Privacy Policy
Version 1.0.0, effective 2026-09-15
The short version
np-studylab collects the least it can: enough to sign you in, put you in the right group, and remind you about the right things. Nothing is public. There are no ads and we do not sell anything about you to anyone. You can export your data and delete your account yourself.
The one page summary covers this in fewer words. This page is the complete list.
Who is responsible
Halfservers, a company registered in Nebraska, United States, decides what np-studylab collects and why. Write to privacy@halfservers.com with any question about this page or any request about your data.
What we collect
| What | Where it comes from | Why we have it |
|---|---|---|
| Email address | You, or Apple or Google when you sign in with them | Signing you in, and sending reminders when push is off |
| Real name | You, at profile setup | So leaders know who is in the room |
| Display name | You, defaults to "First L." | What other members see |
| Birth year | You, at profile setup | To check you are 13 or older and to apply the adult rules |
| Time zone | Your device, and you can change it | So a reminder arrives at the right hour |
| Profile photo | You, optional | So a leader can recognise you |
| Sign in method | Apple, Google, a passkey, or an emailed link | Signing you in |
| Friend code | Made by us | So you can be invited without giving out your email address |
| Group membership | The join and approval flow | Knowing which group you are in and what you can see |
| Who invited you | The invite link you used | So a leader can see how the group grew, and so invites can be shut off |
| Messages, reactions, and images you post | You | Group chat |
| RSVPs and attendance | You, and a leader taking roll | Knowing who is coming |
| Reading marks and streaks | You, when you tap Mark read | Your streak, and a group total |
| Reminder settings and push subscription | You, and your browser | Sending the reminder you asked for |
| Calendar and Shortcuts tokens | Made by us when you ask for them | Your calendar feed and your Shortcuts automation |
| Reports and blocks | You, or another member | Keeping the group safe |
| Moderation and admin records | Leaders and admins, automatically | So there is a record of who did what |
| Request logs and error reports | Automatically | Keeping the app working |
What we never collect: we do not track you across other websites, we do not use advertising cookies, we do not buy data about you, and we do not sell or rent anything about you to anyone.
Who can see what
- Other members of your group see your display name and your avatar. If your profile is private, which is the default for every account, they do not see your real name, your email address, or your real photo.
- Leaders and the owner of your group see your real name, your photo, and who invited you. They need it to run a group of minors.
- People who have only asked to join see nothing at all: not the members, not the messages, not the time or place of a meeting.
- The platform admin, which is one person at Halfservers, can see everything in order to answer a report or fix a problem. Support access is read only, needs a written reason, expires after fifteen minutes, and is recorded outside the main database where it cannot be edited.
- Nobody outside the app, with two exceptions, and you control the first one. Nothing in np-studylab is listed in a search engine or browsable by a stranger, and every screen that shows a person, a message, a group, or a meeting requires a sign in.
- Anyone holding a feed link you made. The calendar feed and the Shortcuts feed are secret web addresses you create yourself from the Me screen. They carry no sign in, because a calendar app cannot sign in, so anybody who has the address can read your group's event times and places until you switch it off. Treat one like a house key: share it only with somebody you would give the address to, and replace or switch it off from Me the moment you are not sure who has it.
- Anyone at all, for these terms. This page, the terms, the one page summary, and the single answer that says which version of them is current are readable with no account, on purpose, so that you can read what you are agreeing to before you agree to it. They contain no data about any person.
Who else touches your data
| Who | What they handle | Where |
|---|---|---|
| Cloudflare | Hosting, the database, and file storage | United States and worldwide edge |
| Apple and Google | Only if you use them to sign in, and only your name and email address | United States |
| Our email sender | The sign in link and reminder emails | United States |
| Our error tracker | Crash reports with no message text, names, or email addresses in them | United States |
We use these companies to run the app. None of them is allowed to use your data for anything else.
How long we keep it
| What | How long |
|---|---|
| Chat messages | Up to 90 days from the day they are posted, then deleted automatically. 90 days is the default for a new group, and a group's leader can set a different window, so ask your leaders what your group's is |
| Anything you delete | Hidden immediately, removed for good 30 days later |
| Images | The same as the message they belong to |
| Your account after you ask us to delete it | 30 days, then removed |
| Reading marks, streaks, RSVPs, and attendance | While you are in the group, and removed when your account is removed |
| Reports and moderation records | One year after the report is closed |
| The record of leader and admin actions | Two years |
| Server request logs | Up to 7 days |
| Error reports | Up to 90 days |
| Database backups | Up to 30 days |
One thing overrides all of this. If a report is open, or a legal hold is set because of a safety matter, the messages and images it names are kept until the matter is closed even when your group's window has passed.
Your choices
- Private profile is on by default. Only an account belonging to an adult can turn it off.
- Reminders are off until you turn them on, and you choose the time.
- Push notifications need your permission, and you can take it back in your browser or phone settings at any time.
- Your streak is yours. Leaders see a group total, not your personal streak, unless you choose to share it.
- Your tokens for the calendar feed and for Shortcuts are off until you ask for one, and each can be replaced or switched off from the Me screen at any time. Replacing one breaks the old address immediately, which is what to do if a link goes somewhere you did not mean it to.
How to see or delete your data
- Open the Me screen.
- Tap Export my data to download everything you have contributed, as a file. The export carries your own contributions plus other people's display names and timestamps. It does not carry anyone else's photos, email addresses, or messages.
- Tap Delete account to start deletion. You have 30 days to change your mind by signing back in and cancelling.
- After 30 days your profile, your photos, and your messages are removed, and anything that has to stay for the record is labelled "Deleted user".
You can also write to privacy@halfservers.com and ask us to do any of this for you. We answer within 30 days.
Depending on where you live you may have further rights: to a copy of your data, to correct it, to delete it, to object to how we use it, and to complain to a regulator. Ask and we will help you use them.
People under 13
np-studylab is not for children under 13, and we do not knowingly collect anything from them. If we find out that an account belongs to someone under 13 we delete the account and its content. If you are a parent and you believe your child under 13 has an account, write to privacy@halfservers.com and we will remove it.
Parents and guardians
If your teenager uses np-studylab you can ask us what we hold about them, ask us to correct it, or ask us to delete it. Write to privacy@halfservers.com from an address we can reach you at, and tell us your teenager's display name and their group. We may ask you to confirm who you are before we hand over anything, because handing a minor's messages to the wrong adult is the worst thing we could do.
Keeping it safe
- Everything travels over an encrypted connection.
- There are no passwords to steal.
- Photos and images are re-encoded when they are uploaded, and the hidden location data cameras add is stripped.
- Access to the production database is limited to one person, and support access is read only, time limited, and logged.
- No system is perfect. If something happens that puts your data at risk, we will tell the people affected.
Where your data lives
np-studylab runs on Cloudflare, and your data is stored in the United States and served from Cloudflare's network worldwide. If you use the app from outside the United States, your data is transferred there.
Changes
We can change this policy. When we do, we publish a new version with a new date, and when the change is meaningful we ask you to agree again the next time you open the app.
Contact
Halfservers, Nebraska, United States. privacy@halfservers.com.