course Library: when you make a link for a deck, note or quiz, anyone who has the link can see its text and your display name, without an account, until you stop sharing it. A deck you list in the Course Library can be found by anyone who looks up that course code; it shows your display name, the school you picked and how many people saved a copy. Published flashcards and quizzes: if you choose Publish on a shared deck or quiz, it gets a public page on studyboardapp.com that anyone can find, including through search engines such as Google, showing its cards or questions, your username, your school and when it was updated, until you unpublish it. Your username is chosen by you, unique, and also visible to people you share with. Your study progress, photos and stickers are never shared. Shared items can be reported, and we review reports.

Optional: Google Drive and OneDrive

If you connect Google Drive or OneDrive, Studyboard can save your files, lecture recordings and (if you turn it on) automatic backups there instead of in Studyboard’s storage, and open them again when you ask. Our server keeps the sign-in Google or Microsoft gives us, encrypted, and uses it only to give your own Studyboard a short-lived key; your files travel straight between your device and Google or Microsoft, never through our server. Studyboard keeps only each file’s name, size, link and where you filed it, with your other data.

Google Drive: Studyboard asks only for access to the files it creates (in a folder called “Studyboard”); it can’t see anything else in your Drive. OneDrive: Studyboard saves into the folder you choose and reads only the folders you ask it to watch. It never deletes anything in Google Drive or OneDrive. A file’s contents are read only when you ask (to open, summarize or study from it), and go to an AI service only if you allowed AI for that account (a checkbox when you connect it, which you can change any time in Files, Cloud) and then use an AI feature on that file. Studyboard’s use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. Disconnect any time in Files, Cloud (or in your Google or Microsoft account settings); deleting your Studyboard account deletes the stored sign-in too.

How Studyboard uses Google user data

This section covers what happens when you connect a Google account to Studyboard: Google Drive or two-way calendar sync with Google Calendar (Pro). Both are optional and start only when you ask.

What Studyboard accesses: your Google account’s email address, to show which account is connected. For Google Drive, only the files Studyboard itself creates (Google’s “drive.file” permission); it can’t see or open anything else in your Drive. For Google Calendar, only a calendar called Studyboard that Studyboard creates and keeps up to date (Google’s “calendar.app.created” permission). Studyboard doesn’t read your other Google calendars or their events.
How it is used: only to provide the feature you turned on: saving and opening your files, putting your deadlines and study sessions on your calendar, and planning around your other events. Google user data is never used for advertising, never sold, never used to build profiles, and never used to train AI models.
How it is stored and protected: the sign-in Google gives us is kept encrypted on our server (Supabase) and used only to give your own Studyboard a short-lived key. Your files travel straight between your device and Google and are never stored on our server. Studyboard keeps each Drive file’s name, size and link, and the calendar events you chose to bring in, with your other planner data, protected the same way (encrypted in transit, private to your account).
Sharing: we don’t share Google user data with anyone, except the hosting provider that runs Studyboard’s server (Supabase), the AI provider you set up when you yourself use an AI feature on a file or event, or when the law requires it. No person at Studyboard reads it, unless you ask us to (for example, for support), it is needed for security, or the law requires it.
Keeping and deleting it: it is kept only while the account stays connected. Disconnecting (Files, Cloud for Drive; Calendar Sync, Two-Way for Calendar) deletes the stored sign-in from our server and asks Google to revoke Studyboard’s access; you can also remove access any time at myaccount.google.com/permissions. Deleting your Studyboard account deletes all of it, and you can ask us to delete it by email at any time. Files Studyboard saved in your Drive stay yours, in your Drive.

Studyboard’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Bug reports and feedback

If you send a report, it includes what you wrote, an optional screenshot you attach, an optional email address for a reply, and basic technical details (app version, browser and device type, screen size, your plan and recent error messages, cleaned of your titles, email addresses and web addresses), and a random number made on your device so its reports can be limited and grouped. If you are signed in, the report is linked to your account. It contains none of your tasks or notes unless you type them. When you report an AI response, the form also fills in that response, which you can shorten or remove before sending. Only the app's owner can read reports.

Payments

Pro is sold through Stripe (website and desktop) or through the App Store and Google Play (iPhone, iPad and Android apps). Stripe and the app stores handle your card and billing details; we never see or store them. We receive only your plan status: whether you have Pro, when it ends and where you bought it. If you pay with Stripe we also keep a Stripe customer id so we can open your billing page. Purchases in the iPhone, iPad and Android apps are checked through RevenueCat (RevenueCat, Inc.), which receives your account id (a random number, not your email), the store's purchase record and your device's platform so it can confirm the subscription with Apple or Google and tell us your plan status.

