Privacy Policy

Last updated 10 September 2026

CoStudent is a study companion that transcribes lectures, summarises materials and helps with homework. This policy describes exactly what it collects, where that data goes, and how to get rid of it.

What we collect

• Account details — your email address, your name if you provide one, and an optional profile photo.
• Lecture recordings and transcripts — audio you record live or upload, and the text produced from it.
• Materials you upload — documents and their extracted text.
• Homework photos — images you capture or select for help.
• Chat history — the questions you ask and the answers returned.
• Study activity — quiz attempts, streaks and scheduled events you create.

We do not collect precise location or contacts, and we do not use your data for advertising or advertising profiles. CoStudent does use limited analytics and diagnostic services on Android to understand feature usage, deliver in-app messages, and detect crashes and technical errors.

Where your data goes

Several features use third-party service providers:

• Chat — your messages and relevant study context are sent to Nous Research to generate replies.
• Homework help and image understanding — images you submit are sent to Google Gemini for analysis.
• Firebase Authentication — used for email/password and Google authentication.
• Firebase Analytics — receives limited app-event and device/app information to measure feature usage and support in-app messaging. It is not used for advertising by CoStudent.
• Firebase Crashlytics and Sentry — receive crash, error, performance and diagnostic information to help us identify and fix technical problems.
• Firebase Cloud Messaging — uses a device messaging token to deliver push notifications.

If you sign in with Google, Google shares your account identifier, email address and name with us so we can create or match your account.

We never sell your data, and we never use it for advertising or to train our own models.

Deleting your data

You can delete individual lectures, materials and homework items at any time from inside the app. To remove everything, open Settings → Delete account. That permanently erases your account, all recordings and transcripts, uploaded materials, homework, chat history and scheduled events from our servers. It cannot be undone.

Full instructions, including how to request deletion without the app, are on the account deletion page.

Security

Passwords are stored hashed, never in plain text. Accounts created through Google Sign-In have no password at all. Access to your content requires a signed token issued to your device.

Changes

If this policy changes in a way that affects how your data is handled, the updated date above will change and the new version will appear here and in the app.

Your rights under the GDPR

If you are in the European Economic Area, the United Kingdom or Switzerland, you have the following rights over your personal data. You can exercise any of them by emailing us at the address below, and we will respond within one month.

• Access — a copy of the personal data we hold about you.
• Rectification — correction of anything inaccurate. You can edit your name in the app at any time.
• Erasure — deletion of your account and content. This is built into the app under Settings, and also available at costudent.app/delete-account.
• Portability — your lectures and transcripts in a machine-readable form. Transcripts can also be exported from each lecture in the app.
• Restriction and objection — you can ask us to stop processing your data, or object to processing based on legitimate interests.
• Withdraw consent — where we rely on consent, you can withdraw it at any time. This does not affect processing carried out beforehand.

You also have the right to complain to your national data protection authority. A list is maintained by the European Data Protection Board at edpb.europa.eu.

Why we are allowed to process your data

Under Article 6 of the GDPR we rely on the following lawful bases:

• Performance of a contract — for your account, your lectures, transcription, summaries, flashcards, quizzes and chat. These are the service you asked us to provide.
• Consent — for microphone access, and for optional features you switch on yourself. Consent is requested by your device before any recording begins, and can be revoked in your phone's settings.
• Legitimate interests — for keeping the service secure and preventing abuse, and for basic error reporting so faults can be fixed. We keep this to the minimum needed and it never involves advertising or profiling.
• Legal obligation — for retaining records of payments where tax law requires it.

We do not carry out automated decision-making that produces legal or similarly significant effects about you.

Recording other people

CoStudent records audio in rooms that may contain people who have not installed it. In many countries — including much of the European Economic Area — everyone present must agree before a conversation is recorded, and some institutions prohibit recording lectures without permission.

When you record, you are the person responsible for obtaining that agreement. Please tell the people around you, and check your school's or workplace's rules first. We show this reminder in the app before each session.

AI-generated content

Chat replies, summaries, flashcards and quiz questions are produced by artificial intelligence. They can be wrong, incomplete or misleading, and should be checked against your original lecture or materials before you rely on them. The app labels this content where it appears, as required by Article 50 of the EU AI Act.

Where your data is stored and transferred

Your account, lectures, transcripts and materials are stored on our servers in Germany, inside the European Union. Live speech recognition runs on that same infrastructure — your lecture audio is not sent to another company to be transcribed.

Some processing does take place outside the EEA. Where it does, transfers are made under the European Commission's Standard Contractual Clauses or an equivalent safeguard:

• Nous Research — chat messages, to generate replies.
• Google (Gemini) — homework photos, to read and solve them.
• Google Sign-In — if you choose it, to create or match your account.
• Paystack — subscription payments. We never see or store your card details.
• Resend and Amazon SES — transactional email such as verification and password resets.

Each of these acts as a processor under a data processing agreement. None of them is permitted to use your data for their own purposes, and we do not sell your data, use it for advertising, or train our own models on it.

How long we keep things

• Account and content — until you delete them. Deleting your account removes your lectures, transcripts, materials, chat history and study activity.
• Backups — deleted content may persist in encrypted backups for up to 30 days before being overwritten.
• Payment records — retained as long as tax law requires, typically six years, and separated from your study content.
• Analytics and diagnostic data — retained only as long as needed for product measurement, security and troubleshooting, subject to the retention settings of the relevant provider.
• Security logs — up to 90 days.

Children

CoStudent is intended for students aged 13 and over, and is not directed at younger children.

Data protection law sets a separate age for consenting to online services without a parent. Under Article 8 of the GDPR this is 16 by default, though individual EU member states may lower it to as young as 13. If you are under 16 and in the EEA or the UK, you need a parent or guardian's permission to use CoStudent unless your country has set a lower age.

If we learn that we hold data from a child below the applicable age without that permission, we delete it.

Contact

Questions about this policy or your data: contact@costudent.app