Privacy Policy

This Privacy Policy explains how StudySolutions (“we,” “us,” or “our”) collects, uses, stores, and shares personal information when you visit studysolutions.app or use any of our services, including our Turnitin similarity and AI reports, the AI Humanizer, and our document unlock tools.

Data controller. StudySolutions is the controller responsible for the personal information described in this policy. If you have any privacy question, request, or complaint, contact us at support@studysolutions.app. This is the only support address we operate — please disregard any message claiming to represent us from a different domain.

Who this applies to. This policy applies to everyone who creates an account, makes a payment, uploads a document, submits text to our tools, or otherwise interacts with StudySolutions. By using our services you confirm that you have read this policy and understand how your information is handled.

We collect the following kinds of information:

• Account data. Your email address, optional display name, and hashed credentials managed by Supabase Auth. If you sign in with Google or Discord, we receive basic profile fields from that provider: name, email, avatar, and the ID of that account.
• Subscription and payment status. Your plan tier, subscription state, renewal date, and a record that a payment succeeded or failed. Card details and PayPal account credentials are handled entirely by Stripe and PayPal — we never see or store full card numbers.
• Service usage records. Quota counters and a usage history for each tool, including timestamps, which service was used, word counts submitted to the Humanizer, and the filenames and domains associated with your Turnitin and unlock requests.
• Uploaded documents and submitted text. Documents you upload for Turnitin similarity and AI reports, and text you paste into the Humanizer. We use them to produce your result, and we also keep copies. See Document & File Handling for exactly how these are handled.
• Support communications. Emails you send to support@studysolutions.app and messages or files you send through the in-app support chat, along with any information you include so we can help you.
• Preferences. Your selected locale (language), theme, and similar interface settings.
• Technical logs. Standard server logs — IP address, browser user-agent, request path, response status, and timestamps — kept for a short period so we can debug issues and defend against abuse. Our authentication service (Supabase Auth) also keeps a log of account events, such as sign-ups, sign-ins, and linking a Google or Discord account; some of these entries include the IP address.

What we do not collect. We do not ask for phone numbers, addresses, government IDs, or academic institution credentials, and we do not attempt to identify you across other websites.

Your information is used only for the following purposes:

• Provide the service. Authenticate you, run your Turnitin, Humanizer, and unlock requests, deliver results, and enforce your plan's quota.
• Process payments. Charge and refund subscriptions, apply promotional codes, and reconcile billing with Stripe, PayPal, and our cryptocurrency payment processor.
• Support and communicate with you. Reply to emails, send transactional messages such as password resets, receipts, and important account or security notices, and confirm changes you make to your subscription.
• Improve reliability. Debug errors, monitor performance, and detect abuse or fraud. Where possible this work happens on aggregated or de-identified data.
• Improve our services. Develop, test, and improve our tools and features.
• Comply with law. Meet tax, accounting, and other legal obligations, and respond to lawful requests when we have to.

Your files are the most sensitive thing you share with us, so this section explains where they go and how long we keep them. If nothing else in this policy stays with you, this section should.

• Turnitin uploads. Files you submit for a similarity or AI report are uploaded over TLS to Cloudflare R2 object storage. The copy used to run your check is deleted automatically after about 24 hours, and the links we generate for you to view or download the resulting report also expire in about 24 hours. Separately, we keep a copy of documents submitted for checks, with details of the check.
• How your report is produced. Your document is processed on servers we rent and by some of the service providers listed under Third-Party Processors (for example, to convert Word files to PDF or to prepare the text for AI scoring). To find matching sources, short passages from your document are sent as search queries to web-search and academic-database services.
• No repository submission. Your documents are not added to Turnitin's student-paper repository, and we do not add them to the sources that our similarity checks compare other people's documents against.
• Humanizer text. Text you paste into the Humanizer is processed by our own humanizer models on servers we rent. If those are unavailable, your request may be handled by a third-party AI provider instead. To show the AI score in the Humanizer, your text and the humanized output are also sent to a third-party AI-detection service. We keep your input and output in your history so you can reopen them, and we also keep copies of them.
• Copies we keep. We store copies of the documents and Humanizer text you submit, and of the reports we produce for them. We never sell them, and we never use them for any malicious or harmful purpose. If you ask us to delete them, we will: email support@studysolutions.app. Deleting your account on its own does not remove them.
• Unlock content. When you use our unlock tools, we fetch the requested content and deliver it to you. We cache retrieved content so we can deliver the same item again; these caches are tied to the content, not to your account, and have no fixed expiry.
• Encryption in transit. Your uploads, API calls, and downloads to and from our services use HTTPS (TLS).

