Privacy Policy - xpStudy

Privacy Policy - xpStudy

Last updated: May 27, 2026

Welcome to xpStudy. This Privacy Policy transparently describes how we collect, use, store, and protect your information. By using our application, you acknowledge the practices described below. When necessary, we will request specific consent for certain purposes. xpStudy is operated by Vinícius de Queiroz Moreira Alves, responsible for data processing.

1. Information We Collect

We collect data that is necessary or appropriate to provide, personalize, improve, protect, and monetize our services, according to the purposes described below:

1.1. Personal Information (Provided by you)

• Account Data: When registering (via Email/Password, Google, or Apple), we collect your Name, Email Address, and Profile Picture to create your identity within the app.

• Generated Content: We collect the study materials you create, including flashcards, summaries, schedule tasks, decks, folders, subjects, and custom exams.

1.2. Behavior and Study Data

• Session History: We record detailed study sessions (start/end times, duration, subject, and focus mode). This data is used to generate your performance charts.

• Gamification: We monitor your daily consistency (streak), XP earned, and level for ranking and reward features.

1.3. Feedback and Support

• Reports: When you use the "Report" function or send feedback, we collect the text details provided, app version, platform, device identifier, and associate them with your User ID for bug fixing, abuse prevention, service improvement, and improving the quality of AI features.

1.4. Financial Information

• Purchase History: We use the RevenueCat service. We have access to your subscription status and purchase history, but we do not process or store your banking or credit card data.

1.5. Device and Security Information (Automatic)

• Identifiers and Diagnostics: We collect advertising identifiers when applicable to Google AdMob and technical diagnostic data used by services such as Firebase Analytics and Crashlytics. The app may also use local notifications on the device for reminders configured by the user.

• Fraud Prevention: We analyze session time metadata to detect inconsistencies and ensure a fair gamification environment.

• Age Range Verification: xpStudy adopts the principle of privacy by default. We query age signals provided by the operating system or app store when available. When age cannot be confirmed, or when the user is identified as an adolescent, we apply Protected Mode by default, reducing tracking, personalized advertising, and sensitive features.

• Device Integrity: We use Firebase App Check as an additional protection layer against fraudulent access and abuse. To do so, the app may request a device integrity token generated by Play Integrity (Android) or App Attest with Device Check fallback (iOS). These tokens are processed by Google's servers to help verify that requests to our services originate from legitimate installations of xpStudy, and are not used by us to individually identify or track users.

• Incident Notification: In the remote event of a security incident (such as unauthorized access to our servers) that may pose a relevant risk to your rights, we commit to notifying affected users and competent authorities, as required by applicable legislation.

1.6. Media and Files

• Gallery and Documents: We request access (only at the time of use) to specific images or files (such as PDFs or Anki packages) for importing content or AI generation. We do not access your camera or microphone directly.

2. Legal Bases and How We Use Your Information

We process your data under the following legal justifications:

• Contract Execution: For authentication, cloud backup, data synchronization, and overall service provision.

• Legitimate Interest: For app improvement, crash analysis (Crashlytics), and fraud prevention.

• Consent: For AI file processing and targeted advertising (when applicable).

Artificial Intelligence and Ephemeral Processing: We use Google Gemini technology to generate summaries and flashcards. When you send a file (e.g., PDF), it is temporarily stored for processing and removed from our active storage shortly after the task is completed. For safety reasons, access to AI features depends on confirmation of the minimum age by the user. xpStudy may ask the user to declare that they are 18 years old or older. This confirmation may be stored locally on the device only to avoid repeated prompts on the same account. If the minimum age is not confirmed, the AI feature may be limited or blocked. Under the applicable terms for paid Gemini API services, prompts, uploaded files, and responses are not used by Google to improve its products or train models, unless voluntary log/dataset sharing is configured by the person responsible for the app.

Advertising and Consent: We display ads through Google AdMob. For users in Europe, we request prior consent for tracking. For users identified as adolescents or whose age is unknown, we apply restrictive advertising settings, disable behavioral tracking when applicable, and keep Analytics/Crashlytics disabled by default according to the app’s technical configuration, in accordance with applicable data protection and child protection rules.

3. Third-Party Sharing

We share necessary data with our infrastructure partners:

•   Google (Firebase, Analytics, Crashlytics and Gemini): database, authentication, storage, statistics, diagnostics, and generative AI.

•   Google AdMob: advertising network.

•   RevenueCat: subscription management.

•   Cloudinary: hosting and optimization of user-uploaded images.

4. Storage and International Transfer

Our servers and databases (Google Cloud) are located in the United States. Your data may be processed and stored outside Brazil by contracted infrastructure providers, with security measures and safeguards compatible with applicable data protection laws. Your data is stored for as long as your account remains active. xpStudy reserves the right to delete accounts that have been inactive for more than 24 months, along with associated data, to minimize unnecessary storage of information. We also use local storage on the device for cache, drafts, preferences, and offline functionality. These data are removed from the app upon logout, account switching, or account deletion, when technically possible.

5. Your Rights and Data Deletion

You have the right to:

• Access and Correct: You can view and edit your data directly within the app.

• Account Deletion: You can request the complete deletion of your account in the app settings or through the web form. This process triggers a recursive deletion that permanently removes your Firebase profile and, through backend routines, removes Cloudinary images linked to your account in our records, including profile pictures and images attached to summaries, flashcards, and decks, as well as linked files in Firebase Storage and reports linked to your account. Profile pictures provided by external login providers, such as Google or Apple, may be displayed in xpStudy through an external URL. In these cases, account deletion removes the reference in xpStudy, but the original file remains under the control of the respective provider.

• Data Portability: You have the right to request a copy of your personal data and generated content (such as flashcards and summaries). To exercise this right, send a request to xpstudy.app@gmail.com. We will provide your data in a structured and machine-readable format within the established legal timeframe.

• Permission Revocation: You can revoke gallery or file access directly in your operating system settings.

6. Children's Privacy and Age Range

• Blocking (< 13 years old): xpStudy is not intended for users under 13 years old. When the user is identified as being under the minimum age or declares that they are under the minimum age, access to the account or to app features may be blocked.

• Protected Mode (13-17 years old and Guests): For adolescents or unverified accounts, we activate Protected Mode by default. Analytical telemetry is suspended, and no personalized advertising tracking is performed.

7. Changes to This Policy

We may update our Privacy Policy to reflect technical and legal improvements. We recommend that you review this page periodically, and continued use of the app after an update indicates awareness of the described practices, without prejudice to specific consent when required.

8. Data Controller and Data Protection Officer (DPO) 

The Data Controller and Data Protection Officer for xpStudy is Vinícius de Queiroz Moreira Alves. To exercise your rights provided by data protection laws or for privacy-related inquiries, please contact us at: xpstudy.app@gmail.com.