Draft — pending founder review. This text is a first draft and may change before launch.
Privacy policy
ezpz.study turns photos of a child's homework into short study games. Because the people using it are families with children, we collect as little as possible, keep your family's material private and let you export or delete everything yourself at any time.
This policy explains what personal data we process, why, who helps us, how long we keep it and what rights you have. It applies to the ezpz.study website and app (including when installed on a phone, tablet or computer).
1. Who we are
ezpz.study is operated from the Netherlands by [legal entity name, registered address, Chamber of Commerce number] ("ezpz.study", "we", "us"). We are the controller of the personal data described in this policy.
For anything about privacy, write to privacy@ezpz.study. We answer every request, and requests about your rights within one month at the latest.
2. Who the service is for
A family account is always created by an adult, a parent or legal guardian aged 18 or over. We check this with a date-of-birth question at sign-up; we do not store the date of birth.
Children never create an account and never give us an email address. The adult who creates the account adds child profiles inside it, and a child uses ezpz.study on a device where the family is signed in, by picking their own profile.
3. What we collect
We only collect what we need to run the service:
- Family account: the email address of each adult in the family, a display name, the family name and the family language. You sign in with a one-time code we email to you, so there is no password and we store none. If you sign in with Google or Apple, we receive your name and email address from them.
- Child profiles: a name or nickname, an avatar picture from our own set, a school level, a UI language and a 4-digit PIN, which we store only as a hash. We do not ask for a child's date of birth, school, email address or photo.
- Study material: the photos and PDF pages you upload, the text read from them, and the questions, answers, explanations and summaries generated from that text, including any edits you make.
- Learning activity: study sessions (date, duration, game mode, score), each answer given, progress per question for the repetition schedule, and test dates, grades and notes entered in the history.
- Notifications: if you turn on notifications, the push address your browser gives us for this device.
- Security records: a log of important account actions (for example exports and deletions), PIN attempts per child profile with a scrambled (hashed) network address, and short-lived server logs with IP addresses.
- Usage events: which features are used (for example "set created" or "session completed"), with the family's account ID, language, device type and whether the app is installed. These are stored in our own database; we do not use third-party analytics or advertising trackers.
- Emails with us: messages you send to support and the service emails we send you (such as your sign-in code, "your set is ready" or "your export is ready").
4. Why we use it and our legal basis
Providing the service (contract, GDPR article 6(1)(b)): running your account, turning your photos into study sets, scheduling repetition, showing history, sending sign-in codes and the notifications and emails you rely on, and handling exports and deletions.
Children's data (consent given by the parent, GDPR articles 6(1)(a) and 8): the adult who holds parental responsibility creates the child profile and agrees to this processing on the child's behalf. No child ever registers directly, so national rules for children under 16 are met through the parent. This consent can be withdrawn at any time by deleting the child profile.
Keeping the service safe (legitimate interest, article 6(1)(f)): hashed PINs with attempt limits, the account audit log, abuse prevention and security logs.
Improving the service (legitimate interest, article 6(1)(f)): usage events in our own database show us which features help families and where things go wrong. We never use them for advertising, never share them with other companies and never sell them. You can object at any time by emailing privacy@ezpz.study.
Legal obligations (article 6(1)(c)): for example answering lawful requests from authorities.
5. Photos and AI processing
To read a page and create questions, we send the page image and the extracted text to Anthropic's Claude API. Anthropic processes this data only to give us the result, as our processor. It is not used to train AI models, by Anthropic or by us.
We ask the AI not to copy personal names into the study material. Worksheets can still contain a name or school name, so every new set first opens on a review screen, where you can edit or remove anything before it is played.
Photos are stored in private storage that only your family can reach, through links that expire after 10 minutes. The original photos are deleted automatically 30 days after a set goes live; you can delete them sooner by deleting the set. Photos of sets that are never approved are kept until you delete the set or your account.
6. Children's privacy (including COPPA)
ezpz.study is designed for children to use within a family account set up by an adult. It is not directed at children signing up on their own, and children cannot create accounts.
For families in the United States: the account is created by an adult who confirms by email, and who states they are 18 or over, before any information about a child is collected. This is how we obtain verifiable parental consent under the Children's Online Privacy Protection Act (COPPA). We collect from children only what is needed for learning (see section 3).
The app has no advertising, no in-app purchases, no chat, no public profiles and no sharing with other families. A parent can review, export or delete a child's information at any time from Settings, or ask us to by emailing privacy@ezpz.study, and can stop further collection by deleting the child profile.
8. International transfers
We keep your family's data in the EU where we can. Some providers above (such as Anthropic, Vercel and Resend) may process data in the United States. For those transfers we rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses with additional safeguards.
9. How long we keep data
- Account, child profiles, study sets and learning history: as long as your account exists, or until you delete them.
- Original photos: deleted 30 days after the set goes live (see section 5).
- A deleted child profile disappears from the app immediately, and its records are permanently erased within 24 hours.
- When you delete the family account, everything is permanently erased within 24 hours: account, child profiles, photos, sets, history and exports.
- Export files remain available to download from your settings until you delete your account.
- Security records (audit log, PIN attempts) and usage events: as long as the family account exists. Server logs: at most 30 days.
10. How we protect data
All traffic is encrypted (HTTPS) and our providers encrypt stored data. Every table in our database is locked to your family with row-level security, so one family can never see another family's data. Sign-in uses one-time codes sent by email, so there are no passwords to leak. PINs are hashed and locked for 15 minutes after 5 wrong tries, and important account actions are logged. Only our servers hold the keys that can bypass these rules.
11. Your rights
You have the right to access, correct, delete, restrict and object to the processing of your data, the right to data portability and the right to withdraw consent. Parents exercise these rights for their children.
You can do the most important ones yourself in Settings → Your data: download a copy of all your family's data (JSON files plus the original photos still stored), delete a child profile or delete the whole family account. Exports and deletions are completed within 24 hours.
For anything else, email privacy@ezpz.study. We may ask you to confirm that you are the account holder. If you are not happy with our answer, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the data protection authority where you live.
13. Changes to this policy
If we change this policy in a way that matters, we will tell parents by email or in the app before the change takes effect. The date at the top shows when it was last updated.
14. Contact
Questions, requests or complaints: privacy@ezpz.study. Postal address: [legal entity name and address], the Netherlands.