Privacy Policy
Last updated: 29 October 2026. This page also covers cookies and similar technologies.
1. Who is responsible for your data
The data controller (Regulation (EU) 2016/679, “GDPR”) is lunilla.ai, Milano, Italy. Contact for any privacy request: lunilla.ai@gmail.com.
2. What we collect, why, and on what legal basis
| Data | Purpose | Legal basis |
|---|---|---|
| Email address and password (stored only in hashed form by Firebase Authentication), name you choose, account ID | Create and secure your account, send the email-verification message, let you sign in | Performance of the service you asked for (art. 6(1)(b)) |
| Daily goal, streak and the days you reached your goal, league, the plants and critters in your garden with their spot and arrival day, coins spent | Run the app: goals, streaks, leagues and garden | Performance of the service (art. 6(1)(b)) |
| Study sessions: start and end time, minutes on camera, minutes classified as study, as non-study, and unclassified, and the 1–5 accuracy rating if you give one. Weekly and daily totals | Show your history, award coins and XP, rank you on the leaderboard, check how accurate the detection is | Performance of the service (art. 6(1)(b)) |
| Your email address and name, and the time you turned the option on or off, only if you tick the optional box for news (at sign-up, or later in the Profile page) | Send you occasional emails with news, tips and offers about StudyCop | Your consent (art. 6(1)(a)), optional and revocable at any time. Without it your account works exactly the same |
| Technical data of each request: IP address, browser, time | Deliver the site, keep it secure, troubleshoot | Legitimate interest (art. 6(1)(f)): running a secure service |
Providing the account data is necessary to use StudyCop: without it we cannot create your account. There is no automated decision with legal or similarly significant effects on you: the study / non-study decision only produces minutes and coins.
Age
StudyCop is for people aged 14 or over. If you are under 14, please do not create an account. If we find out that an account belongs to someone under 14, we will delete it.
Your webcam
StudyCop asks your browser for webcam access only when you press “Start studying”. The video, the frames and the facial landmarks derived from them are processed in your browser, in memory, on your device. They are never uploaded or stored: only the resulting minute counts are sent to our server. You can revoke the camera permission at any time from the browser’s address bar or site settings.
What other users see
Your name, account ID, league, your minutes for this week, today and yesterday, and the time of your last study update are visible on the leaderboard to the other members of your group for that week (up to 30 people with a verified email address). Your email, streak, goal and garden are not.
3. Who receives your data
- Google, as provider of Firebase (Authentication, Cloud Firestore, Hosting). Google acts as our processor and hosts the data above. The database is located in Europe (multi-region “eur3”: Belgium and Netherlands).
- An email delivery provider, as our processor, only if you opted in to news, tips and offers: it receives your email address and name to send you those emails and to handle unsubscribes. We name the provider here before the first email is sent.
- Content delivery networks. The page loads code libraries from
gstatic.com(Google; the Firebase SDK) andcdn.jsdelivr.net(jsDelivr; MediaPipe and three.js), and the face-landmark model fromstorage.googleapis.com(Google). When your browser fetches them, those providers see your IP address and browser details. Fonts are served from this site.
We do not sell your data, we do not use advertising or analytics services, and we do not share data with anyone other than the processors listed above.
Transfers outside the EU/EEA
Google and the CDN providers may process data outside the EU/EEA, including in the United States. Such transfers rely on the European Commission’s adequacy decision for the EU–US Data Privacy Framework where the recipient is certified, or on the Standard Contractual Clauses.
4. How long we keep it
- Account, profile, sessions, leaderboard minutes and garden: until you delete your account. There is no automatic expiry.
- When you press “Delete account” in the Profile page, we erase the account, the profile, the session history and your leaderboard minutes from the live systems.
- News, tips and offers by email: your consent, and your address on the mailing list of our email delivery provider, last until you withdraw your consent, unsubscribe or delete your account. We remove withdrawals and deleted accounts from that list before the next email is sent.
- Technical request logs kept by the hosting provider: a short period (Google’s default for these logs is 30 days).
5. Your rights
You have the right to access your data, have it corrected, erased, restricted, receive it in a portable format, and object to processing based on legitimate interest. You can correct your name and goal and delete your account yourself from the Profile page. For anything else, write to lunilla.ai@gmail.com; we reply within one month.
If you agreed to receive news, tips and offers, you can withdraw your consent at any time, with the switch in the Profile page or the unsubscribe link in every email. Withdrawing does not affect your account or anything done before.
If you think your data is mishandled you can lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali, or with the authority of your own EU country.
6. Cookies and similar technologies
StudyCop sets no advertising, analytics, profiling or tracking cookies, and embeds no third-party video, map or social widget. It only uses the browser storage below, which is strictly necessary to provide the service you request or is a preference you set yourself. Under the ePrivacy rules these need no consent, so there is no cookie banner. If that ever changes, we will ask for your consent before setting anything else.
| Name | Where | What it does | Duration |
|---|---|---|---|
firebaseLocalStorageDb (Firebase Authentication) | IndexedDB, this site | Keeps you signed in | Until you sign out or clear site data |
firebase-heartbeat-database (Firebase SDK) | IndexedDB, this site | Technical record kept by the Firebase SDK: the dates it was last used and its version, sent along with its requests to Google | Until you clear site data |
studycop.vista | localStorage, this site | Remembers the tilt of the garden view you chose | Until you clear site data |
studycop.ora | localStorage, this site | Remembers whether you picked day, night or “follow the time” for the garden sky | Until you clear site data |
studycop.pomo | localStorage, this site | Remembers your Pomodoro timer settings: focus and break lengths, and whether the next phase starts on its own | Until you clear site data |
Neither preference leaves your browser. You can delete all of this from your browser’s site-data settings; you will be signed out.
7. Security
The site is served over HTTPS only. Database security rules let you change only your own records.
8. Changes
If this policy changes, the date at the top changes too.