This Privacy Policy describes how StudenTeam ("we", "our", or "us") collects, uses, stores, and protects personal information about users ("you") of the StudenTeam mobile application ("App").
By using the App you agree to the practices described in this policy. If you do not agree, please discontinue use of the App.
This Privacy Policy should be read together with our Terms of Service, which set rules for using the App (including forums, private messaging, tutor session coordination, and the private tutor marketplace).
StudenTeam is a student-organizer and academic community application developed and operated by Ori.
The App is distributed on iOS (Apple App Store) and may also be available on Android. This policy applies regardless of platform.
When you create an account or sign in, we process:
| Data | Purpose |
|---|---|
| Email address | Account identity, sign-in, and essential service messages (e.g. verification). |
| Authentication credentials | Password-based sign-in is handled by Supabase Auth (passwords are hashed; we do not store plaintext passwords). |
| Session tokens | Stored on your device using secure storage (expo-secure-store, backed by the device keychain / secure hardware where available) to keep you signed in. |
| OAuth profile data | If you use Sign in with Apple or Google, we receive identifiers and profile elements that those providers share with us (for example name, email as permitted by the provider, and profile image URL where applicable), in line with each provider's settings and policies. |
We do not receive your Apple or Google account password.
The following may be stored in our database (Supabase) and linked to your user account:
Certain extended profile fields (for example full name, age, city, degree details, study year, semester preferences, and tutor subject/course selections used in onboarding flows) are stored locally on your device (using AsyncStorage) and are not uploaded to our servers as part of that local profile store. Additionally, the following are stored only on your device:
If you separately choose to publish information in the forum or tutor listings, or send it in a private message, that content is stored on our servers as described below.
Data you enter into organizer features is stored in your account on our backend so it can sync across devices. This includes, depending on what you use:
If you use the forum or related features, we store content you submit on our servers, including:
Forum content you publish may be visible to other users of the App according to how the feature is designed (for example by subject or listing type). Your display name and profile image (if any) may appear alongside your content.
IMPORTANT: Files uploaded to the forum (images and documents) and tutor profile documents (CV/certifications) are stored in public storage buckets on Supabase Storage, which means they are accessible by anyone with the direct URL. Do not upload sensitive personal information, passwords, or confidential documents unless you intend them to be publicly accessible.
We process forum submissions through Supabase Edge Functions (forum-submit) with the following optional safety features:
FORUM_USE_OPENAI_MODERATION=true), forum post and reply text is analyzed by OpenAI's Moderation API to detect policy violations (hate speech, violence, sexual content, etc.). Your text content is sent to OpenAI for this purpose.FORUM_USE_HF_IMAGE_MODERATION=true), raster images (not documents) uploaded to the forum may be analyzed by Hugging Face models to detect inappropriate visual content (NSFW). Your image data is processed by Hugging Face for this purpose.These moderation services operate in fail-open mode — if they are unavailable, your content will still be published. We do not share these moderation results with third parties beyond the analysis itself.
If you register as a private tutor and upload optional documents (for example a CV or certifications in PDF or image formats), those files are stored in the Supabase Storage bucket tutor-profile-documents, which has a public read policy.
This means:
The App displays a warning message when you upload tutor documents informing you that these files will be viewable in the forum/marketplace.
If you use private messaging (one-to-one conversations with other users), we store on our servers:
user_blocks table) so the App can enforce blocks. You can manage blocked users from the App settings.Direct messages are not published to the forum; they are intended to be visible only to you and the other participant in that conversation (and to our systems as needed to operate the feature, secure the service, and handle abuse reports).
Note: Files and images attached to direct messages, like forum attachments, are stored in public storage buckets and may be accessible to anyone with the direct URL. Do not send sensitive personal information, passwords, or confidential documents through direct messages.
We may process messages through Supabase (database, storage, and server-side functions) for delivery, moderation when reported, and safety.
The App may allow students and private tutors to coordinate lesson times (for example proposals, confirmations, rescheduling, or cancellation of suggested sessions) and to display context such as an hourly rate in NIS for scheduling purposes. Related records stored in our database (tutor_session_bookings) include:
This feature is for coordination and scheduling only; the App does not process payments for lessons. All financial arrangements, meetings, and contracts are solely between you and the other party outside the App (see our Terms of Service).
We store in-app notification records in our database for the following purposes:
forum_reply_notifications) — When someone replies to a forum thread you participate in or subscribe to.forum_tutor_booking_notifications) — When students or tutors propose, confirm, reschedule, or cancel tutor sessions.direct_message_notifications) — Helper records to alert you of new direct messages when you are not actively viewing the conversation.forum_post_reply_subscribers) — Which forum threads you have subscribed to for reply notifications.These records are tied to your account and displayed in the App's notifications inbox. The App uses Supabase Realtime subscriptions (WebSocket-based) to listen for new notifications and direct messages while you are actively using the App, triggering local on-device notifications as needed.
This is separate from local assignment reminders scheduled on your device (see Section 10).
If you are a student and you write a review for a private tutor, we store:
tutor_review_reports for moderation.Reviews are visible to other App users viewing the tutor's profile. If you report a review, we store your report record for moderation purposes (admin-accessible only).
The App may track gamification metrics tied to your account, including:
user_stats table.These are used solely to provide motivational features within the App and are not shared with third parties for marketing purposes.
