Privacy

Who we are

Distill Software LLC, 539 W. Commerce St #8337, Dallas, TX 75208, United States, is the controller of the personal data described here. For anything about this policy or your data, email support@studydistill.com.

What we collect

• Your account. An email address, username, and password, or the basic profile info Google shares if you sign in with Google.
• A birth year. Used only to work out whether an account needs parental consent. We never ask for a full birth date.
• A parent or guardian's email, for accounts that need consent. It is used for that consent and nothing else, and it is deleted when supervision ends.
• Payment details. Handled and stored by Stripe directly. We only see that a subscription exists and which plan it is on.
• Your study activity. What you have practiced and how far you have got, so the app can pick up where you left off.
• Things you create. Notes, flashcards, and the reports you send us about a question.
• Some IP addresses. For requests to a few specific endpoints, used only to detect abuse such as automated hammering of a single link. Your sign-in sessions also record an IP address and browser so you can tell your own sessions apart.

Why we're allowed to use it

If you're in the UK, EU, or somewhere with similar law, these are our legal bases:

• To perform our contract with you: running your account, saving your progress, generating courses, and taking payment.
• Our legitimate interests: keeping the service secure, preventing abuse, understanding which pages get read, and improving how courses are built.
• Your consent: the newsletter, and personalized ads. You can withdraw either at any time in Settings without affecting anything else.
• Legal obligation: keeping billing and tax records.

Cookies and ads

We set cookies of our own only to keep the site working: a session cookie that keeps you signed in, and a preference cookie that remembers your light/dark theme. Neither tracks you across other sites, and there's nothing to opt out of there: without them, logging in wouldn't work.

Our page-view counts (Vercel Web Analytics) use no cookies and no identifier for you, so they can tell us a page was read but not who read it. Everyone gets these, including subscribers and children's accounts.

Free accounts may see ads, served through Google AdSense, which sets its own cookies to serve and measure them.

Those ads are personalized by default, meaning they can be chosen from your activity. You can turn that off at any time in Settings, and turning it off still shows ads, just generic ones. Under California law this counts as “sharing” your personal information, and that switch is how you stop it. We do not sell your personal information for money, and never have.

Two things override that switch, in the direction of less personalization, never more. If your browser sends a Global Privacy Control signal we treat it as turning personalization off, whatever the account setting says and whether or not you have an account. And in the UK, EU and Switzerland ads are never personalized at all, because the law there asks for consent up front rather than a switch you can find later, and a default-on setting is not consent.

Subscribers and accounts belonging to minors never see ads at all, personalized or not.

Do Not Track and Global Privacy Control

If your browser sends a Global Privacy Control signal, we treat it as an instruction not to share your data for personalized advertising, and it wins over the setting on your account. It works signed out too, since it travels with the request rather than with a profile.

We honor Do Not Trackthe same way. There is no agreed standard for what answering it obliges, which is why most sites say they ignore it, but a reader who switched it on has told us what they want and it costs us an ad impression to listen. We don't track you across other sites either way.

Newsletter and service emails

If you opt in at signup or from Settings, we'll occasionally email you about new courses and features, sent through our email provider (Resend). Every email includes an unsubscribe link that takes effect immediately, with no login required, and stops working only if you opt back in.

Separately, we send service emails about your own account: verifying your address, resetting a password, parental consent, and the warning before an inactive account is deleted. These go out whatever your newsletter setting, because they're about your account rather than marketing.

Children's accounts

An account for someone under 16 can only be created by a parent or guardian, who approves it through an emailed link before it's active. Child accounts never see ads, are never offered personalized advertising, and never see the newsletter opt-in at signup. We collect only a birth year for age determination, not a full birth date.

If you're a parent or guardian, you can ask us at any time to show you what we've collected from your child, to delete it, or to stop us collecting anything further, by emailing support@studydistill.com. Refusing further collection means the account is closed, since there's no way to run it without the progress data. A supervising adult can also end supervision once the account holder is old enough, which deletes the adult's email address from our systems.

Who else sees your data

We share data only with the services that make Distill work, and only as much as each needs:

• Vercel hosts the site and counts page views.
• Neon hosts the database your account and progress live in.
• Cloudflare R2 stores our files: course images and the source textbooks we build courses from.
• Stripe takes payments and holds your card details.
• Resend delivers our email.
• Google provides sign-in, and AdSense for free accounts.

We don't sell your personal information, and we don't share it for anyone else's marketing. We may disclose data if the law requires it, or to protect our rights or someone's safety. If the business is ever sold or merged, account data would transfer with it, and we'd tell you before that happened.

Where your data is held

Distill is operated from the United States, and the services above process data in the United States and other countries. If you're in the UK or EU, that means your data is transferred outside your home country. Where that transfer needs a legal safeguard, we rely on the providers' standard contractual clauses or their certification under the EU-US Data Privacy Framework.

Keeping and deleting your data

We keep your data while your account is active. Deleting your account from Settings removes your progress, content, and personal data from our systems. Some records may be kept longer where we're legally required to, in particular billing records, which tax rules require us to keep for several years.

If you stop using Distill entirely, we don't keep your data forever. After 2 years with no sign-in and no study activity, your account and its data are deleted automatically. We email you 30 days before that happens, and simply signing in stops it and starts the clock again. Accounts with an active paid subscription are never deleted this way.

Your rights

Wherever you live, you can ask us to:

• Tell you what personal data we hold about you, and give you a copy.
• Correct anything that's wrong.
• Delete your data, and your account with it.
• Export your data in a portable format.
• Restrict or object to how we use it.
• Withdraw consent you gave for the newsletter or personalized ads, at any time.

Most of this you can do yourself: Settings and your Profile let you view, correct, and delete your data, including deleting your account outright. For an export or anything else, email support@studydistill.com and we'll respond within 30 days. We won't treat you differently or charge you more for exercising any of these rights.

If you're in the UK or EU and you think we've got it wrong, you also have the right to complain to your data protection authority. We'd appreciate the chance to fix it first.

Security

We take reasonable technical measures to protect your data: passwords are hashed, the site is served over HTTPS, and access to production data is limited. No system is perfectly secure, though, and we can't guarantee it absolutely. If a breach ever affects your personal data, we'll notify you and the relevant authority as the law requires.

Changes to this policy

We may update this policy as the product changes. We'll update the date at the top, and for changes that meaningfully affect how we handle your data we'll give notice in the app or by email before they take effect.

Who to contact

Distill Software LLC, 539 W. Commerce St #8337, Dallas, TX 75208, United States. Privacy questions: support@studydistill.com.