Privacy Policy

Last updated: 1 October 2026 · Effective date: 1 October 2026

1. Introduction

Studrush ("we", "us", "our") is an AI-powered study and revision app for Android and the web that turns a subject or your study material into a prioritised, time-boxed study plan with notes, diagrams and practice questions (the "App").

We have built Studrush to need as little of your personal data as possible. You can use the App without creating an account. If you do create one, it lets you keep your credits, use our stronger AI model, and sync your study plans across devices.

This Policy explains what personal data we handle, why, who we share it with, and the rights you have under the Constitution of Kenya, 2010 (Article 31) and the Data Protection Act, 2019 (the "DPA"). By using the App, you confirm you have read and understood this Policy.

• Data Controller: Studrush
• Email: felixawere01@gmail.com
• Physical address: Kisumu, Kenya
• ODPC registration: Registration in progress

2. What personal data we collect

If you create an account (optional)

• Email and password. Your password is stored only as a secure one-way hash; we never see or store it in readable form.
• Or, if you sign in with Google: your email address and your Google account identifier. We do not receive your Google password, and we do not access any other Google data.
• Your saved study plans, so they sync across your devices.
• Your credits balance and its history (credits received and spent).

When you use the AI features

• The subject you enter, or the text extracted from a document you upload, so the AI can build your study plan. See Section 5.

Device and technical data (all users, signed in or not)

• A random identifier created for your installation of the App (or your browser). It is not your phone number, IMEI or any hardware ID. If you are not signed in, your credits are linked to this identifier.
• Your IP address, device type, operating system, and App version.
• A record of what you did in the App (for example "generated a 60-minute plan", "watched an ad"), with a short extract of the request (the subject, or the first 300 characters of an uploaded document), whether it succeeded, and how much AI processing it used.

We use this to run the App, give and enforce credits, prevent abuse (such as one person creating many accounts or faking ad rewards), fix problems, and understand which features are used.

Notifications (optional)

• If you allow notifications, a push notification token for your device, so we can send you study reminders and messages. You can turn notifications off at any time in your device settings.

Payments (only if you buy Pro)

• M-Pesa: the phone number you enter, the plan, amount, payment status and M-Pesa receipt number.
• Card payments: handled entirely by Paystack. We never see or store your card number. We keep only the Paystack customer and subscription references needed to manage your Pro subscription.

Advertising (Android app)

• The Android app offers optional rewarded ads: you can choose to watch a short ad to earn credits. These ads are provided by Google AdMob, which collects your device's advertising ID, IP address and device information to deliver and measure ads and prevent ad fraud. See Section 6.

We do not sell your personal data, and we do not build advertising profiles about you ourselves. Please do not submit sensitive personal data (such as health, religious or biometric information) through the App.

3. Why we use your data and our lawful basis

Under Section 30 of the DPA, we must have a lawful basis for processing your data:

Where we rely on your consent, you may withdraw it at any time without affecting processing already carried out.

4. Children and students

Studrush is a revision tool, so we know some users may be under the age of 18.

You can use the App without an account and without giving us your name or email. If you are under 18, please ask a parent or guardian before creating an account or buying Pro.

Where a child provides personal data, Section 33 of the DPA and the Data Protection (General) Regulations, 2021 apply, and we only process that data in the child's best interests. We do not make automated decisions about a child that produce legal or similarly significant effects. If you are a parent or guardian and believe your child created an account without your consent, contact us at felixawere01@gmail.com and we will delete it.

5. How our AI features work

When you generate a study plan, the subject you enter or the text of the document you upload is sent to our AI providers to produce your plan.

• Signed in: plans are generated by DeepSeek models accessed through OpenRouter.
• Not signed in: plans are generated by Cohere.
• The AI does not make decisions about you that have legal or similarly significant effects.
• AI-generated content can be inaccurate or incomplete. Please treat it as study support, not as a single source of truth.

Your input is sent only to produce your plan. These providers process it under their own terms of service; we do not send them your email address or name.

6. Who we share your data with

We do not sell your personal data. We share it only with service providers who help us run the App:

How Google uses data from AdMob is described at policies.google.com/technologies/partner-sites. You can reset or delete your advertising ID at any time in your Android settings (Settings → Google → Ads), and choose whether ads are personalised.

We may also share data with:

• Authorities or regulators where required by law or to respond to lawful requests.
• A successor entity in the event of a merger or sale, subject to this Policy.

A small number of Studrush team members can view account and activity data in order to support users and keep the App running. Their access is limited by role, and actions they take are logged.

7. International data transfers

Some of our service providers store or process data outside Kenya. Our database is hosted in the European Union (Ireland), and other providers listed in Section 6 may process data in the United States and other countries.

Where we transfer personal data outside Kenya, we do so in line with Sections 48 and 49 of the DPA, by ensuring the destination has adequate data protection safeguards, that appropriate contractual safeguards are in place, or that you have given explicit consent.

8. How long we keep your data

• Account data and saved plans: for as long as your account exists. If you ask us to delete your account, we remove it within 30 days.
• Activity records (including IP address and request extracts): up to 90 days. After that, only anonymous daily totals are kept.
• Credits history: for as long as your account exists, so your balance can be checked if something goes wrong.
• Payment records: for as long as required by Kenyan tax and accounting law.
• Password reset codes: expire after 15 minutes and are deleted once used.

To delete your account, email felixawere01@gmail.com from the email address on the account, with the subject "Delete my account". We will confirm once it is done.

9. Your rights

Under the DPA, you have the right to:

• Be informed about how your data is used (this Policy).
• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data ("right to be forgotten").
• Restrict or object to processing.
• Data portability: receive your data in a structured, machine-readable format.
• Withdraw consent at any time where consent is the basis for processing.
• Not be subject to a decision based solely on automated processing that significantly affects you.

To exercise any of these rights, email felixawere01@gmail.com. We will respond within the timeframe required by law, at no charge unless a request is manifestly unfounded or excessive.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Data Protection Commissioner (ODPC):

• Website: www.odpc.go.ke
• Email: info@odpc.go.ke
• Address: Britam Towers, Upper Hill, Hospital Road, Nairobi, Kenya

10. How we protect your data

We use appropriate technical and organisational measures to protect your data, including encryption of data in transit (HTTPS/TLS), one-way hashing of passwords, role-restricted staff access with audit logs, and limits that detect and block abusive use. No system is completely secure, but we work to protect your data and to detect and respond to incidents.

11. Data breaches

In line with Section 43 of the DPA, if a personal data breach occurs that poses a real risk of harm, we will notify the ODPC within 72 hours of becoming aware of it, and we will inform affected users where required.

12. Changes to this Policy

We may update this Policy from time to time. We will post the updated version here and change the "Last updated" date above. Where changes are significant, we will let you know through the App or by email.

13. Contact us

If you have any questions about this Policy or your data, contact:

• Studrush
• Email: felixawere01@gmail.com
• Address: Kisumu, Kenya