Privacy Policy

• Google sign-in is optional. It shares basic identity information, not your Google password, Gmail messages, Drive documents or Google Calendar.
• Profile details and community posts may be visible to other students. Do not put private information in them.
• Your saved study tools are account-linked; team conversations are shared with the team, not end-to-end encrypted.
• Current audio transcription runs on your device. Speech software and model downloads still contact external services.
• University portfolio entries are saved in this browser, not synchronized to your account. Signing out does not erase them.
• Google disconnection, StudentHub account deletion, clearing browser data and cancelling a subscription are separate actions.
• We do not sell personal data or require promotional-email consent to use an account. Retention, deletion and parental-consent limitations are explained below.

StudentHub is a student-focused platform for learning, competitions, collaboration and university preparation. This policy applies to visitors, account holders and people whose information is submitted through these features. It does not govern Google, Razorpay, YouTube, universities or competition organizers when you use their services; their own privacy policies apply there.

Operator and contact details are incomplete. StudentHub is currently described as an individually operated student project. A verified legal operator name, postal address and dedicated public privacy/grievance email have not been supplied for this policy. Signed-in users can contact the operator through Share feedback. That is not an adequate substitute for a public contact channel for parents, signed-out visitors or former users; those contact details still need to be published.

• Account and authentication information. Email address, account identifier, sign-in provider, account creation and confirmation information, and session/security tokens. Email/password registration also submits your name and password to our authentication service; passwords are not stored as readable application profile data. Google identity information is described separately below.
• Profile information. Name, profile picture or picture URL, grade, and any school, country, biography, skills, interests and achievements you provide. School and country are optional. Display names and pictures may be filled from Google. Edit your details on your profile page.
• Learning preferences. Goals, favourite subjects, learning style and onboarding completion. These support the learning experience and personalization. Preference information is held separately from community profile fields; historical personalization records may also remain.
• Study and progress records. Notes and source text, reviewed transcripts, subject/topic labels, flashcards and review state, quizzes and answers, scores, practice history, library/course progress, study sessions and plans, calendar events and reminders, and Exam Mirror materials, assessments, marking records, attempts and readiness evidence.
• Study Hub content. Assistant questions and replies, conversation titles and timestamps; game titles, topics, questions, answer keys, difficulty, play counts and best scores. Conversation and game records are associated with your account.
• Community and uploaded content. Lessons, questions, student answers, comments, reactions, team descriptions, membership and roles, applications to teams, chat messages, read-state records, and attachment names, types, sizes and storage paths. Feedback can include a category, title, description and screenshot.
• Opportunities and other account records. Saved competitions, notification preferences, resumes and information you choose to include in them. Older application-tracker, finance, Coach and Research records may still exist even where the associated tools are no longer promoted.
• Payments and referrals. Subscription/plan status, payment and subscription identifiers, billing dates, cancellation state, complimentary or referral Pro entitlement, invite codes, account-to-account referral attribution and reward records.
• Technical and usage information. Hosting, authentication, email and other providers process request information such as IP addresses, browser/device information, timestamps, errors and security events. Site-level reporting can include visits, pages, referring sites and campaign tags. This is separate from learning progress saved in your account.

Registration does not currently ask for a date of birth, home address or phone number. That does not mean we cannot receive such information: you may include it in a message, resume, upload or feedback report, or supply it directly to a payment provider. Please avoid unnecessary sensitive data, including identity documents, health information, passwords, financial credentials and other people’s personal details.

We process information to create and authenticate accounts, provide the features you request, save work and progress, enable student collaboration, manage subscriptions and referrals, deliver account messages, troubleshoot faults, and protect users against fraud or abuse. Learning personalization is different from advertising profiling; the current application does not install advertising networks or sell student information.

Where applicable law requires a legal basis, providing requested services may involve contractual necessity; security and service operation may involve legitimate interests subject to applicable safeguards; mandatory disclosures and financial recordkeeping may involve legal obligations; and optional processing may require consent. These bases are not interchangeable, and a child’s ability to agree to a contract or consent depends on local law. The operator has not completed a jurisdiction-by-jurisdiction legal-basis assessment. This notice does not replace any consent that is legally required.

Selecting Continue with Google starts an authentication flow through our cloud authentication service to Google’s own account-selection/sign-in page. Google authenticates you and returns the result through that service to StudentHub’s sign-in callback. StudentHub does not receive your Google password or Google two-step-verification codes. Google may show a technical authentication-service domain during this flow; it is not a separate StudentHub mailbox or an additional Google product permission.