We rely on outside service providers to run StudySolutions. The main ones, and the kinds of providers we use, are listed below with what each one handles. Some of them process data under their own terms and privacy policies.

• Supabase. Hosts our authentication service, primary database, and part of our file storage (US-East region). Handles email, hashed credentials, subscription state, usage records, Humanizer history, support chat, and stored copies of documents' text and reports.
• Vercel. Hosts the application and provides deployment analytics such as page views and performance metrics.
• Cloudflare. R2 object storage for Turnitin uploads, generated reports, and the document copies we keep; secure connections to servers we rent; and email routing for our support address.
• Stripe. Processes card payments and manages subscription billing. Stripe holds card data under PCI-DSS; we only receive a reference and status.
• PayPal. Processes PayPal payments and subscriptions. PayPal holds your PayPal account details; we only receive a reference and status.
• Cryptocurrency payment processor. Processes crypto payments for reseller purchases; we only receive a reference and status.
• Server and GPU hosting providers. Provide the servers and cloud GPUs we rent to process documents and Humanizer text and to convert files.
• AI service providers. Handle Humanizer requests when our own models are unavailable, produce the AI score shown in the Humanizer, help prepare documents for AI scoring, help our support team read and reply to your messages (using your account details where needed), and help our team operate and debug the service.
• Document conversion. Cloud document services convert some Word and similar files to PDF for your report and for Studio.
• Search providers. Receive short passages from your document as search queries, so we can find matching sources for your similarity report.
• Detection and humanizer services. Other AI-detection services, such as Turnitin, and AI humanizer tools receive some documents and Humanizer text so we can compare and improve our results. Submissions to Turnitin use settings that keep them out of its student-paper repository.
• Caching and rate limiting. An in-memory data service holds rate-limit counters and, for up to 31 days, the humanized text of recent Humanizer runs.
• Support tools. An email provider hosts the mailbox that receives email sent to our support address, and a machine-translation service translates support chat messages, and our replies, that are not in English.
• Resend. Delivers account email — sign-up verification, sign-in links, email-change confirmations, and password resets.
• Google and Discord. Optional OAuth sign-in providers. We only receive what you approve at the consent screen. If you link a Discord account, we also add you to our Discord server and update your roles there to match your plan.

We do not sell your personal information, and we do not share it with third-party advertising networks. We do not run banner or programmatic ads on StudySolutions.

If you choose Sign in with Google, Google shares your basic profile with us: your name, email address (and whether Google has verified it), profile picture, and the ID of your Google account. We do not request access to Gmail, Drive, Calendar, Contacts, or any other Google service.

• Use. To run your account: signing you in, showing your name and picture, sending account and service emails, helping you through support, setting up your payment with Stripe if you buy a plan or credits, and preventing abuse of free plans, such as a deleted account signing up again.
• Storage. Kept with your account in our Supabase database, encrypted at rest. If you delete your account, we keep this record so the same Google account can't be used to sign up again (see Data Retention).
• Sharing. Never sold, never used for advertising, and never used to train AI models. It reaches only the processors listed above that run the service (for example Supabase for hosting, Resend for email, and Stripe for payments), or others when the law requires it.
• Your control. You can remove our access at any time at myaccount.google.com/permissions. You can still sign in with your email address afterwards.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We use cookies and similar storage for a limited set of purposes:

• Essential. Keep you signed in, remember your locale, and secure the session. These are required for the service to work.
• Analytics. Vercel Analytics helps us understand aggregate traffic patterns and identify UX issues. These do not personally identify you to us.
• Referral attribution. If you arrive through a creator or friend referral link, we store which link you used in a first-party cookie for up to 30 days so the person who referred you gets credit if you sign up. It is server-signed and not readable by scripts in your browser. We also store a random visitor identifier so repeated clicks on the same link are not double-counted. We do not store your IP address or browser user-agent string with these records — only a one-way cryptographic digest used to detect abuse, a broad device category, and a two-letter country code. If you never create an account, the attribution simply expires.