Email delivery

Emails we send you (confirming your address, resetting your password, signing in) are sent through our email delivery provider, Supabase, which handles your email address and the message so it can be delivered. We send no marketing email.

Other services we use

Studyboard runs on Supabase (accounts, sync and storage). The website and the web app are delivered by Cloudflare, which hosts them and, like any web host, sees your IP address and the pages you load; Cloudflare also runs the AI trial and the key relay described above. On the website, fonts, the sign-in library and the PDF reader are served from the same site as the page, so no other third party is contacted for them. If the sign-in library's copy can't be loaded the page falls back to a public content network (jsDelivr), which can then see your IP address as for any web page. Studyboard also contacts the AI provider you chose, only when you use AI, and Stripe when you pay on the website. If you download the Windows or Mac installer from our website, the file is delivered by GitHub, which can see your IP address as for any download. That desktop app also asks GitHub about once a day whether a newer version is out, so it can tell you; GitHub sees your IP address, and nothing else is sent.

How long we keep things

Your account and planner: until you delete them. Deleted items are remembered for 45 days only so your other devices can catch up.
After you delete your account: your data is removed from our database and storage straight away. Encrypted backups can hold a copy for up to 30 days before they are overwritten; nothing is restored for a deleted account.
Payment records: Stripe and the app stores keep them as tax and accounting law requires. We keep a log of payment events (such as a renewal or a cancellation) linked to your account for up to 120 days so your plan stays right, then delete it. When you delete your account, your Stripe customer profile is deleted and any payment records we still hold lose their link to you.
Crash reports: kept for about 30 days, then deleted. They are anonymous and not linked to your account.
Study group reports: kept for up to a year. The copy of what was reported is cleared 90 days after the report is handled.
AI trial count: until you delete your account.
Bug reports: kept only as long as needed to fix the problem, and never longer than 180 days (screenshots attached to a report are deleted after 30 days). Reports sent while signed in are deleted with your account.
Free trial record: if you had a free trial or the free week of Pro that new accounts get, we keep a one-way scrambled code (a hash) made from your email address, also after your account is deleted, only so the same address can't get another one. It can't be turned back into your email address.

Your choices and your data

Export: Settings, Data and Backups, Export a Backup File gives you everything in one file.
Get a copy of your data (access and portability): Settings, Data and Backups, Export My Data makes a ZIP with one JSON file and spreadsheet (CSV) files of your tasks, notes, grades, flashcards, courses, schedule and study sessions. It is made on your device, works offline, and never includes AI keys, access tokens, school calendar links, sign-in details or device ids.
Deleted by mistake: things you delete wait in Settings, Data and Backups, Recently Deleted for 30 days (synced with your account like the rest of your data), then are removed for good.
Delete everything on this device: Settings, Data and Backups, Clear All Data. Clearing your browser's site data also removes it.
Delete your account and online data: Settings, Account and Sync, Delete My Account and Data. This removes your account, synced data, uploaded files, reminders, devices, calendar links and calendar connections, your Studyboard email address and plan record from our server, and cancels a card subscription for you. Study groups you own pass to another member, or are deleted if nobody else is in them, and your group messages are deleted. Subscriptions bought through the App Store or Google Play must be cancelled by you in your store account, because we cannot cancel them. You can also email us from the address on the account to ask for deletion.
Your rights: depending on where you live (for example the EU, UK or California) you may have the right to access, correct, delete or port your data and to object to its use. Use the steps above, or contact us.

International transfers

Our servers are in the United States (US West). Supabase, Cloudflare, Stripe, RevenueCat, Sentry, our email provider and the AI provider you choose may process data in other countries, including the United States. Where the law requires it we rely on safeguards such as standard contractual clauses.

Children

Studyboard is for students aged 13 and over. In the European Economic Area and the UK, where the age of digital consent is higher in some countries (up to 16), a person under that age needs a parent or guardian's permission to make an account. If you are younger than 13, please do not create an account. If you think a child has given us personal data, contact us and we will delete it.

Security

Connections are encrypted (HTTPS). Each account can only read its own rows, and plans can only be changed by our payment system, never from your device (apart from starting a free trial once, when one is offered). No system is perfectly safe; if something affecting you goes wrong we will tell you.

Changes and contact

If this policy changes in a way that matters, we will update the effective date above and tell you in the app. Questions or requests about your data: support@studyboardapp.com.