Browse deals

Legal

Privacy Policy

Effective date: 23 July 2026 Last updated: 2 August 2026

This Privacy Policy explains how Studely, operated by a sole individual established in Romania (“Studely”, “we”, “us”, “our”) collects, uses, shares and protects personal data when you visit https://studely.app (the “Site”) or sign in to an account. It also describes your rights and how to exercise them.

Studely is a scored directory of free tools, cloud credits, online courses and discounts for students. Reading the directory requires no account. An account exists only to enable a small number of features (see Section 2).

1. Who is responsible for your data

The data controller for the purposes of the EU General Data Protection Regulation (GDPR) and the UK GDPR is:

  • Controller: Studely, operated by a sole individual established in Romania
  • Registered/operating jurisdiction: Romania
  • Contact for privacy matters: privacy@studely.app

2. What we collect and why

We practise data minimisation: we collect as little as possible. The table below is the complete list.

Data When collected Purpose Lawful basis (GDPR / UK GDPR)
Email address Only if you sign in. Authentication is passwordless “magic link” — you enter your email, we email you a one-time sign-in link. No passwords are stored. To create and secure your account, send the magic-link sign-in email, and (in future) associate features such as comments or submissions with you Art. 6(1)(b) — performance of a contract / service you requested; and Art. 6(1)(f) — legitimate interest in securing accounts
Server and access logs Automatically, on every request Security, abuse prevention, debugging, and keeping the Site available. Logs may include IP address, timestamp, user agent, and requested URL, held by our hosting and network providers Art. 6(1)(f) — legitimate interest in a secure, reliable service
Advertising cookies The Google AdSense tag loads on every page, so Google may set cookies or read device identifiers. No ad unit is configured, so no advertisement is served. No analytics run at all. To review the site for the AdSense programme, and — once ad units exist — to display, measure and (subject to consent) personalise advertising Consent — Art. 6(1)(a), collected in the EEA/UK/CH by Google’s certified consent platform, which loads with the tag (see Section 7)

We do not collect names, postal addresses, phone numbers, payment details, or passwords. We do not knowingly collect special-category data (health, religion, biometrics, etc.).

What we genuinely store today As of the effective date, the only personal data Studely itself stores is the email address of people who have signed in, held in our authentication database (Supabase). Everything else in the table above is either handled by a processor’s infrastructure logs, or is future-state (AdSense) that is not active yet.

3. We do not sell your data

We do not sell your personal data for money, and we do not currently “share” it for cross-context behavioural advertising as those terms are defined under the California Consumer Privacy Act as amended by the CPRA.

AdSense may constitute a “sale” or “share” under CCPA/CPRA Once Google AdSense is live, the setting of third-party advertising cookies can qualify as a “sale” or “share” under the CCPA/CPRA (and similar US state laws). Before enabling AdSense, a “Do Not Sell or Share My Personal Information” control will be added and an opt-out signal mechanism (e.g. Global Privacy Control) supported. See Section 8.

No outbound link on Studely is an affiliate link today, and we earn no commission from any vendor. Clicking an offer sends you to the provider’s own site, where that site’s privacy policy applies.

We intend to add affiliate links. From the point one exists, the vendor may set a tracking cookie or append a tracking parameter so it can attribute a sign-up to Studely — always on the vendor’s site, under the vendor’s privacy policy, never on Studely. Any such offer will be labelled, per FTC guidance and equivalent norms. Monetisation will never change whether an offer is listed or how it is scored.

5. Who processes your data (processors and sub-processors)

We rely on the following third parties to run Studely. Each acts as a processor (or independent controller, where noted) and each has its own privacy terms.

Provider Role What they handle Data location
Supabase Processor — database & authentication Stores your email address; issues and validates magic-link tokens the European Union (Supabase region eu-central-1, Frankfurt, Germany) (project region)
Resend Processor — transactional email (SMTP) Delivers the magic-link sign-in email to your address See Resend’s terms
Vercel Processor — application hosting Serves the Site; generates request/access logs See Vercel’s terms
Cloudflare Processor — DNS and network Resolves studely.app; may process request metadata at the network edge See Cloudflare’s terms
Google AdSense Independent controller — advertising. Its tag loads on every page; no ad unit is configured, so no advertisement is served May set cookies or process device identifiers while the tag is loaded, and will serve and measure ads once units are enabled See Google’s terms

We do not sell or rent your data to any of the above; they process it only to provide their service to us.

