Privacy Policy

1. Information we collect

• Account information — your email address, a securely hashed password (if you register with email/password), your name, and, if you sign in with Google, the basic profile information Google provides.
• Content you save — citations, reference lists, and projects you create and choose to save in your account.
• Billing information — if you subscribe to a paid plan, Stripe (our payment processor) handles your payment details directly. We store only your Stripe customer/subscription identifiers and your current plan, never your full card number.
• Usage metadata — for AI-assisted features, we record usage counts (e.g. credits used) to enforce plan limits. We do not store the raw text of your documents for this purpose.

2. How we use your information

We use your information to provide and improve the Service: authenticating you, saving your citations/projects, processing subscription payments, enforcing plan limits, and responding to support requests. We do not sell your personal information.

3. Cookies and local storage

We use a session cookie to keep you signed in, and your browser's local storage to remember your light/dark theme preference. We do not use advertising trackers, and we do not sell or share your information for advertising.

Only if you accept optional analytics, our analytics provider stores identifiers in your browser - a cookie and a local storage entry - so that the pages you view and the actions you take in one visit can be counted together as a single journey, and a return visit can be recognised as a return. They are randomly generated, are not derived from your device, and last until you clear your browser data. We do not use browser or device fingerprinting, and we do not track you across other websites.

Until you accept, none of that exists. We do not load the analytics software, so it cannot create an identifier or store anything, and we record no first-visit information of our own. If you decline, it stays that way. The choice itself is kept in your browser's local storage as a single word - accepted or rejected - and a version number; it contains nothing about you.

If you buy a one-time Assignment Scan without an account, we also set a cookie that identifies your browser as the owner of what you paid for. It holds a random signed token and nothing else, and without it we could not show you the check you have already bought when you return from the payment page.

4. Product analytics

We use a product analytics service (PostHog) to understand which StudyRef features are used and where people get stuck, so we can improve the Service. It is available on this site and it is optional: we ask before starting it, we do not load the analytics software until you accept, and StudyRef works exactly the same whether you accept or decline. You can change your answer at any time using the Cookie settings link in the footer. Our code also sends nothing unless analytics has been switched on and configured, so a deployment of StudyRef that has not enabled it sends no analytics data at all.

What we record is a fixed list of product events — for example that an assignment check completed — together with counts and categories such as how many citations had no matching reference. Every event StudyRef can send is defined in advance in our code, and properties that are not part of that definition are discarded before anything is sent.

The following are not sent to our analytics service:

• the text of your assignment, or any part of your document
• the contents of any file you upload, whether or not it is saved
• the wording of your assignment brief, rubric, or its requirements
• your citations, references, or the titles of the sources you cite
• the names of files you upload
• the address of the page you came from beyond its site name, or anything you typed into a search engine to find us
• your name, your email address, or your institution email address
• payment identifiers from Stripe

For signed-in users we attach a pseudonymous reference: a one-way hash of your account id, used so that we can tell that the same account performed a sequence of actions. It is not your account id and cannot be read back into one, but it is a persistent reference to you rather than anonymous data. Signed-out visitors have no such reference.

We measure how people arrive at StudyRef and what they go on to do, so we can tell which pages and which of our free tools are genuinely useful. That means recording the kind of source a visit came from - for example a search engine, a link from another site, or a direct visit - together with which StudyRef page you arrived on and which of our tools you then used. We record the site name a visit came from, never the full address of the page you came from and never anything you typed into a search engine.

We also count purchases as part of this, and only if you accepted optional analytics. When you buy a one-time Assignment Scan, we attach the analytics identifier described above to the payment record we create with Stripe, so that a completed payment can be counted against the visit that led to it - including when you buy without an account, which is otherwise impossible for us to connect to anything. The identifier is the only thing we add for this purpose: it is a random token or the one-way hash described above, it cannot be read back into your identity, and no part of your assignment, your brief, your references or your file names is ever placed in a payment record. Our servers check the identifier before sending it and again when reading it back, so nothing else can travel in its place.

If you decline optional analytics, none of that happens: no analytics identifier is created, none is attached to your payment, and we record nothing in our analytics service - not a page view, not a purchase, not the fact that you created an account or started a subscription. Your account, your purchase, your receipt, your plan and what you paid for are all unaffected - those are business records kept by us and by Stripe, and your analytics choice does not change them.

Page views and session information are sent from your browser directly to the analytics provider, using their official software. Everything else - the product events described above, and anything raised from our servers such as a completed payment - is sent from our servers. We do not use session recording, screen recording, heatmaps, keystroke capture, or automatic capture of what you click or type: the provider's automatic capture feature is switched off, so only the events we have defined are recorded. We instruct the provider not to record your IP address or derive your location from it.

If you would prefer your usage not to be included, email us at support@mystudyref.com and we will exclude your account.

5. Third parties

We share the minimum data necessary with the services that power StudyRef: Stripe (payments), Google (if you use Google sign-in), PostHog (product analytics, as described in section 4), and our database/hosting providers. These providers process data on our behalf and under their own privacy commitments. As described in section 4, the record we create with Stripe for a one-time Assignment Scan carries our analytics identifier so the purchase can be attributed - but only if you accepted optional analytics; no payment identifier from Stripe is sent to our analytics provider in the other direction.

6. Data retention and deletion

We retain your account data for as long as your account is active. To request deletion of your account and associated data, contact us at support@mystudyref.com.

7. Your choices

You can review and update your account details from your dashboard, and you can cancel a paid subscription at any time (see our Refund Policy).

8. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by an updated "Last updated" date above.

9. Contact

Questions about this policy or your data? Reach us at support@mystudyref.com or via the contact page.