We receive an account identifier and basic identity information made available by Google, including your email address, email-verification information, name and profile picture URL where available. Google/provider metadata may include related basic profile fields. We do not require every field to be present.

The authorization endpoint checked for this policy on 1 November 2026 requested Google’s email and profile permissions. These are basic sign-in identity permissions, not Gmail, Drive or Calendar permissions. Google identity integrations may also use the openid scope to identify an account; StudentHub does not currently add a request for it in its sign-in button. Review the permissions Google actually shows before continuing.

• Basic sign-in does not authorize StudentHub to read or send Gmail messages, view contacts, inspect Drive documents or photos, or read/change Google Calendar events.
• Knowing your Gmail address is not access to your inbox. StudentHub’s own calendar is separate from Google Calendar.
• The application does not use Google permissions for background mailbox/document searches, advertising, or importing your Google files.
• Google sign-in is optional: email/password sign-in remains available. Public pages can be browsed without Google sign-in, though account features require a StudentHub account.

Google handles its own authentication, account-security checks and consent screens under the Google Privacy Policy. Selecting Google is authorization for that sign-in connection, not consent to advertising emails or all future uses of your data. If additional Google product access is introduced, its purpose, information and permissions must be disclosed and any required authorization obtained before access begins.

• Account creation and authentication. Our authentication service uses the Google identity to create or recognize your StudentHub account and establish a session. Accounts with a matching email may be linked under the authentication provider’s verification rules; we do not guarantee that every matching address is automatically linked. Contact us if you appear to have duplicate accounts.
• Profile display. Name and picture information may be copied into your StudentHub profile. A picture URL can be stored rather than a separate image file; displaying an externally hosted picture causes your browser to request it from that host. Profile names and pictures may appear with community contributions.
• Storage and session handling. Account identifiers and provider metadata are processed by our authentication service; copied profile values are stored in the application database. Session/access/refresh credentials are handled by the authentication service and SDK, with sign-in state persisted in browser storage. Application features do not use Google provider tokens to call Gmail, Drive or Calendar APIs. This is not a claim that the authentication service never processes Google tokens.
• Service delivery and sharing. Our cloud/authentication providers process this information to operate the account. Display values can be shown to other users with your profile or posts. If an externally powered Coach is used, its personalization context may include the name copied into your profile, along with other profile information, as explained in section 9. Google sign-in alone does not send your study content to an AI model.
• Limits on use. We do not sell or rent Google identity information, use Google permissions to deliver targeted advertising, or use those permissions to train a StudentHub model. Operational access can be needed for support, security or legal obligations; we do not claim that stored identity information is inaccessible to authorized service personnel.

Google information is subject to the applicable Google API Services User Data Policy. Google’s additional Limited Use requirements apply where the scopes/product rules require them; basic sign-in is not a claim of sensitive-scope certification or an independent privacy audit. Retention and deletion limitations in section 15 also apply to identity information copied into StudentHub.

Review or remove StudentHub’s connection from your Google Account connections. Choose the connection associated with StudentHub, then the option to stop using Sign in with Google or remove access. Google explains these controls in its third-party connections guide. The name displayed may reflect the authentication client currently configured.

• Disconnecting Google does not delete your StudentHub account, your profile, previous study content or information already shared.
• Disconnecting may affect future Google sign-ins; do not assume it immediately signs you out of an existing StudentHub session. Sign out separately, especially on shared devices.
• If you rely only on Google, establish and verify an available alternative sign-in method before disconnecting. Do not assume that a Google-created account already has a StudentHub password.
• StudentHub privacy settings provide an account-deletion control. Delete individual content using the relevant feature where offered. The current deletion limitations are in section 15.
• Deleting a StudentHub account does not delete your Google account, erase Google’s own records, automatically revoke the Google connection, or cancel a Razorpay subscription.
• Changing a name or picture at Google does not guarantee that an older copy in StudentHub is updated. You can edit copied profile details in StudentHub.

Profile fields are intended for community use and may be visible to other signed-in students under the profile’s access rules. Profiles are generally community-visible by default. Treat your name, picture, grade, school, country, skills, interests, achievements and biography as potentially visible rather than automatically private. Your profile editor lets you edit or clear optional fields; this policy does not promise a profile-visibility switch that the current editor does not provide.