6. International data transfers

Some of the providers in Section 5 are established in, or transfer data to, countries outside the EEA / UK (notably the United States). Where personal data is transferred outside the EEA or UK, we rely on an appropriate transfer mechanism — typically the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, and/or a provider’s certification under the EU–US Data Privacy Framework where applicable.

7. Cookies

The only cookies Studely itself sets are strictly necessary: a session cookie to keep you signed in after a magic link, and a short-lived cookie during the sign-in exchange. Strictly-necessary cookies do not require consent. Studely runs no analytics.

The Google AdSense tag loads on every page — Google requires it on the site in order to review it. No ad unit is configured, so no advertisement is served anywhere; but the tag being present means Google may set cookies or read device identifiers. In the EEA, UK and Switzerland that consent is collected by Google’s certified consent management platform, which loads with the tag. This is the position today, not a future step. Consent is per the ePrivacy Directive (“cookie law”) and GDPR.

Full details of every cookie, its purpose and duration, and how to change your choice, are in the Cookie Notice.

8. Your rights

GDPR / UK GDPR (EEA & UK residents)

You have the right to:

  • Access — get a copy of the personal data we hold about you.
  • Rectification — correct inaccurate data.
  • Erasure (“right to be forgotten”) — have your data deleted.
  • Restriction — limit how we use your data.
  • Portability — receive your data in a portable, machine-readable format.
  • Object — object to processing based on legitimate interest.
  • Withdraw consent — where processing relies on consent (e.g. advertising cookies), withdraw it at any time, without affecting prior lawful processing.
  • Complain — lodge a complaint with a supervisory authority. Because Studely’s operator is established in Romania, the lead authority is the Romanian ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal, dataprotection.ro). You may also complain to your own national data protection authority in the EEA, or, in the UK, the Information Commissioner’s Office (ICO).

Because the only data we hold is your email address, most requests are simple to fulfil — deleting your account removes the email we store.

CCPA / CPRA (California residents)

You have the right to:

  • Know / access the categories and specific pieces of personal information collected.
  • Delete personal information we hold about you.
  • Correct inaccurate personal information.
  • Opt out of the sale or sharing of personal information — we do not currently sell or share it; once AdSense is live, use the “Do Not Sell or Share My Personal Information” link (to be added).
  • Non-discrimination for exercising your rights.

Similar rights may apply under other US state privacy laws (e.g. Virginia, Colorado). We honour recognised opt-out preference signals such as Global Privacy Control where required.

How to exercise your rights

Email privacy@studely.app from the address associated with your account, stating the right you wish to exercise. We may take reasonable steps to verify your identity — usually by confirming control of the email address on file. We aim to respond within one month (GDPR/UK GDPR) or 45 days (CCPA/CPRA), extendable as the law allows. You may use an authorised agent where the law permits.

9. Data retention

Data Retained Then
Email address (account) For as long as your account exists Deleted when you delete your account or ask us to erase it, subject to any legal hold
Magic-link tokens Short-lived (single use, expiring) Automatically invalidated / expired
Server & access logs For the retention period of our hosting/network providers Rotated and deleted per their schedules
Advertising-cookie data (once live) Per your consent and Google’s retention settings Cleared when consent is withdrawn or the cookie expires

We keep personal data no longer than necessary for the purposes above or as required by law.

10. Children and minors

Studely’s audience is students, which may include people aged 13 to 17.

  • The minimum age to create an account on Studely is 16.
  • If you are under 16, you may still read the public directory, but you must not sign in or submit any personal data to us.
  • We do not knowingly collect personal data from children below 16. If we learn that we have, we will delete it.
  • Where a parent or guardian believes a minor has provided data, they can contact privacy@studely.app to have it removed.

11. How we protect your data

Access to the database is governed by row-level security on every table, the authentication system stores no passwords, and administrative access is gated behind the same magic-link sign-in. A structured security audit was carried out and its findings remediated. No system is perfectly secure, but we take reasonable technical and organisational measures appropriate to the limited data we hold.

12. Changes to this policy

We may update this Privacy Policy. When we do, we will change the “Last updated” date above and, for material changes, take reasonable steps to notify signed-in users (e.g. by email to the address on file). Your continued use of the Site after an update means you accept the revised policy where the law permits.

13. Contact

Questions, requests, or complaints about privacy:

Cookie Notice · Terms of Service · Affiliate & Advertising Disclosure