Privacy Policy
Version 1.1. Effective October 27, 2026.
StudyHertz (studyhertz.com, the "Service") is run by Alaric Hartsock, an individual in Bend, Oregon, USA ("we", "us"). This policy explains what we collect, why, who we share it with, how long we keep it, and the choices and rights you have. It is part of our Terms of Service.
1. What we collect
- Account: your username and a salted hash of your password (never the password itself). We check your birth year once at sign-up to confirm you're 13 or older; we don't store it.
- Social sign-in: if you use Apple, Google, GitHub or Microsoft, we receive that provider's account ID for you, your name, and your email address if you share it (Apple may give us a private relay address). We record whether the provider verified the email.
- Study data you enter: study sessions (subject, activity, times, notes, focus ratings), subjects and goals, exams and scores, to-dos, plans, practice logs, settings and achievements.
- Bug reports and feedback you send us. Please don't include health or other sensitive details.
- Legal consent records: when you accept the Terms we log your user ID, the Terms and Privacy versions, the time (UTC), how you signed up, your IP address, your browser's user agent and the exact checkbox text.
- Technical data: IP addresses and request logs kept by our hosting and network providers for security and reliability, and sign-in session records.
- Cookies and local storage: see section 4.
2. How we use it, and our legal bases
- To provide the Service: running your account and showing your data back to you (performance of our contract with you).
- To keep the Service secure, prevent abuse (for example rate limits) and fix bugs (our legitimate interests).
- To keep records of your acceptance of the Terms (legal obligation and legitimate interests).
- To measure our ads with Google Ads and to understand how the site is used with Google Analytics, only if you click Accept on the cookie banner (your consent, which you can withdraw at any time).
We don't sell your personal information for money. We don't use your study data for advertising.
3. Who we share it with (subprocessors)
- Render (Render Services, Inc., USA): hosts the app and its database.
- Stripe (Stripe, Inc., USA): processes subscription payments. Stripe receives your payment details directly; we only keep your Stripe customer ID and your plan, status and renewal date.
- Cloudflare (Cloudflare, Inc., USA): DNS and network delivery for studyhertz.com, which can involve your IP address and request data.
- Google Ads and Google Analytics (Google LLC, USA): only if you accept cookies. See section 4.
- Sign-in providers: Apple, Google, GitHub and Microsoft, only if you choose to sign in with them. Their own privacy policies apply to your account with them.
We may also disclose information if the law requires it, to protect users or the Service, or as part of a transfer of the Service (we'll tell you first). These providers are in the United States. If you use StudyHertz from outside the US, your data is transferred to and processed in the US.
4. Cookies, Google Analytics, Google Ads and your choices
Necessary: a session cookie (sid) keeps you signed in, and short-lived cookies (oa, ps) protect social sign-in. Your theme and preferences are kept in your browser's local storage. These don't require consent and are never shared.
Advertising (optional): Google Ads. If you click Accept, Google's tag (which loads on every page) (from googletagmanager.com, ID AW-18541546430) switches to full measurement: Google may then set cookies such as _gcl_au and use cookies on Google domains to measure whether our ads lead to sign-ups (conversion tracking) and to personalize ads. Under California law, this can count as "sharing" personal information for cross-context behavioral advertising. Google processes this data under its privacy policy; see also how Google uses cookies in advertising.
Analytics (optional): Google Analytics 4. If you click Accept, the same Google tag also sends Google Analytics usage data: pages viewed, approximate location derived from your IP address, device and browser type, and how you arrived (for example, from a search or an ad). Google may set cookies such as _ga and _ga_* (kept up to 2 years). We use these reports in aggregate to improve StudyHertz; we don't send your study data, username or email to Google Analytics. Google Analytics data is retained for 14 months.
Before you choose, or if you click Decline: we use Google's consent mode. The Google tag still loads, but with all consent types set to "denied". In that state Google sets and reads no cookies; it receives only cookieless measurement pings (for example, that a page was viewed or a sign-up happened, with your IP address, browser information and the page address, and ad-click identifiers redacted). Google uses these pings in aggregate to model conversions and usage. We honor the Global Privacy Control (GPC) browser signal: with GPC on, advertising consent stays denied even if you click Accept.
Do Not Sell or Share / change your choice: open cookie settings at any time; this link is also in the footer of the home page. If you withdraw consent, the tag immediately switches back to cookieless pings. To remove cookies Google already set, clear this site's cookies in your browser. You can also manage ad personalization at adssettings.google.com.
5. How long we keep data
- Account and study data: while your account is active. After you delete your account, we delete it within 30 days, except copies in backups, which roll off within 35 days.
- Sign-in sessions: up to 30 days, or until you sign out.
- Bug reports: until resolved, plus up to 12 months.
- Consent records: for as long as your account exists plus up to 6 years, to show what you agreed to.
- Hosting and network logs: kept by Render and Cloudflare under their own retention periods, typically up to 30 days.
6. Your rights
Wherever you live, you can ask us to access your data, export it (you can also export your sessions yourself from the app's Data page), correct it, or delete your account and data, and you can withdraw consent to advertising cookies at any time. If you're in the EU, the UK or another place with similar laws, you may also have the right to object to or restrict processing, and to complain to your local data protection authority. California and Oregon residents have similar rights under the CCPA/CPRA and the Oregon Consumer Privacy Act, including the right to opt out of "sharing" for targeted advertising (see section 4). We won't treat you differently for using these rights.
To make a request, email support@studyhertz.com from the address linked to your account, or tell us your username. We'll respond within 30 days (45 days where the law allows), and we may need to verify that the account is yours.
7. Children
StudyHertz isn't for children under 13, and we don't knowingly collect their personal information. Sign-up asks for a birth year and blocks anyone under 13. If you're under 18, a parent or guardian must agree to the Terms for you. If we learn that we have collected information from a child under 13, we'll delete it. Parents can contact support@studyhertz.com.
8. Security
We use HTTPS, salted password hashing, HttpOnly session cookies, rate limits on sign-in and sign-up, and signature checks on social sign-in tokens. No system is perfectly secure. If a breach affects your personal information, we'll notify you and the authorities as required by law, including Oregon's breach notification law (ORS 646A.604). Report security issues to security@studyhertz.com.
9. Health-related notes
StudyHertz isn't a health app. Please don't enter health, mental health or other sensitive information in notes or bug reports.
10. Changes to this policy
We'll post changes here with a new version number and effective date. For material changes, we'll notify you in the app before they take effect.
11. Contact
support@studyhertz.com. Alaric Hartsock, Bend, Oregon, USA. Security: security@studyhertz.com.