Tietosuojakäytäntö
Miten MaxStudy kerää, käyttää, jakaa ja suojaa tietoja verkkosivustollamme ja sovelluksissamme.
Päivitetty viimeksi 29. lokakuuta 2026
Alla oleva englanninkielinen teksti on tämän asiakirjan oikeudellisesti sitova versio.
1. Introduction
This Privacy Policy explains how MaxStudy ("MaxStudy," "we," "us," or "our") collects, uses, shares, and protects information when you use our website, applications, and related services.
The controller of your personal information is Molte Labs Ltd. (Israeli company number 517419230), Kfar Giladi 43, Tel Aviv, Israel. Privacy contact: support@maxstudy.app.
2. Information we collect
- Account information, such as your name, email address, user identifier, profile image, and basic information received from supported sign-in providers.
- Content you choose to provide, such as audio recordings, PDFs, images, documents, text, chat questions, folders, bookmarks, and onboarding answers.
- Service information, such as transcripts, summaries, flashcards, quizzes, AI conversations, processing status, feature usage, and subscription status.
- Technical information, such as IP address, browser or device type, operating system, application version, diagnostic logs, crashes, and security events.
- Study group information, such as the groups you create or join, your role, when you joined or left, the notes you add to a group, your study progress on shared notes, and the reports and blocks you make.
- Fraud-prevention data for study groups: one-way hashes of a device identifier and of your sign-in identities, described in section 6.
- Website purchase information received from Paddle, such as customer, transaction, subscription, plan, payment status, and billing-country details. MaxStudy does not receive or store full payment-card details from Paddle Checkout.
3. How we use information
- Provide accounts, uploads, recordings, transcription, study-material generation, AI chat, synchronization, and account history.
- Process and manage subscriptions, access rights, billing support, cancellations, and refunds.
- Secure the service, prevent fraud and abuse, diagnose problems, provide support, and maintain service reliability.
- Analyze and improve product performance, user experience, and features, subject to applicable law and your available choices.
- Meet legal obligations, enforce our agreements, and protect users, MaxStudy, and third parties.
4. Service providers and sharing
We share information only as reasonably necessary to operate, secure, support, and improve MaxStudy or as required by law.
We do not sell your personal information. We share limited data with advertising and attribution partners to measure our ads, as described below.
The service providers we use, and what they do for us:
- Supabase: database, authentication, and file storage.
- Google Cloud Run (EU, europe-west1): processing of recordings and documents.
- Google Gemini, OpenAI, Deepgram, and Speechmatics: transcription and AI processing of your recordings, documents, and chat questions. Under our agreements, these providers do not use data sent through their business APIs to train their models.
- PostHog (United States): product analytics.
- Sentry: crash and error reports.
- Google Analytics: website analytics.
- Meta (Pixel and Conversions API): advertising measurement, which may include a hashed email address, IP address, and user agent. Used only with your consent where required.
- AppsFlyer: app install attribution (which ad or link led to an install or purchase). On iOS, AppsFlyer receives your device's advertising identifier only if you allow tracking in the iOS prompt. On Android, you can reset or delete your advertising ID in your device settings.
- RevenueCat: mobile app subscription management.
- Apple and Google: sign-in and the app stores. Apple and Google also process purchases made through their app stores.
- Netlify: website hosting.
- Paddle: web payments. Paddle is the Merchant of Record for website purchases and acts as an independent controller under its own privacy notice.
5. Uploaded content, recordings, and AI processing
When you upload or record content, it may be transmitted to and processed by our storage, transcription, and AI providers to produce the features you request.
Processing your recordings and documents with these providers is necessary to provide the service. You choose what to record or upload. You are responsible for having permission to record lecturers or other people where required, and for providing required notices and obtaining necessary permissions before recording or uploading material involving other people or protected content.
Source files and generated results may be retained for as long as reasonably necessary to provide the service, maintain security, resolve problems, and meet legal obligations. Some temporary source files may be removed after processing while generated materials remain in your account.
6. Study groups
If you create or join a study group, some of your information is visible to other people, and we keep some records to prevent abuse of free access.
- What other members see: your first name (the first word of your profile name, never your email address or full name), whether you are the group owner, when you joined, the titles and content of the notes you share (their summaries, flashcards, quizzes, and transcripts). Before opening a note, members see its title, your first name, the date it was added, and a short preview.
- What members do not see: your uploaded source files (audio recordings are not kept), AI chats, and your own flashcard and quiz results.
- What people with the invite link see: a signed-in user who opens the link or enters the code before joining sees the group name, the owner's first name, the number of members and notes, and the titles of up to five recent notes. Anyone who opens the link on the web without signing in sees only the group name, the number of members and notes, and whether the group can be joined. To rate-limit that page we store a keyed hash of the visitor's IP address, not the address itself, and routinely delete these records after two days.