Questions, student replies, contributed lessons, comments and team listings are shared in their respective community areas and can include account attribution. Team membership and roles may be shown in team discovery. Material on publicly accessible pages can be copied, linked or indexed. Private account data is not intentionally published simply because you sign in with Google.

Team chat and attachments are restricted to authorized team participants under application access rules, and team owners have moderation powers. These conversations are not demonstrated end-to-end encrypted. Authorized operators/service providers can have access for operation, security, support or legal purposes. Recipients may save or screenshot content; access restrictions cannot prevent this. Expiring a file access link does not delete the stored file or a downloaded copy.

Current credit-free tools. The Study Assistant matches your question to published Learning Library content without an external generative model. Questions and replies are saved in private account-scoped conversations. Game Studio uses student-authored content. Current note organization, flashcards, quizzes and study planning use source-grounded or deterministic methods; Exam Mirror measures source recall from saved attempts rather than claiming to infer all reasoning skills. These saved records are not automatically public.

Microphone and audio. Recording begins only after you choose it and grant browser microphone permission. Uploaded audio or recorded sound is decoded and transcribed in a browser worker on your device in the current audio tool; that path does not upload the audio to a paid transcription API. The speech library is downloaded from jsDelivr and the speech model/runtime from model-distribution services, including Hugging Face infrastructure. Those downloads expose standard request information to those services and may create browser caches. Review the transcript before saving it: saved text then becomes account data. Other uploaded materials and any previously stored audio files are not covered by a blanket “nothing ever leaves your device” claim.

Legacy or externally powered Coach/Research. These services are no longer the core free Study Hub experience, but existing records and server endpoints may remain. If invoked and available, they can send a prompt, conversation history, attachment text and selected personalization context through the Lovable AI gateway to the configured model/search provider. Current Coach context can include your name, grade, school/country, interests, goals, achievements, saved opportunities, older application records and recent learning progress. Research can send your query for web search and save answers, findings, sources and usage records. Availability depends on permissions, funding and provider responses.

Provider-side processing and retention are governed by the provider configuration and terms; no verified zero-retention or no-training guarantee is made here. Do not submit private information about yourself or others to external AI features. StudentHub does not currently train its own generative model on student conversations. Study results and readiness estimates are learning aids, not university-admission decisions, medical assessments or guaranteed exam predictions. You can decline optional tools without agreeing to unrelated processing.

The admissions workspace provides general editorial guidance without an external AI service or a questionnaire. When you are signed in, the priorities you add to your plan and completed-action identifiers are saved to your account. They are private account records, not community posts. Without signing in, workspace changes last only for the current page session. Answers and completed tasks from the previous counsellor may remain in existing account records; they are not used to rank universities or calculate a readiness score in the current workspace. These remote records are subject to the account-data retention and deletion limitations in section 15.

University application portfolio entries are currently stored in this browser’s local storage, not in account-synchronized University records. They can remain after sign-out and may be visible to another person using the same browser, including someone signing into a different StudentHub account. Similar local state can be used for team requests and interface preferences.

Clearing StudentHub’s cookies/site data in your browser removes this local material but does not delete remotely saved account records. Keep a copy of work you want before clearing it. Avoid shared browsers for portfolio entries; deleting an account alone is not a device-storage wipe. Clicking an official university or examination link opens that organization’s service under its own policy.

Razorpay processes Pro checkout and subscription payments. Subscription creation can share your StudentHub account identifier, selected plan and email with Razorpay. StudentHub stores provider identifiers, status, billing-period dates and entitlement information to verify payments and manage access. Card, UPI or bank credentials are entered in Razorpay’s payment flow; the application does not store raw card numbers, card security codes, UPI PINs or bank passwords. Razorpay may collect additional payment, contact or fraud-prevention information under its own policy.

Cancelling a subscription is separate from deleting an account. Cancel a recurring subscription through the available billing controls before deleting the account; deletion does not itself cancel provider billing or erase transaction records. Payment providers may retain records for accounting, fraud prevention, disputes or legal duties.

Invite links contain a referral code. Opening one can store the code in your browser; after sign-in/confirmation, a claim associates the invited account with an inviter so qualifying joins and rewards can be counted. The inviter can see progress and reward information; we do not need access to your phone contacts or email address book to do this. Copy/share controls let you choose recipients using your own messaging service. WhatsApp or another sharing service handles what you send under its own terms.

