Privacy Policy

• We collect what we need to run your study plan, practice and coaching, and nothing for advertising.
• We don’t sell your data, and we don’t use your private notes, answers or conversations to train AI models.
• When you use an AI feature, the text needed for that request is sent to an AI model to produce your answer. Section 5 explains exactly which providers are involved.
• You can export your cards, notes and plans and delete your account yourself in Settings, at any time.
• Strictly necessary cookies keep FluxStudy working. Optional preference and analytics cookies are only used if you allow them, and you can withdraw at any time in Cookie settings.
• Your EU/EEA and UK data-protection rights are summarised on our GDPR page.

The table below lists each category of personal data, what it is used for, the legal basis under Article 6 of the GDPR, how long it is kept and who processes it for us. The legal bases we rely on are:

• Contract (Art. 6(1)(b)): processing needed to give you the service you signed up for.
• Legitimate interests (Art. 6(1)(f)): for example keeping FluxStudy secure and reliable. We have balanced these interests against your rights, and you can object (see section 8).
• Legal obligation (Art. 6(1)(c)): for example keeping accounting records.
• Consent (Art. 6(1)(a)): optional preference and analytics cookies, which under the ePrivacy rules (in Sweden, the Electronic Communications Act, LEK) need your consent before anything is stored on or read from your device. You can withdraw it at any time.

Some data is kept only on your device, such as offline flashcards, unsaved mock-exam answers and your sound setting. See our Cookie & Storage Policy for the full list.

• From you: your email address, what you upload, type, answer and choose.
• From your use of FluxStudy: session records, product events, progress calculated from your practice.
• From Stripe: subscription status and renewal details if you buy a paid plan.

Nova, practice generation, mock exams and study images are AI features. When you use one, we send the content needed for that request to an AI model and return the result to you. That content can be your message, relevant passages from your own materials and notes, and preferences you asked Nova to remember. Specifically:

• Reading your materials: text extraction from files, transcription of photos and scans, and search embeddings run on Cloudflare Workers AI.
• Searching your library: Nova can search your own notes and materials (one note, one course or your whole library, as you choose) and notes other learners explicitly shared with you, which are labelled as shared. Search embeddings of your notes and of your question are made on Cloudflare Workers AI and stored in Cloudflare Vectorize; only the few most relevant passages are sent with your message, and Nova shows which ones it used. Nova never searches other people’s content that wasn’t shared with you. Deleting or trashing a note removes its passages and embeddings from search.
• Standard coaching runs on Cloudflare Workers AI (currently the GLM-5.3-Flash model).
• Deep tutoring, practice questions and mock exams are sent through OpenRouter to DeepInfra, which runs the model (currently StepFun Step 3.7 Flash). Requests are set to use only DeepInfra for this route. If that route is unavailable, some requests fall back to the standard Workers AI model.
• Study images are created from the description you write, sent through OpenRouter to xAI’s image model. Your uploaded photos are not sent to this route. The resulting image is stored privately in your account.

Uploaded content is treated as data, not instructions: text inside a document can’t make Nova save preferences or act for you. We don’t use your content to train AI models. The providers’ own handling of requests is governed by their terms and our agreements with them. Content sent through OpenRouter may be processed outside the EU (see section 6).

Camera and photos

Nova, Notes and the Library can read a photographed problem, classroom board or handout. The camera only turns on after you tap “Open camera” in one of these tools, and it turns off when you close it; you can always pick an existing photo instead. Your browser asks for permission first, and no embedded third party can use the camera.

• Photos are resized and re-encoded on your device before upload, which removes location and camera details (EXIF).
• They are sent to Cloudflare Workers AI (currently the GLM-5.3-Flash model, with Meta’s Llama 3.2 Vision as a backup) only to read the text, maths or layout on them. Reading photos counts toward your standard Nova allowance.
• A photo you solve with Nova isn’t stored unless you choose “Save to notes”, which keeps it privately as a note image.
• A scanned handout keeps its page photos privately with the material you save, next to the text you reviewed, so you can look at the actual pages later. You can delete one photo or all of them at any time in the Library (the text stays); deleting the material or your account deletes them too.
• A board or paper scan keeps the photos in the note by default (“Keep the photos in the note”); you can switch that off before saving or remove the images from the note later.
• Stored photos count toward your storage, are only shown to you, and are included in your data export.
• Photos are never used to recognise or identify people; faces in them are ignored. We don’t use your photos to train AI models.

AI can be wrong

AI output can contain mistakes. Practice scores and progress states are study aids, not grades or predictions of exam results. You can report any item you think is wrong.

No automated decisions with legal effects

FluxStudy does not make decisions based solely on automated processing that have legal or similarly significant effects on you (Art. 22 GDPR). Review schedules and progress states only organise your own study, and you stay in control of your plan.

We use a small number of providers to run FluxStudy. Each may only process personal data for the purposes described here. We don’t sell personal data or share it with advertisers.

AppHelm is a product of our own corporate group, so analytics data stays within Sansa Group AB rather than going to an unrelated company.

Data processed worldwide

Our vendors for hosting, payments, AI and email may store and process your data on servers around the world, including outside the EU/EEA and the UK. Where the law requires it, these vendors rely on recognised safeguards such as the EU Standard Contractual Clauses or the EU–US Data Privacy Framework. You accept this Privacy Policy and our Terms of Service when you sign in or use FluxStudy. If you don’t agree to your data being processed this way, please don’t use FluxStudy.

We may also disclose data where the law requires it, to protect people’s safety or our legal rights, or as part of a merger or sale of the business, with this policy continuing to apply.

