Privacy policy

This policy explains what StudyCru collects about you, why, who we share it with, how long we keep it, and how to get it deleted. It applies to the StudyCru mobile app and this website.

StudyCru is a social product. Other students see part of your activity — your name, photo, rating and study history — before deciding whether to study with you. We have tried to design that so it never reveals who you studied with, exactly when, or where. The detail below says what is visible to whom.

1. Who we are

StudyCru ("we") is the data controller for the information described here. Contact us at [email protected] or through the contact form. The operator is Brand Lab Maroc.

2. What we collect and why

Data	Why we need it	Required?
Name, email address, password (stored hashed)	To create and secure your account	Required
Date of birth	To confirm you meet the minimum age and to age-gate features	Required
Profile photo	So other students can recognise you at a session	Required to complete your profile
Student card image	So a human can verify you are a student. This is an identity document and we treat it as sensitive.	Required to get verified
University or school, study level, subjects	To match you with relevant sessions and people	Required
City and country	To show sessions near you	Required
Precise location (GPS)	To confirm you actually arrived at an on-site session, and to sort sessions by distance. Collected while you are using the app, not in the background.	Required for on-site attendance
Messages you send (group chat and direct messages)	To deliver them, and to investigate reports	Required to use chat
Ratings, reviews, session history, attendance records	To build the track record other students rely on	Created by using the app
Reports you file or that are filed about you	Safety and moderation	Only if used
Follows and blocks	To run the social graph and honour your blocks	Only if used
Device identifiers, push token, IP address, login history	To deliver notifications, keep you signed in, and detect duplicate or abusive accounts	Required
Crash and diagnostic logs	To find and fix bugs	Required

3. What other people can see

• Your public profile: name, photo, university, study level, subjects, city, country, rating and a capped list of recent sessions.
• Your session history shows what you did — the session title, whether it was on-site or online, and the rating. It does not show who else was there, the exact date, or the location.
• Written reviews about you are anonymous and undated. We deliberately omit the date, because a comment plus a date is often enough for someone who was in a small group to work out who wrote it.
• A session's exact address is only shown to accepted participants. Before that, other users see an approximate area.
• Your email address, date of birth and student card are never shown to other users. Only our verification team sees the student card.

4. Who we share it with

We do not sell your data and we do not use it for advertising. We share it only with:

• Cloudflare — content delivery, security, and object storage for images (profile photos, student cards).
• Google (Firebase Cloud Messaging) — to deliver push notifications.
• Google (Sign-In) — if you choose to sign in with Google.
• Resend — to send account emails such as verification, password resets and deletion confirmations.
• OpenStreetMap / Nominatim — to turn a typed place name into a location and to show map tiles when you search for or view a session's meeting place. This can include your GPS coordinates and, from the app, your IP address.
• Our hosting provider — the server that runs the service.
• Law enforcement or regulators — only where we are legally required to, or where it is necessary to prevent serious harm.

5. How long we keep it

• Account data — for as long as your account exists.
• Student card image — retained while your account is verified, so we can re-check a disputed verification.
• Messages — until you or the sender deletes them, or the account is deleted.
• Moderation reports and safety records — kept after an account is deleted, with the profile detached, because deleting them would erase the other person's record of what happened.
• Server and access logs — a short rolling window for security and debugging.

6. Your rights

You can ask us to give you a copy of your data, correct it, or delete it. You can also object to how we use it, or ask us to restrict it. To exercise any of these, use the contact form.

To delete your account, use the account deletion page — you do not need the app installed. In the app it is Settings → Account → Delete account. Your request is reviewed and then your data is permanently erased.

Some fields — your name, date of birth and university — are locked after you first set them, because they underpin verification. Contact us if one is genuinely wrong.

7. Security

All traffic between the app and our servers is encrypted with HTTPS. Passwords are stored hashed with bcrypt, never in plain text. Our verification team opens student card images through short-lived signed links, and every such access is logged against the specific person whose document was viewed. We are migrating student card storage to a private bucket so the underlying file is not reachable without that signed link; until that migration completes, treat this as in progress rather than done. Access to production data is otherwise restricted, and every time an administrator opens a private conversation, that access is logged too.

8. Children

StudyCru is not intended for children. You must be at least 18 to create an account, and we ask for your date of birth at sign-up to enforce this. If we learn that we hold data about someone below that age, we delete it.

9. International transfers

Our servers and service providers may process your data outside your country. Where that happens we rely on appropriate safeguards, such as the European Commission's standard contractual clauses.

10. Changes

If we change this policy we will update the date at the top and, for anything significant, tell you in the app before it takes effect.