- Device identifier: when you open a shared note on the free plan or report content, the app sends a device identifier, either the AppsFlyer install ID the app already uses for attribution or, if that is unavailable, a random ID created for your app install. We store only a one-way hash (SHA-256) of it, to limit free unlocks per device, detect accounts created to get extra free access, and prevent coordinated false reports.
- Sign-in identity hash: each free unlock of a shared note also stores one-way hashes (SHA-256) of your sign-in identities, meaning your email address and your Apple or Google account identifier. We use them while your account exists to limit free unlocks per person and to prevent abuse, such as creating extra accounts. They contain no raw email address, Apple or Google identifier, or device identifier. When you delete your account, these records, including the hashes, are deleted with it.
- Moderation records: when you report content we keep the reason, any details you write, the reported note or group, who made the report, the person reported, and the hash of your device identifier. When you delete your account, the device hash is removed from your reports. When you block someone we keep the block until either account is deleted. Reports are kept after account deletion without the link to the deleted account and without the device hash, for as long as reasonably necessary to handle them and protect the service.
- Notes you shared stay in the group if you leave or are removed, unless you remove them first. If you delete your account, your notes are deleted and leave every group, and groups you own pass to another member or are deleted if nobody else is in them.
7. Legal bases
Depending on where you live, we process information on the following legal bases:
- Providing the service, including uploading and transcribing recordings and processing recordings and documents with AI: performance of our contract with you (Article 6(1)(b) GDPR).
- Security, crash reports, fraud prevention, and product analytics: our legitimate interests (Article 6(1)(f)). This includes the study group device and identity hashes and moderation records, which we process to prevent fraud and abuse of free access, keep groups safe, and handle reports.
- App install attribution (AppsFlyer) and website analytics (Google Analytics): our legitimate interest in knowing which of our marketing works (Article 6(1)(f)). You can object at any time by emailing support@maxstudy.app.
- Meta advertising measurement (Pixel and Conversions API): your consent where required by law, for example in the EU and UK (Article 6(1)(a)).
- Billing and tax records: legal obligation (Article 6(1)(c)).
8. Security and retention
We use reasonable technical and organizational safeguards designed to protect information in transit and at rest and to restrict unauthorized access. No security method can guarantee absolute protection.
We retain personal information only for as long as reasonably necessary for the purposes described here, including providing your account, meeting legal and accounting obligations, resolving disputes, enforcing agreements, and preventing fraud. Specific periods:
- Account content: until you delete it or your account.
- Audio recordings: deleted after transcription. Recordings that fail to process are deleted within 30 days. Files you add to a note as sources stay with that note until you delete it.
- Billing records: as required by tax law (up to 7 years, Israel).
- Deleted-account billing marker (internal IDs only, no name or email): 18 months, or longer only while a subscription can still renew.
- Analytics events: deleted when you delete your account.
- Copies of payment-provider events: personal details removed after 90 days.
- Web checkout data that never converted to a purchase: email and answers removed after 30 days.
9. Your choices and rights
Depending on applicable law, you may have rights to access, correct, delete, export, restrict, or object to certain processing of your personal information. You may also withdraw consent where processing is based on consent. You can download your data from Settings on the web (maxstudy.app). If you are in the EU, UK, or a similar jurisdiction, you also have the right to lodge a complaint with a supervisory authority, such as the data protection authority in your country of residence.
You can request account deletion through supported product controls or contact support@maxstudy.app. Some information may be retained where required by law or reasonably necessary for security, fraud prevention, accounting, or dispute resolution, including the study group records described in section 6.
10. Children
MaxStudy is intended for users aged 16 and over. Users under 16 (or under the lower age set by the law of their country, but never under 13) may use MaxStudy only with the consent of a parent or guardian. Children under 13 may not use MaxStudy. If we learn that we hold a child's personal information without the required consent, we will delete it.
11. International transfers
Information may be processed or stored outside your country, including in the United States and other countries, through our service providers. Where required, we rely on European Commission adequacy decisions (including the decision covering Israel, and the EU-US Data Privacy Framework for certified providers) and otherwise on Standard Contractual Clauses, and we continue to protect information as described in this policy.
12. Cookies and similar technologies
On our website we use the following cookies and similar technologies:
- Consent and preference cookies: maxstudy_consent_choice (your cookie choice), maxstudy_consent_required (whether consent is required where you are), maxstudy_locale and nf_lang (your language).
- Local storage: maxstudy_onboarding_draft_v1 (your unsent sign-up answers) and maxstudy_funnel_id (a random ID linking steps of the sign-up and checkout flow).
- Product analytics: PostHog cookies and local storage.
- Website analytics: Google Analytics cookies.
- Advertising measurement: Meta cookies _fbp and _fbc. These are set only with your consent where required.
- You can change your cookie choice at any time by clearing the maxstudy_consent_choice cookie in your browser, which shows the consent prompt again, or by contacting support@maxstudy.app. You can also block cookies in your browser settings.
13. Changes and contact
We may update this Privacy Policy from time to time. We will update the date shown on this page and will notify you of material changes.
Privacy questions and requests may be sent to MaxStudy at support@maxstudy.app.