• Lovable Cloud and platform infrastructure. Provide database, authentication, storage, hosting, service operation and diagnostic processing. They handle account/content records and request information needed for those services. See Lovable’s privacy policy.
• Google. Provides optional sign-in, remotely hosted profile pictures where applicable, Google Fonts requests and YouTube videos. These are distinct requests, not access to all Google products. See the Google Privacy Policy.
• YouTube. Lesson videos use privacy-enhanced embedding through youtube-nocookie.com. Loading/playing an embedded video can still send device/request information to YouTube; privacy-enhanced mode is not a promise of no data collection.
• Razorpay. Receives subscription/payment information and checkout requests. See Razorpay’s privacy policy.
• Transactional email delivery. The cloud email system and delivery infrastructure process recipient addresses, delivery events and account-confirmation/recovery links to deliver requested account messages.
• Speech software and model distribution. jsDelivr and model/runtime hosts process download requests when local transcription is used. See jsDelivr’s privacy policy and Hugging Face’s privacy policy.
• External AI/search services, when invoked. The Lovable AI gateway routes the information described in section 9 to configured providers. OpenAI-labelled models exist in the legacy integration; see OpenAI’s privacy policy. We do not imply that every study action calls OpenAI.

We may disclose necessary information to authorized support personnel, to comply with a valid legal obligation, or to investigate fraud, abuse or a safety threat. StudentHub does not sell or rent personal data. A future change in ownership or a materially different use of information must be assessed against applicable notice, consent and Google policy requirements; this notice is not blanket permission for such a change.

Competition, university, examination and other external links take you to organizations StudentHub does not control. Browser referrer information can be transmitted when following links. Do not assume those organizations receive your whole StudentHub account merely because you click a link.

Account email can include confirmation, password recovery, email-change verification and other security or service messages. These use the relevant email address and account link; do not forward password-reset or verification links. In-app messages can include deadlines, subscription information, referrals and feature announcements.

StudentHub does not currently operate a promotional-email mailing list. Signing in, including through Google, is not consent to promotional emails, and your account does not depend on allowing marketing. If an optional update mailing list is added, its purpose, consent requirements and unsubscribe/withdrawal controls must be provided before it is used. Essential account/security messages are distinct from marketing.

• Sign-in storage and security tokens support authentication, session persistence and refresh. Clearing them normally signs you out.
• Functional storage remembers appearance and onboarding/tour/animation state. Referral storage remembers an invite code until it can be claimed or cleared.
• University portfolio data, and some team-request state, can persist locally. These are not all just anonymous appearance preferences.
• Downloaded speech models/runtime files may be cached on the device. Clearing caches/site data can cause a later re-download.
• Google sign-in, embedded videos/fonts, checkout and model downloads make third-party requests. Those services can apply their own cookies, storage or logging rules.

No Google Analytics, advertising pixel or comparable third-party marketing tracker is installed in the current application source. That is not a claim that no platform analytics, server logs or third-party request data exist. Platform traffic reports can show visits, page views, referrers and campaign parameters; account learning activity is also stored for the features you use. Do not put personal information in campaign tags or invite URLs. We do not use these reports to sell student advertising profiles.

Browser settings let you block or clear storage, though this can affect sign-in and saved work. There is currently no comprehensive cookie-consent preference manager; whether particular non-essential processing requires one depends on applicable law and must be assessed. See the Cookie Policy for related information; the more specific feature-storage details above describe the current University and referral tools.

Active account information and saved work are generally retained while the account exists or until you use an available deletion control. Individual deletion can remove content from normal application access; it does not erase copies made by recipients, external sites or providers. Existing legacy records are not necessarily deleted when a feature disappears from navigation.

Account deletion is not currently verified as a complete data purge. The available control deletes the authentication account and attempts to remove many account-linked records. Some cleanup failures do not stop the overall operation, and newer records, including Study Assistant conversations, are not covered by every cleanup step. Uploaded storage objects, device-only drafts, provider-held information and some billing/referral/usage records may remain. A success message must not be understood as confirmation that every copy has been erased.

• Delete individual assistant conversations, games and study materials through their own controls where offered before deleting an account, particularly if you need to remove newer feature data.
• Clear StudentHub site data separately on each device to remove local drafts, referral codes and preferences. Account deletion does not do this automatically.
• Revoke the Google connection separately and cancel recurring billing separately. StudentHub deletion does not request erasure from every external provider.
• Payment, dispute, security and legal records can require different retention from active learning content. Logs, backups, model caches and provider copies can also have separate lifetimes.