You can clear or block cookies in your browser at any time. Blocking essential cookies will sign you out and prevent core features from working. Blocking the referral cookie only affects whether the person who referred you receives credit. We do not use tracking pixels for advertising and do not share analytics data with ad networks.

How long we keep each kind of information is listed below. Where we have not set a fixed period, we say so.

• Account and profile data. Retained while your account is active. Deleting your account deactivates it, and only our support team can restore it. We keep the account record, including your email and any connected Google or Discord sign-in, so the same email or sign-in can't be used to sign up again.
• Turnitin uploads and reports. The copy of your upload used to run the check and the report files are deleted automatically after about 24 hours, and view and download links also expire in about 24 hours. Your scores and file names stay in your usage history. We keep copies of submitted documents (and, for some checks, the report or the document's text) until you ask us to delete them.
• Humanizer text. Kept in your history, where you can delete individual entries. We also keep copies until you ask us to delete them; deleting a history entry does not remove those.
• Usage history. Retained while your account is active so you can see what you've run, and kept with the account record after deletion to prevent abuse of free plans.
• Billing and tax records. Retained for the period required by applicable tax and accounting law, even after account deletion.
• Support emails and chat. Kept, with any files you attach, so we can refer to earlier conversations if you contact us again. There is no fixed deletion period.
• Technical logs. Server logs are kept briefly for debugging and abuse prevention, then discarded. The log of account events has no fixed deletion period.

We protect the information we hold with safeguards that include:

• Encryption in transit. Traffic between your browser or API client and our services uses TLS.
• Encryption at rest. Storage layers used by Supabase and Cloudflare R2 are encrypted at rest by the provider.
• Managed authentication. Passwords are hashed and verified by Supabase Auth. We never see your raw password. OAuth flows use short-lived tokens.
• Limited access. Access to production systems is limited to the people who need it.

No system is perfectly secure. If you believe your account has been accessed without your permission, contact support@studysolutions.app immediately.

You can do any of the following through your account settings or by emailing us at support@studysolutions.app.

• Access. Ask us what personal information we have about you.
• Correction. Update your email, display name, and profile fields at any time in the dashboard. Ask us for help if a field is not editable.
• Deletion. Ask us to delete the documents and text you submitted, including the copies we keep, and we will. Deleting your account from settings deactivates it; what we keep afterwards, and why, is listed under Data Retention.
• Cancel a subscription. Cancel from your billing settings; your access continues until the end of the current period.
• Object or restrict. If you are in a jurisdiction that grants objection or restriction rights (for example, the UK or the EEA), email us to invoke them.
• Complain. If you are in the UK, EEA, or another jurisdiction with a data-protection authority, you have the right to lodge a complaint there. We would appreciate the chance to address your concern first.

We may need to verify your identity before acting on a request — usually by confirming it comes from the email address on the account.

StudySolutions is intended for users aged 13 or older (16 or older in the European Economic Area). We do not knowingly collect personal information from children below those ages. If you believe a child has provided us with personal information, email support@studysolutions.app and we will close the account and delete the documents and text submitted from it.

StudySolutions operates globally. Our primary database is hosted in the United States (Supabase, US-East). Some of the servers we rent are in the European Union, and our providers may store or process data in other countries consistent with their own infrastructure.

When we transfer personal information out of the United Kingdom, European Economic Area, or Switzerland, we rely on lawful transfer mechanisms — such as the European Commission's Standard Contractual Clauses or an equivalent — to make sure your data continues to receive appropriate protection.

We may update this policy from time to time to reflect changes to our service, our processors, or the law. When we do, we'll update the “last updated” date at the top of the page. For material changes, we'll also give you reasonable notice — for example, an email or an in-product banner — before the update takes effect.

Continued use of StudySolutions after an update means you accept the revised policy. If you don't, you can stop using the service and delete your account.

For any privacy question, request, or concern, email support@studysolutions.app. This is the only address we use for privacy correspondence.

We aim to respond to privacy requests within 30 days. If a request is unusually complex we may take longer and will let you know why.