Examples of data that typically remain on-device unless you explicitly upload or publish something:
ProfileDetails.expo-constants) displayed in About/Settings screens.expo-localization) for UI localization (Hebrew/English).expo-image-picker) for profile photo upload and forum/DM image attachments — only when you explicitly trigger these features. Permission purpose strings (in Hebrew) are declared in app.json.expo-document-picker) for forum/DM file attachments.expo-notifications) for local assignment reminders and in-app activity alerts.expo-web-browser) to open legal documents and external links.The App does not access your device GPS location. Any "location" fields in exams or schedule slots are user-entered text (e.g., classroom names), not geographic coordinates.
If you send a bug report from the App, we process:
Reports are submitted through the Supabase Edge Function send-bug-report, which:
bug_reports table in our database.Third-party email providers (Resend and/or Gmail) process your bug report content and email address in transit to deliver the notification to our team. They handle this data according to their own privacy policies:
The App implements rate limiting (server-side and client-side cooldown) to prevent abuse of the bug report system.
We use this information only to diagnose issues, improve the App, and respond to you where appropriate.
We use personal information to:
| Purpose | Typical legal basis (where GDPR applies) |
|---|---|
| Provide sign-in, sync, and core organizer features | Performance of a contract / steps at your request |
| Operate the forum, marketplace listings, direct messaging, tutor coordination, and in-app notifications | Performance of a contract; legitimate interests in operating a safe community |
| Moderate content, enforce rules, respond to reports | Legitimate interests; legal obligations |
| Store and display profile and content you choose to publish or send | Performance of a contract; consent where required (e.g. certain optional uploads) |
| Secure the service and troubleshoot errors | Legitimate interests |
| Comply with law and respond to lawful requests | Legal obligation |
| Review bug reports and provide support | Legitimate interests / performance of a contract |
We do not sell your personal information. We do not use your data for third-party advertising profiling.
We share your information in the following circumstances:
FORUM_USE_OPENAI_MODERATION=true). Your forum text content is sent to OpenAI's Moderation API. Privacy policy: https://openai.com/policies/privacy-policyFORUM_USE_HF_IMAGE_MODERATION=true). Raster images are analyzed for inappropriate content. Privacy policy: https://huggingface.co/privacyThese moderation features are optional server-side configurations and may be enabled or disabled by us without notice. They operate in fail-open mode — if unavailable, content is still published.
We may disclose information:
We do not sell your personal information to third parties for their own marketing purposes.
Your data is processed using cloud infrastructure operated by Supabase and may be stored or processed in the regions configured for our project (potentially including the European Union or other regions Supabase supports). If you are outside those regions, your information may be transferred internationally. We rely on appropriate safeguards where required (such as standard contractual clauses or equivalent mechanisms offered by our providers).
We retain account and content data while your account is active and as needed to provide the service, including:
If you delete your account (via the App's Settings → Delete Account feature), we invoke the delete_current_user() SECURITY DEFINER function, which deletes your auth.users record from Supabase Auth.
What happens after deletion:
Important: Forum content, messages, or files you sent may have been seen, downloaded, or copied by other users before deletion. We cannot control copies made by others outside our systems.
Local on-device data (AsyncStorage, SecureStore) remains until you uninstall the App or clear app storage from your device settings. Uninstalling the App does not delete your account or server-side data; you must use the in-app delete account feature or contact us.
We implement appropriate technical and organizational measures, including:
LargeSecureStore): session tokens are encrypted using AES-CTR with encryption keys stored in Expo SecureStore (backed by iOS Keychain / Android Keystore), and ciphertext is stored in AsyncStorage.Important security considerations:
The App is not directed at children under 13 (or the minimum age required in your jurisdiction). We do not knowingly collect personal information from children below that age. If you believe we have done so, contact Orikal3107@gmail.com and we will take appropriate steps to delete the information.
Depending on your location, you may have rights to access, rectify, delete, restrict, or object to certain processing, and data portability. You may also withdraw consent where processing is consent-based.
To exercise these rights, contact Orikal3107@gmail.com. We will respond within 30 days where applicable law requires it.
If you are in the EEA/UK, you may lodge a complaint with your local data protection authority.
California residents (summary): You may have rights under the CCPA/CPRA (for example to know, delete, and opt out of sale/sharing). We do not sell personal information as defined by California law. To submit a request, email Orikal3107@gmail.com.
The App uses notifications in the following ways:
forum_tutor_booking_notifications) and displayed in the App.Notification permissions:
The App requests notification permissions from your device OS (iOS/Android) to display local notifications. You can manage these permissions in your device system settings. The App is configured in production mode for expo-notifications with no custom notification sounds.
The App may allow you to open links or documents in a browser or in-app web view. Those third parties have their own privacy practices; this policy does not apply there.
We may update this Privacy Policy from time to time. We will update the Last Updated date at the top. If changes are material, we may provide additional notice (for example in the App). Continued use after the effective date constitutes acceptance of the updated policy where permitted by law.
Privacy: Orikal3107@gmail.com
General: Orikal3107@gmail.com
App name: StudenTeam
This policy is intended to be clear and accurate. If anything here does not match what you see in the App, the App's actual data practices and App Store disclosures should be aligned — please contact us so we can correct documentation.