Privacy Policy

1. Introduction

Leonenko Group LLC ("Company," "we," "us," or "our") operates StudyStack( "study-stack.com"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

We are committed to protecting the privacy of our users, including teachers, school administrators, parents, and students. Please read this Privacy Policy carefully. If you do not agree with the terms of this Privacy Policy, please do not use the Service.

2. Information We Collect

2.1 Account Information

When you register for an account, we collect your name, email address, and authentication credentials (via Google OAuth or email sign-up). For teacher accounts, we may also collect your school name, grade level, and subject area.

2.2 Usage Data

We automatically collect information about how you interact with the Service, including pages viewed, features used, resources generated, timestamps, and device information (browser type, OS, screen resolution).

2.3 Generated Content

We store the educational content you generate through the Service (lesson plans, worksheets, study materials, etc.) to allow you to access, edit, and reuse your materials.

2.4 Uploaded Content

If you upload files (documents, images, PDFs), we store these files to process and generate educational materials. Uploaded files are associated with your account and are not shared with other users.

2.5 Payment Information

Payment processing is handled by Stripe. We do not store credit card numbers or full payment details on our servers. We retain only the information necessary to manage your subscription (plan type, billing period, transaction IDs).

3. How We Use Your Information

We use collected information to:

• Provide, operate, and maintain the Service, including generating personalized educational content.
• Improve the Service by analyzing usage patterns and feature adoption (in aggregate, not individually).
• Personalize your experience, including remembering your teaching style, grade level, and subject preferences.
• Process transactions and manage your subscription.
• Send transactional emails (password resets, subscription confirmations, important service updates).
• Respond to support requests and communicate with you about the Service.

4. What We Do NOT Do

We want to be clear about what we will never do:

• We do not sell your personal data to third parties, advertisers, or data brokers. Ever.
• We do not share your data with advertisers or use it for targeted advertising.
• We do not sell student data. Student education records are never monetized, shared, or used for non-educational purposes.
• We do not use your content to train AI models without explicit, opt-in consent. Your generated content is yours.
• We do not display ads on StudyStack.

5. Data Retention and Deletion

1. Active account data is retained for as long as your account is active and you continue to use the Service.
2. Upon account deletion, we initiate a 30-day soft-delete period. During this window you may reactivate your account and recover your data.
3. After the 30-day soft-delete period, all personal data and generated content is permanently and irreversibly purged from our systems, including backups.
4. You may request deletion of your data at any time by contacting us at hello@study-stack.com.

6. COPPA Compliance (Children Under 13)

StudyStackcomplies with the Children's Online Privacy Protection Act (COPPA). We do not knowingly collect personal information from children under 13 without verified parental consent.

• Student accounts for children under 13 may only be created by a parent, legal guardian, or authorized school administrator acting in loco parentis.
• We collect only the minimum information necessary to provide the Service to child users.
• Parents and guardians may review, modify, or request deletion of their child's information at any time.
• We do not condition a child's participation on disclosing more personal information than is reasonably necessary.

If you believe we have inadvertently collected information from a child under 13 without proper consent, please contact us immediately and we will promptly delete it.

7. FERPA Compliance

When StudyStackis used by schools or teachers in an educational setting, we act as a "school official" under FERPA with a legitimate educational interest. For full details on our FERPA compliance practices, please visit our FERPA Compliance page.

8. Cookies and Tracking

8.1 Essential Cookies

We use essential cookies to maintain your session, remember your preferences, and keep you logged in. These cookies are strictly necessary for the Service to function.

8.2 Analytics

We use privacy-friendly analytics to understand how users interact with the Service in aggregate. We do not use invasive tracking pixels, fingerprinting, or third-party advertising cookies.

8.3 Your Choices

You can configure your browser to reject cookies, though some features of the Service may not function properly without essential cookies.

9. Third-Party Integrations You Connect

StudyStack offers optional integrations with third-party services that you must explicitly authorize. The sections below describe exactly what data flows to and from those services. Connecting an integration is always opt-in, and you can disconnect it at any time from Integrations in your account settings.

