Studia — Privacy Policy

Last updated: 29 May 2026

This policy explains what Studia does — and doesn't do — with your information. We've written it in plain English because many of our users are teenagers. If anything here is unclear, email us at help@getstudia.app and we'll explain.

1. Who we are

Studia is an iOS and iPadOS app that helps students plan and track GCSE and A-level revision. The app is made and run by:

Syed Khairi, sole trader, United Kingdom
Contact: help@getstudia.app

Under UK data protection law, Syed Khairi is the data controller for any personal data this app handles.

2. The short version

You don't need an account. There's no sign-up, no email, no password.
Your study plans, sessions, notes, and photos are stored on your device and, unless you turn it off in Settings, sync through your private iCloud using Apple's CloudKit. We can't see any of it.
We don't run ads.
We don't track you across other apps or websites.
We don't sell your data. We don't share it with marketers.
Our server keeps short-lived technical logs (your IP address and what curriculum file you requested) for security and debugging. That's it.
The app asks for Camera, Photos, Calendar, Notifications, Live Activities, and system-alarm access only when you choose to use a feature that needs them. You can say no.

3. Who Studia is for

Studia is designed for students aged 13 and over. The App Store rates it 4+.

If you are under 13, please don't use the app. Ask a parent or carer to email us if a younger child has started using it and we'll explain how to delete the data from their device.

Because many of our users are under 18, we follow the UK Information Commissioner's Office (ICO) Age Appropriate Design Code (also called the Children's Code). That means:

High-privacy defaults — there is no public profile, no sharing feature, no social network.
No profiling for advertising or marketing.
Minimum data — we only handle what's needed for the planner to work.
No dark patterns — streaks, reminders and notifications can all be turned off in your device settings without breaking the app.
Clear language at every step, including this policy.

4. What information Studia uses, and why

Here is everything the app handles, where it lives, and the legal reason we can use it.

a) Your study data

This is the bulk of what the app does — your plans, schedules, ratings, reflections, focus sessions, streaks and scores.

What: study plans (subject, exam board, exam date, availability, target grade), study sessions (when, what topic, duration), self-ratings (Red/Amber/Green), session feedback (difficulty, recall, focus, mood), pause reasons, streaks, study scores, calendar-export flags.
Why: to run the planner — generate your schedule, track progress, decide when to revisit weak topics.
Where: on your device, in the app's SwiftData database. If iCloud Sync is enabled, it also syncs through your private iCloud using the dedicated Studia CloudKit container.
Who can see it: people with access to your device, device backup, or iCloud account. Studia does not receive this data.
Legal basis: contractual necessity — UK GDPR Article 6(1)(b). We need this data to provide the service you asked for.
How long it stays: until you delete it. You can delete a plan or session inside the app at any time. Uninstalling the app removes the local app data from the device, but may not delete an iCloud copy; use the iCloud Sync setting to delete the iCloud copy when available.

b) Progress photos and captions (optional)

If you choose to add a photo to a session — a picture of your notes, a whiteboard, or whatever — that photo and any caption you type sit alongside your study data on your device and, if iCloud Sync is enabled, in your private iCloud. It is never sent to Studia's server.

Legal basis: consent (you opt in by tapping Add Photo) and contractual necessity for the feature.
How long: until you delete the photo or the plan.

c) Focus-session timer state

When you're in a focus session the app remembers where you are in the timer, your pause count and so on. This is on your device only.

d) Notifications, Live Activities, and system alarms

Local notifications fire when a focus block ends or a break starts. Live Activities show your timer on the lock screen and Dynamic Island. On supported iOS versions, Studia can use system alarms for more reliable focus-session alerts. All of this happens on your device — nothing is sent to a server.

e) Calendar export (optional, write-only)

If you choose to export your sessions to Apple Calendar we write events into your calendar. We don't read your existing events and we don't keep our own copy.

Legal basis: consent at the moment you tap Export.

f) Curriculum content (downloaded to your device)

The app fetches curriculum data — subject lists, papers, topics, learning objectives — from our backend at studia.mrkhairi.com. This isn't personal data. It's the same content every user gets. We download it to your device so the planner can work offline.

g) Crash logs sent to Apple (only if you opted in)

If you have switched on "Share with App Developers" in your iPhone's Privacy & Analytics settings, Apple sends crash logs to us. Apple controls what's in those logs; we just receive them to fix bugs. You can turn this off any time in iOS Settings.

h) Operational logs from our backend

Every time the app fetches curriculum, our server records a short technical log. This is only for security and debugging — not for analytics, profiling or advertising.

What's logged:

Cloudflare edge logs — your IP address, timestamp, the URL you requested, the response code, and your device's user agent. Cloudflare is our CDN / reverse proxy.
Directus activity log — the same kind of metadata, written into our PostgreSQL database by the Directus CMS.

We do not link these logs to any individual, combine them with your study data (we can't — we don't have it), share them with third parties, or use them for advertising or analytics.

