Privacy Policy

Effective October 23, 2026 · Version 2026-10-23

The short version. A parent or guardian sets up Study Desk. Everything about students (first name or nickname, an avatar chosen from the app’s own drawings, grade level, school, study cards and progress) lives on the family’s own devices. So that a parent can see the same students on a phone, computer and tablet, the app keeps a copy on our server that is encrypted on the family’s device with a key only the family’s devices hold. We cannot read it. In readable form, our server keeps only the parent’s email address, consent records, feature choices, signed-in devices, daily usage counts, and feedback a parent chooses to send us. Four optional features send information to service providers in readable form, and each stays off until the parent confirms consent by email and turns it on: the study helper (homework photos and text go to an AI service), natural voice (the words on study cards go to an AI speech service), speak answers out loud (a short recording of the student’s answer is turned into text and not kept), and the weekly summary email (first names and study numbers go to our email provider). A fifth, shared study totals, adds your family’s weekly study numbers (minutes, cards, right answers per subject) to combined sums for all sharing families. Turning all of them off in Parent view (there is one button for that) withdraws consent for all of them.

Who we are

Study Desk is a free homework study app made by CodeBreeder LLC (“we”, “us”). It runs at studydeskapp.com (and, while families move their devices over, at its earlier address, study.portdrop.app). You can reach us about privacy at frandyslueue@gmail.com.

Study Desk is set up by parents

Study Desk is meant for children in kindergarten through grade 8, but only a parent or legal guardian can create a family account and add students. We do not ask children for any personal information, and children cannot create accounts. We follow the U.S. Children’s Online Privacy Protection Act (COPPA):

A parent agrees to these terms when creating the account.
Before any feature that sends information to a service provider can be turned on, we send the parent a separate email with this notice and a link to confirm their consent. A second email the next day confirms what was agreed and how to withdraw it.
A parent can see and delete their children’s information, and turn off any optional feature, at any time.

New accounts are currently by invitation only.

What we collect and why

Kept on our server (about the parent only)

What	Why	How long
Parent email address	To sign in with an emailed code and to send account notices	Until you delete the account, or 2 years after the last sign-in
Consent records: the policy version and date you agreed to, the date you confirmed parental consent by email, and which optional features are on	To show what you agreed to and honor your choices	Same as the account
Consent links (stored only as a hash)	To confirm parental consent	7 days, or until used
Sign-in codes, stored only as a one-way scrambled value (hash), with a hashed network address	To check the code you type and to stop abuse	Expire after 10 minutes; removed within a day
Signed-in devices: a session stored only as a hash, a device name such as “iPad” (which you can rename), and when it was last used	To keep each device signed in and let you see and sign out your devices	Up to 180 days, or until you sign the device out
Your family’s encrypted sync copy	To show the same students and progress on all your devices	Until you delete the account, start sync over, or 2 years after the last sign-in. After each change, the previous copy is kept for devices still downloading it and removed by the hourly cleanup once it is an hour old, normally within two hours (longer only if a cleanup backlog builds up).
Link codes (the family key, locked with a one-time code)	To add a new device to your family	10 minutes, or until used
Weekly summary setting, and which week was last emailed	To send the optional weekly summary once a week	Same as the account
Number of study helper uses and new voice clips per day	To keep the free service within its daily limits	35 days
For a device you chose to “sign out and erase”: a hash of its old session	So it erases itself whenever it next comes online	1 year
Feedback you send from Parent view: your message, the kind (idea, problem, and so on), an optional 1 to 5 rating, the app version and the kind of device (such as “iPad”), and any reply we send	To read it, reply to you (we look up your email from your account while it exists), and improve Study Desk	Until we mark it handled, then 1 year from that day. If you delete the account, it is hidden from our team at once and removed (most often right away, at the latest by the next hourly cleanups)
Error reports: when something in the app breaks, only the kind of error (like “TypeError”), where in Study Desk’s own code it happened (file name, line and function name), the app version, the kind of device and the screen. Never the error’s message or anything shown on screen, and no account is attached. Each network address can send at most 30 a day (counted under a one-way hash of the address).	To find and fix problems	90 days after the error was last seen
Only if we invite you to test new versions: which checks you marked as passed, a problem or skipped on each kind of device, and any notes you add	To find problems before other families do	Deleted when testing ends for your account, or when you delete the account
Only if you turn on “Share study totals”: a one-way code made from your account and the week, showing that week was already sent	So the same week isn’t counted twice	8 weeks