Your data is kept while your account is active and deleted when you delete your account. The retention column in section 3 gives the specifics. When you delete your account from Settings, this is what happens:

• All your sessions are ended immediately, on every device.
• Your uploaded files and generated images are deleted from storage, and your search embeddings are deleted.
• Your account and study data are deleted from our database: materials and extracted text, courses, goals, plans, practice items, answers, review schedule, mock exams, focus sessions, rewards, Nova preferences, reminder settings, product events and usage records.
• Content reports you filed are kept for quality and abuse-prevention records, but disconnected from you.
• Billing event receipts are kept as accounting law requires, and Stripe keeps its own transaction records. Deleting your FluxStudy account does not by itself cancel a paid subscription, so please cancel it first (Pricing → “Current plan · manage”).
• Copies in our database provider’s point-in-time recovery backups expire on a rolling basis and are not used to restore deleted accounts.

Deleting your account also removes some storage on the device you use at the time. To remove everything from a device, clear site data for fluxstudy.com (see the Cookie & Storage Policy).

Under the GDPR you have the right to:

• Access the personal data we hold about you and get a copy.
• Rectification: correct inaccurate data. You can change most things yourself in the app.
• Erasure: have your data deleted. Use “Delete account” in Settings → Account, or ask us.
• Restriction: ask us to limit processing while an issue is resolved.
• Data portability: receive your data in a machine-readable format. In Settings you can export flashcards (CSV), notes (Markdown) and plans (CSV), and your committed plan as a calendar file (ICS). Ask us for anything else.
• Object to processing based on legitimate interests, such as product events or reminders. You can switch reminders off in Settings.
• Withdraw consent at any time where we rely on consent (optional preference and analytics cookies). Use “Cookie settings” in the site footer, the Cookie & Storage Policy or Settings → Privacy & data. Withdrawing is as easy as giving consent and doesn’t affect processing that happened before. FluxStudy’s core service never depends on consent to optional cookies.
• Complain to a supervisory authority: in Sweden, Integritetsskyddsmyndigheten (IMY), imy.se (opens in a new tab), or the authority where you live or work. We’d appreciate the chance to help first.

Our GDPR page explains each right, the legal bases we use and how international transfers are protected in more detail.

Study buddies are off until you invite someone or accept an invite, and you can have at most 5. A buddy sees only your first name, whether you studied today (yes or no), how many days you studied this week inside a shared weekly goal you both joined, and your streak count if you turn that on. You choose this per buddy in Progress. Buddies never see your notes, cards, grades, mock scores, minutes, times of day, courses, exam dates or your “why”. There are no rankings, no public profiles and no notifications.

Invite links work once and expire after 7 days; we store only a scrambled (hashed) version of the link. If you invite someone by email, we send that one invite and keep only a hashed form of the address, to limit invites to 5 a day. Removing a buddy is instant and they aren’t told. Expired invites are deleted daily, cheers after 30 days and shared goals after 12 weeks. Buddy data is included in your export and deleted with your account (legal basis: contract — 6(1)(b)).

Any learner can create a class and teach it, or join one with an invite. A teacher sees your first name and that you joined. Nothing about your studying is shared by default. In each class you can choose to share study days per week, practice on the class’s pack cards, progress on the pack’s objectives and mock scores on pack courses, and turn each off again at any time; we record each choice (consent, 6(1)(a)). Teachers never see your notes, Nova chats, your “why”, habits, results outside the class’s packs or times finer than a day. Class averages only appear when at least 5 students share the same thing, and there are no rankings.

Course packs a teacher publishes are copied into your own library when you add them, and stay yours if you leave. Files a teacher shares stay in the teacher’s storage and are viewable only by class members while the pack is live; teachers confirm they have the right to share them. Invite links expire and are stored only as a hash; email invites keep only a hashed address for rate limiting, and expired invites are deleted daily. Leaving a class is instant. Class data is in your export. If you delete your account, your memberships and sharing choices are deleted; a class you taught alone is closed (students keep their copies), and packs you created in a class with other teachers are removed (legal basis for running classes: contract, 6(1)(b)).

• Sign-in emails from auth@fluxstudy.com, only when you ask to sign in. They contain a link or code that expires after 5 minutes.
• Study reminders and a weekly recap from notifications@fluxstudy.com, sent outside your quiet hours. Turn them off any time in Settings.
• We don’t send marketing emails, and we don’t track email opens or clicks.

• All connections use HTTPS. Session cookies are HttpOnly, Secure and SameSite.
• Sign-in links and codes are stored hashed, expire after 5 minutes, work once, and are rate-limited.
• Sign-in emails are protected by a human check (Cloudflare Turnstile) against automated abuse.
• Every request is checked against your account: your files, passages and search results are only reachable by you. Stored files are private and not publicly listed.
• Payment card details are handled by Stripe and never touch our servers.

No system is perfectly secure. If a personal data breach is likely to put your rights at risk, we will notify the supervisory authority and, where required, you.

FluxStudy is for adults aged 18 and over. We don’t knowingly collect personal data from anyone under 18. If you believe someone under 18 has an account, contact us and we will delete it.

We use strictly necessary cookies and on-device storage to run FluxStudy and remember settings you change. Optional preference and analytics cookies are only used after you allow them in our cookie banner, and are off by default. We honour Global Privacy Control as a refusal of analytics. There are no advertising cookies.

Analytics will be provided by AppHelm (product analytics), which is not yet enabled. You can change or withdraw your choice at any time through “Cookie settings” in the footer or Settings → Privacy & data; when you withdraw, analytics stops and the analytics cookies we can identify are deleted. See the Cookie & Storage Policy for every item.

If you live in California, our Notice for California Residents explains your rights under the CCPA/CPRA. We do not sell or share personal information.

We’ll update this policy when our practices or providers change, and revise the “last updated” date. If a change materially affects how we use your data, we’ll tell you in the app or by email before it takes effect.