Verified maximum periods for backup deletion, storage-object cleanup, security logs, legacy records and financial records have not yet been established by the operator. We therefore do not promise immediate erasure from all systems or invent a fixed number of days. A documented retention schedule and a fully checked deletion process remain necessary operational work; publishing this notice does not complete them.

• Edit your profile to correct information and clear optional school, country, picture, biography or other fields. Some display-name information is required by the current editor.
• Review privacy settings for a summary of selected account information and the account-deletion control. That summary is not a full downloadable export or an inventory of every newer record.
• Use feature-specific controls to delete saved conversations, games or other content where available, and clear device storage separately.
• Review/remove Google access in Google Account connections, stop using optional tools, and use sign-out and browser permissions to manage the device’s access.
• Ask the operator about access, correction, deletion, a copy/export, restriction, objection, consent withdrawal or a privacy complaint. The rights available and exceptions depend on where you live and the processing involved.

We may need proportionate information to verify that a request concerns your account, or that a parent/guardian is authorized to act. Do not send passwords, reset links or full identity documents in public posts. Applicable rights and response deadlines are set by law, not waived by this policy. You may also complain to the competent privacy regulator where that right applies. The incomplete public contact route is disclosed in sections 2 and 20.

StudentHub’s current Terms describe account use for ages 13 and above, with parental or guardian awareness for minors. That is not a universal legal consent threshold: some places require parental authorization at higher ages or apply additional child protections. For example, United States COPPA protections concern children under 13 in covered services; EU consent rules for services offered directly to children vary by country when consent is the legal basis. India’s child-data framework also needs assessment against its commencement schedule and applicable rules.

No verifiable parental-consent or comprehensive age-verification mechanism is currently implemented. Parent/teacher awareness, accepting this policy, or using Google sign-in is not a substitute for legally required parental consent. We do not claim that an age statement alone makes worldwide access compliant. Google also has specific rules for child-directed and mixed-audience applications; the operator must assess the audience and keep Google sign-in optional, rather than treating it as age verification.

Students should not publish home addresses, phone numbers, exact schedules, identity documents or identifying details about other children. Parents and guardians can ask about a child’s information, correction or removal, subject to verification and applicable law. If information from a child has been collected without authorization where it is required, the operator needs to assess and address it; this policy does not invent a parental workflow or guarantee a response process not yet established.

The hosted website uses HTTPS and the authentication service manages credentials and session verification. Database access rules and owner checks are used to restrict private records, and restricted file access is used for team/study attachments. These are access controls, not a guarantee of end-to-end encryption or immunity to mistakes, unauthorized access or device compromise. Authorized operational access and the deletion limitations described above remain relevant.

Keep devices and account credentials secure, sign out on shared devices and avoid forwarding private access links. Report suspected exposure through Share feedback when available. If a personal-data incident occurs, the operator must investigate and make any notifications required by applicable law; there is no independently audited incident-response certification or guaranteed notification timeframe claimed here.

StudentHub is accessible internationally. Cloud infrastructure, Google, Razorpay, email delivery and software/model distribution may process information outside the country where you live. Processing locations can differ between account storage, logs, support, payment handling and external feature requests; this policy does not promise that all information stays in one country.

Where law requires transfer safeguards, an adequate contractual or other lawful mechanism must apply. The operator has not supplied a complete verified list of processing locations, subprocessors or transfer arrangements for this notice. We therefore do not claim specific residency guarantees, adequacy decisions or signed transfer clauses that have not been verified.

We update the date above when this policy changes. Material changes to data access, sharing or purpose should be brought to users’ attention through an appropriate notice, and any required new consent or Google permission must be obtained before that processing begins. Continuing to use StudentHub does not automatically waive privacy rights or authorize unrelated marketing.

Signed-in users can choose Share feedback and submit a general-feedback report titled “Privacy request”, explaining the feature and request without including sensitive credentials. The report is associated with your account and reviewed by authorized operators. The signed-in feedback control is unavailable to signed-out visitors, parents without an account and users whose account has already been deleted. A dedicated public contact email, verified operator identity and grievance route still need to be supplied and published.

Related pages: Terms of Service, Cookie Policy, and privacy settings.

This policy is a detailed description of reviewed StudentHub practices, not a legal certification, Google endorsement or substitute for missing privacy safeguards. Provider configurations and laws can change. The disclosed contact, child-consent, retention and deletion gaps require operational/legal follow-through, not just wording.