Privacy Policy

What we collect

• Account details — your name, email address and password (stored hashed, never in plain text), plus your university if you choose to add it.
• Academic data you enter — academic years and their weightings, modules and credits, assessments, weights, deadlines and grades. This exists solely so we can calculate your averages, projections and targets. We never share it with other users: friends and leagues see study time only, never marks.
• Study activity — study sessions you log, streaks and weekly goals, and (if you join them) friend, league and squad memberships.
• Subscription data — if you upgrade to Pro or buy a semester pass, payment is processed by Stripe. We store a Stripe customer reference and your plan status; your card details never touch our servers.
• Usage and funnel events — we record basic product analytics, such as which onboarding steps are completed and which features are used, so we can find where the product confuses people and fix it. These events are tied to your account for that purpose, not used to build advertising profiles, and never sold.
• Support messages — if you contact us, we keep the message and your email so we can reply.

Cookies and the consent banner

• Essential cookies — a sign-in cookie keeps you logged in, and a small cookie remembers your cookie-banner choice. These are required for the site to function and do not need consent.
• Advertising cookies (optional) — on the free plan, Google AdSense may set cookies to serve and measure ads. These load only in line with the choice you make in the consent banner, and you can change your choice at any time.

Advertising

The free plan is supported by ads served by Google AdSense. Until you give consent via the cookie banner, any ads shown are non-personalised (NPA) — selected from the context of the page rather than from tracking. If you consent, Google may use cookies to personalise ads; you can learn how Google uses data at Google’s own privacy documentation, and withdraw consent at any time. Pro accounts see no ads and load no advertising scripts or cookies at all. We never pass your grades, study data or email address to advertisers.

Payments

Subscriptions and semester passes are processed by Stripe, a PCI-DSS-compliant payment provider. Stripe handles your card details under its own privacy policy; we receive only a customer reference, the plan you bought and its status. Billing management (cancelling, changing plan, invoices) happens through Stripe’s secure portal.

Email

We send a small number of email types, each with its own purpose:

• Verification and account email — confirming your address when you register, and essential service messages (for example password resets or billing receipts). These are necessary to run your account and cannot be opted out of while you have one.
• Deadline reminders — optional notifications about upcoming assessment deadlines you have entered.
• Streak and study nudges — optional reminders to keep a streak going or hit your weekly goal.

Reminder and nudge emails can be switched off at any time from your account settings or via the unsubscribe link in the email itself. We do not send marketing on behalf of third parties.

How your data is used

To provide the service: calculating your averages, projections and targets; powering the planner, streaks and social features you opt into; processing subscriptions; sending the emails described above; and improving the product using the usage events described above. We do not sell your personal data, and we do not share your academic data with anyone.

Storage, processors and retention

Your data is stored in a managed Postgres database (Supabase). Payments are handled by Stripe; ads on the free plan are served by Google. We keep your data for as long as you have an account. If you delete your account, your academic data, study history and profile are deleted; limited records we are required to keep (such as payment records for tax purposes) are retained only as long as the law requires.

Your rights

Under UK data protection law you can access, correct, export or delete your data. You can export your data and delete your account from within the app at any time, or contact us and we will do it for you. You also have the right to complain to the Information Commissioner’s Office (ICO) if you believe we have mishandled your data — though we would ask you to raise it with us first so we can put it right.

Changes to this policy

If we make material changes to this policy we will update the date above and, for significant changes, tell you by email or in the app before they take effect.

Contact

Questions about your data? Email support@mrenigma.uk or use our contact form.