Privacy Policy
Last updated: September 19, 2026
This Policy explains how Oren Study handles personal data when you use the mobile application, website and related services. Processing is governed by the General Data Protection Regulation (GDPR), applicable Portuguese law and relevant Google Play rules.
Oren Study does not sell personal data or use it for third-party behavioural advertising.
1. Data controller
The data controller is the operator of the Oren Study project. For privacy questions, requests concerning your data or complaints, use the contact details at the end of this Policy.
2. Data we process
Depending on the features you use, we may process the following categories of data:
- Account and profile data, such as name, email address, account identifier, language, theme, preferences and the record of your acceptance of the terms.
- Study content, including Spaces, plans, modules, topics, notes, calendar entries, deadlines, grades, quizzes and flashcards.
- Conversations with the Oren tutor, responses, chat titles and study memories extracted from interactions to maintain useful context.
- Files, images and documents you upload, their metadata and extracted text when required to analyse the content.
- Usage and operational data, such as message, analysis, document and AI-action counts, storage usage, limit reset dates and technical error or security logs.
- Subscription data, such as the identifier associated with a purchase, plan, subscription status, relevant dates and events provided by RevenueCat or Google Play. We do not receive or store full card numbers or other payment credentials.
- Technical data required for sessions and security, such as authentication tokens, IP address and basic request information that may appear in infrastructure logs.
3. Sources, purposes and legal bases
We receive data directly from you, from the application or device during use and, for subscriptions, from Google Play and RevenueCat.
- Performance of a contract: to create and manage your account, store study content, provide the tutor, process files, synchronise subscriptions and deliver requested features.
- Legitimate interests: to protect the service, prevent fraud and abuse, enforce usage limits, diagnose failures and improve stability, while balancing your rights.
- Legal obligation: to comply with applicable tax, accounting, judicial or regulatory duties.
- Consent: where the law requires it for a specific purpose. Consent may be withdrawn without affecting earlier lawful processing.
4. AI tutor and AI features
To generate a response, Oren may send the current message and necessary context to an AI provider, including relevant history, Space data, calendar entries, grades, study memories and content extracted from images or documents. This is used to answer your request and keep the conversation contextual.
The service currently uses OpenRouter, which may route requests to compatible model providers, and may use the DeepSeek API when that option is configured. These providers process content under their own terms, settings and policies. Do not submit sensitive personal data or third-party information that is not needed for studying.
AI can produce incorrect content. Oren does not make decisions about you that have legal or similarly significant effects.
5. Service providers and data sharing
We share only the data needed to operate the service with these categories of recipients:
- Supabase: authentication, database, file storage and related services.
- OpenRouter and model providers selected through its platform; DeepSeek when used directly: processing AI requests.
- RevenueCat: technical management of purchases, Premium entitlements and subscription status.
- Google Play and Google: app distribution, payment processing and website hosting or delivery services.
- Authorities, courts or third parties where disclosure is legally required or necessary to protect rights, users and the service.
6. International transfers
Some providers may process data outside Portugal or the European Economic Area. Where required, these transfers rely on an adequacy decision, Standard Contractual Clauses or another applicable legal mechanism. The specific location and safeguards also depend on each provider's configuration and policies.
7. Retention and deletion
We retain account data and content while the account is active and for as long as needed for the purposes described. Records required for security, dispute resolution or legal compliance may be kept for a limited additional period.
You can delete your account in the app under Profile > Delete account. This process deletes the account, Spaces, chats, messages, content, memories and associated files from systems controlled by Oren Study. You may also request deletion through the contact address on this page. Deleting the account does not automatically cancel an active Google Play subscription; cancel it separately in the store settings.
Data that Google Play, RevenueCat or other providers must retain for their own legal obligations remains subject to their policies and schedules. Backups may persist temporarily until overwritten under applicable technical cycles.
8. Your rights
Under the GDPR, you may request access, rectification, erasure, restriction, portability or object to processing, and withdraw consent where consent is the legal basis.
- We may need to verify your identity and will respond within the applicable legal timeframe.
- You may lodge a complaint with Portugal's data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt, or with the competent supervisory authority in your country.
9. Children and minors
Oren Study is intended for users aged 13 or over. Users under 18 must have permission from their legal guardian. We do not knowingly collect data from children below the minimum age; if you become aware of such an account, contact us so that we can take appropriate action.
10. Security
We apply reasonable technical and organisational measures, including authentication, access controls, encrypted connections and separation of user data. No system is completely invulnerable; you should protect your credentials and report suspected unauthorised access.
11. Website, sessions and local storage
The app and website may use session identifiers, local storage and technologies strictly necessary for operation, language, theme and security. We currently do not use behavioural advertising or advertising cookies on the website. If optional technologies are introduced, this Policy and consent controls will be updated where required.
12. Changes and contact
We may update this Policy to reflect changes to the product, providers or law. The new version will show its update date and, where a change is material, we will provide notice through the app, website or another appropriate channel.
By using Oren Study, you confirm that you have read and understood this Privacy Policy.