9.1 Google Classroom

If you choose to connect your Google Classroom account, you will be redirected to Google to grant StudyStack the following permissions. These are the only Classroom scopes we request:

• View your Classroom classes (classroom.courses.readonly) — so we can show you a list of courses you teach, read-only.
• View the rosters of your Classroom classes (classroom.rosters.readonly) — so you can import your class rosters into StudyStack with one click instead of typing them in.
• View email addresses of students in your classes (classroom.profile.emails) — so imported students can later sign in, receive parent updates, and be matched across sibling StudyStack features.
• Manage coursework you create (classroom.coursework.me) — so when you click “Publish to Classroom” on a resource, we can create the assignment in the course you select. We only create or update coursework that StudyStack itself originated. We do not read, modify, or delete coursework created by other tools or by you directly in Classroom.

9.2 How we use Google Classroom data

Data retrieved from Google Classroom is used solely to provide the features you triggered:

• Course and roster data is imported into your StudyStack account so you can generate differentiated resources, track classes, and publish assignments.
• Student names and email addresses imported from Classroom are treated as student education records and are protected under our FERPA Compliance commitments.
• Once per day we refresh rosters for courses you have already imported, so new or removed students stay in sync. We never import courses you have not explicitly opted to import.

9.3 What we will not do with Google Classroom data

Use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We do not use Google Classroom data to serve advertisements of any kind.
• We do not sell, rent, or trade Google Classroom data to any third party.
• We do not transfer Google Classroom data to data brokers, information resellers, or any party that would use it for purposes other than providing or improving features visible to you.
• We do not use Google Classroom data to train general-purpose AI or machine learning models. Roster names and emails are never sent to our AI providers.
• Humans at StudyStack do not read Google Classroom data except (a) with your explicit consent, (b) for security purposes such as investigating abuse, (c) to comply with applicable law, or (d) in aggregated and anonymized form for internal operations.

9.4 Storage and security of Classroom tokens

To keep your integration working without forcing you to sign in repeatedly, we store the OAuth access and refresh tokens Google issues to StudyStack. Tokens are:

• Encrypted with AES-256-GCM at the application layer before they are written to the database, using a key that is stored separately from the encrypted payload.
• Encrypted again at rest by our database provider (Neon).
• Never exposed to your browser, logged in plain text, or sent to third parties.
• Automatically refreshed on your behalf so Google's normal access-token expiry does not interrupt features you started.

9.5 Disconnecting and revocation

You can end the Google Classroom integration at any time in either direction:

• From StudyStack: go to Integrations → Google Classroom and click Disconnect. We immediately delete the stored access and refresh tokens.
• From Google: visit myaccount.google.com/permissions and remove StudyStack. Google will invalidate the tokens and future API calls from StudyStack will fail.

Classes and students you already imported into StudyStack are not automatically deleted when you disconnect — they become regular StudyStack records that you can edit or delete at your discretion, the same as any class you created manually. To remove imported data entirely, delete the relevant class in Classes or request full deletion per Section 5.

10. Third-Party Services

We use a limited number of third-party services to operate StudyStack:

• Vercel — hosting and infrastructure.
• Neon — database hosting (encrypted at rest).
• Stripe — payment processing (PCI DSS compliant).
• OpenAI — AI content generation (data processing agreement in place; your data is not used to train their models).
• Postmark — transactional email delivery.
• Google OAuth — authentication (we only receive your name and email).

Each third-party service processes only the minimum data necessary and is bound by their own privacy policies and our data processing agreements.

11. Data Security

We implement industry-standard security measures to protect your data:

• All data is encrypted in transit using TLS 1.3.
• Database data is encrypted at rest.
• Access to production systems is restricted and audited.
• We conduct regular security reviews of our codebase and infrastructure.

12. Your Rights

Depending on your jurisdiction, you may have the following rights:

• Access — request a copy of the personal data we hold about you.
• Correction — request correction of inaccurate data.
• Deletion — request deletion of your data.
• Portability — request an export of your data in a portable format.
• Objection — object to processing of your data for certain purposes.

To exercise any of these rights, contact us at hello@study-stack.com. We will respond within 30 days.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service at least 30 days before they take effect. The "Last updated" date at the top of this page indicates when the policy was last revised.

14. Contact

If you have questions or concerns about this Privacy Policy, please contact us at hello@study-stack.com or visit our Contact page.