Shared study totals (optional)

If a parent turns on Share study totals in Parent view (it is off by default and needs confirmed parental consent), once a week one of the family’s devices adds up last week’s study for all of the family’s students together: total minutes, cards practiced and cards right the first time, for each subject (such as math or spelling). Those numbers are added to combined totals for all families who share them. The totals don’t include names, card words or set names, and the sums don’t record which family sent what. To count each week only once, we keep a one-way code made from your account and the week for 8 weeks. A week can be shared only until 14 days after it begins; after that its sums never change. Our team sees a week’s totals only after sharing for it has closed, and only when at least five families shared it, so one family’s numbers can’t be picked out. We use them to see which subjects and games help children most. Turn it off any time; numbers already added stay in the combined sums.

We do not use passwords, and we do not collect your name, phone number, address, payment details, location, or advertising identifiers. Each device keeps a random device id, which it sends when it signs in and when it checks its account, so an erase request can reach it. Sync never sends children’s information in readable form. It reaches us readable only through the optional features below, and only when a parent turns them on: the weekly summary email (first names and study numbers), the study helper (a homework photo or typed text can show a child’s name or school), natural voice (the words on a card, which could include a name if someone typed one) and spoken answers (a short recording of the child’s voice, turned into text and not kept).

Kept on your devices, and synced only in encrypted form (about students)

A first name or nickname. Please don’t use a full name.
An avatar chosen from the app’s own drawings. We never ask for or collect photos of children.
Grade level (K–8) and, if you choose, a school name.
Study cards, homework photos you keep with a set, stars, stickers, rewards, practice history and settings. Cards can hold anything typed or photographed, so please keep personal details off them.
A 4-digit parent PIN that locks Parent view on that tablet.

This information lives in each device’s browser storage. When a device is signed in to your family account, it encrypts this information (except homework photos, which stay on the device that took them) with your family key before sending it, using AES-256-GCM. The family key is made on your first device and is copied to a new device only through a one-time link code you type, or your recovery key. It is never sent to us in a form we can use, so we cannot read the encrypted copy. We can see its size and when it changes. If you lose every device and your recovery key, no one, including us, can recover it. A device set up without an account keeps everything on that device only. Backup files you save yourself are not encrypted; keep them private.

