The short version

WizzStudy is built and operated by 9keys Group Inc. in Canada. We store your documents, generated artifacts, review history, and recordings in Supabase's Canada (Toronto) region. We do not sell your personal information. You can export everything we hold on you, or delete your account, from your data settings.

What we collect

Account information

Email address (required for account creation)
Display name (optional)
Avatar URL (optional; from OAuth providers like Google or Apple if used)
Plan and subscription status

Content you upload

Documents (PDF, DOCX, MD, TXT) and lecture recordings (WebM/MP3)
Generated artifacts: summaries, flashcards, quizzes, audio recaps
Review history (which cards you saw, how you rated them, when)
Notes you write inside the app

Usage data

Generation telemetry: model used, prompt version, latency, cost, faithfulness score (for our research)
Anonymized product analytics via PostHog (pageviews, key events)
Error tracking via Sentry (no personal data in error payloads)

Research use

WizzStudy is part of a research partnership between 9keys Group Inc. and Ontario Tech University, funded in part by Mitacs Accelerate. When you sign up, we ask whether you want to contribute anonymized data to the research corpus. This is opt-in (with a default-on checkbox) and you can opt out at any time from settings.

If you opt in, we store a PII-redacted copy of the documents and generated artifacts you produce in a separate research-only table (research_corpus). This data is only accessible to the WizzStudy founder and the named graduate researcher on the Mitacs grant. No personal identifiers are stored.

If you opt out, no copy is created. Existing rows are deleted on the next nightly maintenance run.

Where your data lives

Documents, audio, generated artifacts: Supabase Storage, Canada (Toronto) region
Database (rows): Supabase Postgres, Canada (Toronto) region
Authentication: Supabase Auth (same region)
AI processing: Anthropic (US-East), Voyage AI (US), Deepgram (US), ElevenLabs (US). Content is sent to these vendors only to generate the artifact you requested, and is not retained by them for training.
Payments: Stripe (Canada + global); only card metadata, never the card number, ever touches our servers.
Email: Resend (US/EU). Email addresses and message content for transactional sends only.
Analytics: PostHog (EU region). Anonymized event data only.
Error tracking: Sentry. Stack traces and request paths; no personal data.

We share data with the vendors above as required to operate the service. We do not sell, rent, or share your personal information for advertising or marketing purposes. We do not allow third parties to train AI models on your content.

We may disclose information if compelled by a legally valid Canadian court order. In that case we will notify you unless legally prohibited.

Your rights (PIPEDA)

Under PIPEDA, you have the right to:

Access the personal information we hold about you, use the export feature in your data settings.
Correct inaccurate information, update your profile or contact us.
Delete your account and all associated data, use the delete feature in your data settings.
Withdraw consent for research use, toggle off in settings.
Make a complaint to the Office of the Privacy Commissioner of Canada if you believe we have not complied with PIPEDA.

Retention

Raw audio chunks: deleted automatically 90 days after upload (recap audio is kept).
Exports generated by you: deleted automatically 7 days after creation.
Account data: kept until you delete your account.
Audit log: kept for 13 months for security and compliance.
Anonymized research data: kept indefinitely for the duration of the research project.

Cookies and tracking

We use cookies only for things that the app cannot work without: keeping you signed in, remembering your theme preference, and CSRF protection. We do not use advertising cookies or share cookies with third-party advertisers. PostHog analytics is anonymized and respects Do Not Track.

Children

WizzStudy is intended for post-secondary students aged 16 and older. We do not knowingly collect personal information from anyone under 16. If you believe a child has signed up, please email legal@wizzstudy.com and we will delete the account.

Changes to this policy

We will update this policy if our practices change. Material changes will be communicated by email to all active accounts at least 14 days before they take effect.

Contact

Privacy questions or PIPEDA requests: privacy@wizzstudy.com. Mailing address available on request.