Privacy

You connect Studea to your school's Canvas with an access token you generate yourself. With it, Studea reads your child's classes, the scores published in them, the assignments in those classes and whether each one has been submitted, marked, or flagged as missing. It reads the current term and roughly the two before it, so a grade has something to be compared against.

Studea only ever reads. It never submits work, messages a teacher, or changes anything at the school. That is a limit we impose, not one Canvas imposes: the token Canvas gives a parent carries that parent's own permissions, because Canvas does not offer parents a read-only one. We would use a scoped credential the day one exists.

The token is encrypted before it is stored and is never shown back to you or to anybody else. You can revoke it from your own Canvas settings at any time, without telling us first, and Studea stops working immediately when you do.

Six optional questions about your child and about you: how they behave when a class gets hard, what is going on outside school, what has worked before, anything a teacher would not know, how you want to be told when something is wrong, and what you are already worried about. Every one can be skipped, and answering none of them is a supported way to use the app.

These change how Studea talks to you and never what it found. They are private to your household, they are never shown to the school, and you can read, change or empty any of them at any time from About.

Anything you type into the assistant is kept too, so a conversation can carry on where it left off.

• Your email address, and your name if your sign-in provider gave us one.
• Your child's first name and grade level. Not a surname, not a date of birth, not a photograph, not an address.
• Their classes, the teacher's name where the portal publishes it, and every score Studea has observed, with the date it saw each one.
• Assignments and submissions: the name, what it is worth, when it was due, and whether it is submitted, marked, late or missing.
• What Studea decided was worth telling you, and whether you opened it.
• Your answers to the six questions, and your conversations with the assistant.
• Your encrypted school token, and which school it belongs to.
• If you turn notifications on, the subscription your browser issues so a message can reach that device.
• A record of household invitations sent and accepted, and an internal log of actions taken on an account, which is how a question about what happened to somebody's data can be answered honestly.

Studea is built on other companies' infrastructure, and being specific about which is the only way this section is worth reading.

• Supabase stores the database and handles sign-in. Everything in the list above lives there.
• Vercel runs the app and serves the pages.
• Anthropic runs the model behind the assistant. This is the one worth reading twice: when you ask the assistant a question, your child's first name, grade level, class names, teachers, scores and your answers to the six questions are sent to Anthropic's API so a reply can be written. The same happens when Studea words one of its own cards. Nothing is sent unless there is something to answer.
• Resend sends the two emails Studea sends: a sign-in link, and a household invitation.
• Google, only if you choose to sign in with Google, and only to establish that the address is yours.

Each of those companies has its own terms about what it does with what passes through it. We have chosen them and we are responsible for that choice, but their policies are theirs and are worth reading if this matters to you.

Nobody else. No advertising network, no analytics product, no data broker, no tracking pixel, and no third-party script on any page.

• Your child's data is never sold, rented, or shared for anybody else's advertising.
• It is never shown back to the school, to a teacher, or to another family.
• It is not used to train anybody's model by us.
• Studea does not profile your child for anyone but you, and does not compare them to other children.
• There are no cookies beyond the one that keeps you signed in. Nothing here follows you to another site.

The account belongs to a parent or guardian. A child does not sign in, is not asked for anything, and has no account. What Studea holds about a child comes from a school record their parent already has the right to see, and from what that parent chooses to write down.

Studea is not directed at children and does not knowingly collect anything directly from one. If a child has used a parent's signed-in device, that is the parent's account and the parent controls it.

Schools and districts have their own obligations about student records. Studea is a tool a parent points at their own child's record; it is not a service bought by a school and it holds no relationship with one.

Grades and the things derived from them are kept while your account exists, because a score means very little without the term behind it.

Delete your account and everything tied to it goes with it: the children, the classes, the scores, the assignments, the conversations, the notes you wrote, and the school token. Ask and it will be done, and you will be told when it has been.

Revoking the token in Canvas stops any further reading immediately, whether or not you delete the account.

The school token is encrypted at rest. Access to your household's rows is enforced by the database itself rather than only by application code, so a bug in a screen cannot show one family another family's child.

Studea is in development and is built by a very small team. That does not change what is written above, but it is a fair thing to weigh: no independent security audit has been done, and this page will say so until one has.

If this policy changes in a way that affects what is collected or where it goes, you will be told inside the app rather than by a silent edit to this page.

Questions, corrections, or a request to see or delete what is held. Use Tell me what's wrong, under The app in Settings. It reaches a person.

Written to be accurate about what this app actually does and readable by the people it affects. It is not legal advice and has not been reviewed by a lawyer.