Sent to service providers when features are used

Study helper (optional, off until the parent confirms consent and turns it on). When a student or parent asks the helper to read a homework photo, sort typed homework, write practice sentences, check handwriting or explain a math problem, the photo or text is sent through our server to an AI service and the answer comes back to the tablet. We do not store the photo, the text, or the answer on our server.
- Requests a student starts, and every photo or drawing, go to Cloudflare Workers AI, which runs on Cloudflare’s network.
- Text-only requests a parent starts in Parent view go to DeepSeek. DeepSeek’s own privacy policy governs how it handles that text, and it may store it on servers in the People’s Republic of China. Photos and anything a student starts are never sent to DeepSeek.
We never add student names to these requests, but a photo or typed homework contains whatever is on the page, which may include a child’s name or school. Please cover or crop names before taking a photo.
Natural voice (optional, off until the parent confirms consent and turns it on). The words on study cards, and short spoken directions and encouragement, are sent to Cloudflare Workers AI to make speech. Because a card can hold a child’s name or other personal details, we send them to OpenAI instead only if OpenAI has approved zero data retention for our account (so OpenAI keeps nothing we send); even then, if OpenAI is unavailable or doesn’t read the words exactly, Workers AI reads them. Only the words are sent, never a recording of your child. They are sent inside the request, not in the web address, so they stay out of web logs. The audio is kept for up to a year in Cloudflare’s cache, labeled only by a one-way hash of the words, and on your device so it can play again offline. If a card holds something personal, that text is sent too. When natural voice is off, Study Desk uses only voices that run on the device itself (it skips “online” voices some browsers offer), so nothing is sent; if a device has no such voice, cards aren’t read aloud.
Speak answers out loud (optional, off until the parent confirms consent and turns it on). When a student taps the microphone, the app records until they stop talking (a few seconds at most) and sends that short recording to Cloudflare Workers AI (Whisper) to turn it into text, which the app then checks like a typed answer. The microphone is never on unless its button is lit up. Children’s recordings are never sent to OpenAI. A parent can also dictate homework from Parent view; that recording is turned into text by Workers AI too, or by OpenAI only if OpenAI has approved zero data retention for our account (so OpenAI keeps nothing we send). We do not store any recording or its text on our server; OpenAI’s and Cloudflare’s own terms govern how they handle what they process.
Sign-in emails. Your email address and the code are sent to Resend, which delivers the email.
Weekly summary email (optional, off until the parent confirms consent and turns it on). Once a week, the first time one of your signed-in devices opens after the week ends, it writes a short summary for each student: first name or nickname, minutes studied, accuracy, level-check results and the next grade topics. It does not include card words or set names. It is sent through our server to Resend to email you. We pass it on and do not keep it.
Bot check. On the sign-in screens, the app loads Cloudflare Turnstile, which checks that a person, not a bot, is asking for a code. It looks at signals from your browser and does not use cookies for advertising.
Feedback replies and our own alerts. When you send feedback, or the app reports an error, our team gets an email about it through Resend; a feedback alert includes your message and email address so we can reply. Only the Study Desk owner and at most two helpers can see feedback, error reports and tester results, in a separate admin dashboard that needs its own emailed sign-in code. Every sign-in and change there is logged; the log names a family only by a short account reference, never its email. Admins can see account facts (dates, consent choices, devices) but never your children’s information, which stays encrypted.
Fonts and other files are served by Study Desk itself. The app does not load anything from Google or ad or analytics services.
Hosting. The app and server run on Cloudflare. Like any website host, Cloudflare processes network addresses and request details to deliver the app and protect it from attacks, and keeps short-lived technical logs.

We do not sell or rent personal information, we do not show ads, and we do not share information for advertising or tracking. We only disclose information to the providers above to run the features you use, or when the law requires it.

Your choices and rights

Turn the study helper, natural voice, spoken answers, weekly summary email or shared study totals on or off at any time in Parent view → Family account, or turn all of them off at once with Turn off all optional features. When all five are off, nothing about your children is sent to a service provider in readable form and no study numbers are shared.
Withdraw consent by turning those features off, or by deleting your account.
See your children’s information in Parent view, or save a backup file there.
Remove a student. In Parent view, remove a student to erase all of their information from every synced device the next time each one syncs, and from the encrypted copy (the copy from just before is removed by the hourly cleanup once it is an hour old, normally within two hours). This can’t be undone; they would start over.
Erase a tablet. Parent view → Erase this tablet removes everything Study Desk saved on it. To erase a lost device, use Parent view → Sync and devices → Sign out and erase; it erases itself the next time it opens online.
Delete your account. Parent view → Delete account. We email a code to confirm, then delete your email, consent record, devices, usage counts, feedback, tester results and the encrypted sync copy from our server, and erase that device. Your email is removed and every sign-in stops working at once; for a very large account, any remaining rows (which no longer carry your email) are removed by the hourly cleanup. Your other devices erase themselves the next time they open online; a device that never comes back online keeps its copy until you remove the app from it. Deletion can’t be undone.
Send feedback only if you want to: Parent view → Send feedback. Please leave children’s names out of it.
You can also email us to ask what we hold about you or to delete it. We answer within 30 days.

Security

We keep a written information security program and data retention policy. You can read them on the Data & security page.

Changes to this policy

If we change how we collect or use information, we will update this page and its version date, and ask parents to agree again in the app before any new kind of collection or sharing begins.

Contact

CodeBreeder LLC · frandyslueue@gmail.com