Legal basis: legitimate interest — UK GDPR Article 6(1)(f) — running the service safely.
How long: Directus activity logs are purged after 90 days. Cloudflare edge logs follow Cloudflare's own retention.
Note: under UK GDPR an IP address counts as personal data even though we don't know who you are.

i) What we do not collect

To be explicit, Studia does not collect or store:

Your name, email address, phone number or postal address.
Your precise location.
Contacts, microphone, health data, or browsing history.
Behavioural / usage analytics (we don't know which buttons you tap).
Advertising identifiers (IDFA) or any cross-app tracking.
Remote push tokens.
Device identifiers for tracking or fingerprinting.

5. On-device storage

Studia stores your study data using Apple's SwiftData framework. iCloud Sync is on by default and uses Apple's CloudKit private database in the dedicated container iCloud.com.syedkhairi.studia.studydata. You can turn iCloud Sync off in Settings on a per-device basis; that device then uses a local-only store.

Local-only means "not CloudKit-synced"; iOS device backups remain controlled by you and Apple. Studia has no admin panel, database, or support tool that can read your plans, sessions, photos, or reflections.

6. The Studia backend (studia.mrkhairi.com)

Our backend is a self-hosted Directus + PostgreSQL instance, sitting behind Cloudflare.

It stores only curriculum content — subjects, exam papers, topics, learning objectives, learning resources.
It does not store any study plans, sessions, ratings, photos, names, emails or account identifiers.
The app reads from it. It never writes study data to it.

Cloudflare sees the IP address of each request because it sits in front of our server. That's how CDNs work. Cloudflare's privacy terms apply to that processing.

7. Device permissions

The app asks for these only when you use the feature that needs them. You can change your mind in iOS Settings → Studia.

Camera — to take a photo for your progress gallery.
Photo Library — to pick an existing photo for your progress gallery.
Calendar (write only) — to export sessions to Apple Calendar.
Notifications — to warn you when a focus block or break is ending.
Live Activities — to show your focus timer on the lock screen and Dynamic Island.
System alarms — on supported iOS versions, to keep focus-session countdown alerts reliable.

None of these are required. The planner works without them.

8. Our Children's Code commitments

Because Studia is used by under-18s, we commit to:

No profiling for marketing or advertising.
High-privacy defaults — there's nothing public to switch off because nothing is public.
Minimum data — we don't ask for anything beyond what the planner needs.
Clear, age-appropriate language in this policy and in the app.
No dark patterns — every notification, streak and reminder can be turned off without breaking the app.
Parents and carers can contact us at help@getstudia.app about a child's use of the app. Because there's no Studia account, we may need to walk you through deleting data from the device and, if enabled, the user's private iCloud copy.

9. Your rights

Under UK GDPR and (if you live in the EU/EEA) EU GDPR you have the right to:

Access — ask for a copy of any personal data we hold about you.
Rectification — ask us to correct anything wrong.
Erasure — ask us to delete data.
Restriction — ask us to stop using it.
Portability — ask us for a copy in a portable format.
Object — object to processing based on legitimate interest (our server logs).
Withdraw consent — turn off any optional feature in iOS Settings.

Because we don't hold study data on our servers, most of these rights are exercised directly on your device:

Delete a plan, session or photo in the app.
Uninstall the app to remove local app data from the device.
Use the iCloud Sync setting to stop syncing on this device or delete the existing iCloud copy.

For server logs (the Cloudflare / Directus logs in section 4(h)) email us at help@getstudia.app. Note that without your IP address and an approximate timestamp we can't usually find a specific log row.

You can complain to the UK Information Commissioner's Office at ico.org.uk. If you live in the EU/EEA you can complain to your local data protection authority.

10. International users

Studia is available on the App Store worldwide.

UK/EU/EEA: this policy is written for UK GDPR; the EU GDPR has near-identical rights and we honour them the same way. We don't currently have an Article 27 EU representative — we don't process EU residents' data on a large scale and study data stays on the user's device or private iCloud, not Studia servers. We'll review this if usage grows.
California / United States: we don't "sell" or "share" personal information as those terms are used in the CCPA / CPRA. There is no targeted advertising in the app.
Everywhere else: the same principles apply — minimal data, no tracking, on-device processing where possible.

11. Security

All network traffic uses HTTPS (TLS 1.2 or higher), terminated at Cloudflare.
On the device, the app relies on iOS's built-in data protection.
iCloud study-data sync uses the user's private CloudKit database controlled by Apple.
Our backend stores only curriculum content and short-lived operational logs. There is no user database to breach.

No system is perfect. If we ever discover a breach that affects personal data we will follow the ICO's 72-hour notification rules.

12. How long we keep things

What	Where	How long
Study plans, sessions, photos, ratings	Your device; private iCloud if sync is enabled	Until you delete them. Uninstalling removes local app data but may not remove the iCloud copy
Curriculum cache	Your device	Replaced on the next refresh
Directus activity log	Our PostgreSQL database	90 days, then purged
Cloudflare edge logs	Cloudflare	Per Cloudflare's own retention
Crash logs (if you opted in)	Apple → us	As long as the bug is open

13. Changes to this policy

If we change something important we'll update the Last updated date at the top and flag the change in the app. If a change affects your rights we'll explain what changed and why.

14. Contact

For any privacy question, parent/carer query, or data-rights request:

help@getstudia.app