Privacy Policy | Study Shesh

1. Overview

Study Shesh (“we”, “us”, “our”) is committed to protecting your privacy in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). This Privacy Policy explains how we collect, use, disclose, store, and retain personal information when you use Study Shesh (“the Service”), including essay writing, AI feedback, study tracking, and any future classroom or teacher-linked features we make available.

2. Information We Collect

Information you provide

Account information: Your email address and any profile details you choose to provide.
Study preferences: Selected exam date, study goals, learning-style preferences, and onboarding choices.
Essay content: Essays, paragraph responses, prompts, uploaded files, source material, titles, and any other text you submit for AI review or saving to your account.
Feedback content: AI-generated feedback, grades, rubric-style ratings, improvement notes, and any future teacher or reviewer comments.
Classroom information: If and when classroom features are offered, information relating to classes, teachers, invitations, memberships, assignments, submissions, and sharing settings.
Communications: Messages you send to us, support requests, and in-app feedback.

Information collected automatically

Study data: Practice question answers, flashcard progress, study sessions, quiz results, engagement data, and usage history.
Technical and device data: Browser type, device type, operating system, IP address or approximate network identifiers, and request metadata used for performance, abuse prevention, and compatibility.
Usage analytics: Pages visited, features used, interactions with essay tools, and event-level analytics used to understand how the Service is performing.
Local browser storage: Preferences and limited progress data saved in your browser to improve continuity and performance.

3. How We Use Your Information

We use your information to:

Provide, operate, maintain, secure, and improve the Service.
Authenticate your account and send sign-in or account-related emails.
Process essay uploads, convert supported files into text, and return that text to you for editing or review.
Generate AI feedback on essays and paragraphs, including grades, comments, criteria ratings, and study tips.
Save your drafts, study history, and feedback so you can revisit your work over time.
Generate structured insights such as recurring error types, progress trends, rubric patterns, and product-quality analytics.
Support present and future classroom features, including linking students and teachers, managing classes, and showing submitted work, feedback, and progress information to authorised teachers or school representatives where those features are used.
Prevent fraud, abuse, misuse, and excessive automated usage, including by applying rate limits and security monitoring.
Process payments and manage subscriptions.
Communicate service updates, security notices, and support responses.

4. Essay Data, AI Feedback, and Future Teacher Access

When you submit an essay, paragraph, prompt, or uploaded file for review, that content may be processed by our systems and by third-party service providers that help us extract text, generate AI feedback, store your drafts, analyse performance, and operate the Service.

If you are signed in, essay drafts, prompts, feedback, grades, and related metadata may be stored in your account so you can revisit your work and track progress over time. We may also generate structured signals from your submissions, such as common error categories, writing trends, or rubric-based insights.

If we introduce classroom or teacher-linked features, teachers or school staff authorised through those features may be able to view student submissions, AI feedback, progress indicators, and related learning insights for students linked to their class or school account. We intend to design these features so access is permissioned, role-based, and limited to the educational relationship represented in the Service.

Where reasonably possible, we may also use aggregated, de-identified, or pseudonymised essay-derived data to improve feedback quality, identify common learning needs, and understand how students use the Service. We do not sell student essays as a data asset.

5. Third-Party Services

We use third-party service providers that may process personal information on our behalf, including some or all of the following categories:

Stripe — Payment processing and subscription management. Stripe processes payment information directly. We do not store full card details. See Stripe's Privacy Policy.
Resend — Authentication and transactional email delivery. See Resend's Privacy Policy.
Vercel — Hosting, infrastructure, and web analytics. See Vercel's Privacy Policy.
Ollama Cloud or other AI providers we integrate with — Processing essay and paragraph content to generate feedback and related outputs. The content you submit for AI review may be transmitted to these providers to deliver the feature.
PostHog — Product analytics and feature usage measurement. We use event-level analytics to understand how users interact with the Service. See PostHog's Privacy Policy.
Upstash — Rate limiting and abuse-prevention infrastructure. See Upstash's Privacy Policy.
Sentry — Error monitoring and performance diagnostics. See Sentry's Privacy Policy.
Google — If enabled, analytics and site measurement services such as Google Analytics. See Google's Privacy Policy.

Our providers may change over time as the Service evolves. Where we add or replace material service providers, we may update this policy to reflect those changes.

6. Data Storage, Security, and Access Controls

Your data is stored using infrastructure and service providers selected to support authentication, storage, analytics, monitoring, and AI-powered features. We take reasonable technical and organisational steps to protect personal information, including:

Encrypted transmission using HTTPS/TLS.
Account and session controls designed to restrict unauthorised access.
Role-based feature access for staff and teacher tools.
Monitoring, logging, and abuse controls to protect the Service.
Reasonable efforts to limit unnecessary exposure of sensitive text in analytics and error tooling.

No method of electronic storage or transmission is completely secure, and we cannot guarantee absolute security.

7. Data Retention

We retain personal information for as long as reasonably necessary to provide the Service, maintain your account, operate learning features, resolve disputes, meet legal obligations, and protect the Service from abuse.

Account and study history: We may retain account records, study progress, drafts, and AI feedback while your account remains active.
Essay data: Essays, prompts, feedback, and related metadata may be retained to support your history, progress tracking, and future classroom functionality unless deleted earlier through product features or account deletion workflows.
Teacher-linked records: If classroom features are used, class memberships, submissions, and related access records may be retained for the operation of those features, educational continuity, support, and compliance.
De-identified or aggregated analytics: We may keep de-identified, pseudonymised, or aggregate usage information for longer where reasonably necessary to improve the Service.

If you request account deletion, we will take reasonable steps to delete or de-identify personal information associated with your account within a reasonable period, subject to legal, operational, fraud-prevention, and backup-related constraints.

8. Your Rights and Choices

Subject to applicable law, you may have the right to:

Access: Request access to personal information we hold about you.
Correction: Request correction of inaccurate or incomplete personal information.
Deletion: Request deletion of your account or personal information.
Objection or restriction: Ask questions or raise concerns about particular processing activities, including teacher-linked sharing if and when those features are used.
Complaint: Lodge a complaint with us or with the Office of the Australian Information Commissioner (OAIC) if you believe your privacy rights have been breached.

To exercise any of these rights, contact us at privacy@apracademy.app.

9. Cookies and Local Storage

The Service uses cookies, browser storage, and similar technologies for authentication, session management, local persistence of settings or progress, security controls, and product analytics. Some of these technologies are necessary for the Service to function properly.

We do not use third-party advertising cookies for behavioural advertising.

10. International Data Transfers

Some of our service providers process data outside Australia. By using the Service, you acknowledge that your information may be processed in other jurisdictions. Where this occurs, we take reasonable steps to work with providers that offer appropriate safeguards for handling personal information.

11. Age and School Use

The Service may be used by students directly, and in future may also be used in classroom or teacher-linked contexts. Where students use the Service through a school, teacher, parent, or other authorised arrangement, additional notices, permissions, or school-specific terms may apply.

If you believe we have collected personal information in a way that is inconsistent with applicable law or appropriate permissions, contact us and we will investigate.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes by posting the updated policy on the Service and updating the “Last updated” date. Continued use of the Service after changes are posted constitutes acceptance of the revised policy, to the extent permitted by law.

13. Contact

For privacy-related enquiries or to exercise your rights, contact our Privacy Officer:

Email: privacy@apracademy.app
Post: APRAcademy Pty Ltd, Sydney, NSW, Australia

You may also contact the Office of the Australian Information Commissioner at www.oaic.gov.au.