Privacy policy
Last updated 16 August 2026. Written to describe what the software actually does, not what a template says it might.
Who is responsible
The controller of your personal data is Piotr Gebski, Stolarskiego 10/12, 97-200 Tomaszow Mazowiecki, Poland (tax identification NIP 7732424192). For anything in this policy, including any request below, write to piotr@gebski.cloud.
What we collect, and why
| What | Why | Legal basis |
|---|---|---|
| Your email address, and a display name if you set one | To create your account, sign you in, and contact you about it | Performance of our contract with you |
| Documents you upload — the PDF itself, the text extracted from it, and the filename | To produce the study pack you asked for | Performance of our contract with you |
| What we generate — notes, questions, flashcards, and your flashcard review history | To show you your packs and schedule your revision | Performance of our contract with you |
| Credit and charge records | To run your balance and keep proper accounts. Card details are handled by our payment provider and never reach us | Contract, and a legal obligation to keep accounting records |
| Your IP address, stored as a counter | To rate-limit sign-in attempts and the emails this site can be made to send, which stops the service being used to spam other people | Our legitimate interest in keeping the service secure |
| Usage events — that a pack was built or a run failed, tied to your account | To find faults and understand which features are used | Our legitimate interest in improving the service |
| Your email on the waiting list, and which page you submitted it from | To email you once, when StudySift opens | Your consent, which you may withdraw at any time |
Your documents are sent to an AI provider
This is the part most worth reading. To build a study pack we send the text of your document to Anthropic, in the United States, which is the service that reads and summarises it. If your document contains personal or confidential information, that information is sent too.
We do not send your name, email address, or account details along with it — only the document text and our instructions. But if you would not be comfortable with a third-party provider processing a document, do not upload it.
Who else handles your data
We use these providers to run the service. They act on our instructions and may not use your data for their own purposes.
| Provider | What for | Where |
|---|---|---|
| Supabase | Database, accounts, and file storage | EU (Frankfurt) |
| Fly.io | The worker that reads documents and builds packs | EU (Frankfurt) — fly.toml sets primary_region = fra |
| Vercel | Hosting the website | United States and edge locations |
| Anthropic | Reading and summarising the documents you upload | United States |
| Resend | Sending account and notification email | United States |
Your account data and your documents are stored in the European Union. Where a provider is outside the EEA, the transfer relies on the European Commission's Standard Contractual Clauses.
We do not sell your data, and we do not share it for advertising.
How long we keep it
| What | Kept for |
|---|---|
| Uploaded documents and their extracted text | 30 days, then deleted automatically. Your study packs remain. |
| IP address counters | 24 hours |
| Your account, packs and flashcards | Until you delete your account |
| Billing records | About 5 years, as accounting law requires, even after an account is closed |
| Waiting list address | Until we email you at launch, or until you ask us to remove it — whichever comes first |
Cookies
StudySift sets one cookie, and only after you sign in: a session cookie that keeps you signed in. It is required for the site to work, so we do not ask for consent to it and there is no cookie banner.
We use no advertising cookies and no cross-site tracking of any kind.
Analytics
We use Vercel Web Analytics to count page views, so we can see which pages people find useful. It sets no cookies and does not build a profile of you or follow you to other sites, which is why there is no consent banner for it.
It records the page address, the referring page, and coarse details of your browser, device and country. Before anything is sent we strip the parts that would identify you or your work: sign-in and password-reset links are never reported at all, because their addresses contain a single-use token, and the identifiers of your documents and study packs are replaced with a placeholder — so we can see that a pack was opened, never which one or whose.
Vercel is our hosting provider and processes this on our behalf, inside the European Union. Our lawful basis is legitimate interest in understanding which parts of the site work; you can object at any time using the contact details below.
Your rights
Under the GDPR you may ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to another provider. Where we rely on your consent — the waiting list — you can withdraw it at any time, without affecting what was done beforehand.
Write to piotr@gebski.cloud and we will respond within one month.
If you think we have handled your data wrongly you can complain to the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa — or to the authority in the EU country where you live.
Age
StudySift is for people aged 16 and over. We do not knowingly collect data from anyone younger. If you believe a child has given us their data, tell us and we will delete it.
Security
Data is encrypted in transit. Every table in our database enforces row-level security, so one account's data cannot be read by another. Access to production systems is limited to the operator of the service.
No system is perfectly secure. If we ever discover a breach that puts your rights at risk, we will tell you and the supervisory authority as the law requires.
Changes
If we change this policy we will update the date at the top, and for any change that materially affects you we will email you before it takes effect.
Questions about any of this go to piotr@gebski.cloud.