Privacy policy

Last updated 28 October 2026

This policy explains what personal data Unizy (unizy.uk) collects, why, and your rights. Unizy is run by Ammaar Hasan, who is the data controller. Contact: [email protected].

What we collect

• Your account details, if you create an account: your email address, so we can send you sign-in, confirmation and password-reset emails; your first name, if you give it; and your password, which is never stored as you type it, only as a secure scrambled (hashed) version.
• Your study data, if you are signed in: your university, course, year and modules, and the notes, flashcards, test answers, progress and marked work you save. If you are not signed in, this stays in your browser on your device and we never receive it.
• Work you send to the tutor: questions to the tutor, answers and essays you submit for marking, and photos of your work. These are sent to our tutoring technology provider to produce a reply. We don’t keep the photos. The marked result, including any transcription of your photos, is saved to your account so you can see it later.
• Tutor usage counts: how much of your daily and weekly tutor allowance you have used.
• Friends and group chats: your display name, university, course and year (shown to your friends), your friend code, friend requests, the groups you’re in and the messages you send. Messages are visible to the members of that group. When someone tags the tutor, recent messages in that chat are sent to our tutoring technology provider to produce a reply.
• Things you share with a group: flashcard sets, quizzes, seminar-prep lists and copies of notes you choose to share, plus quiz scores, seminar-prep ticks and saves that members add to them. These are visible to that group. Your own notes are never shared unless you share a copy, and you can remove what you shared.
• Your study plan: classes, deadlines and revision sessions you add, which lectures you mark as finished, your practice queue and flashcard review schedule. These are saved like the rest of your study data.
• Timetables and handbooks you upload: when you use 1-click setup, the PDF or screenshots are sent to our tutoring technology provider to pick out your modules, classes and deadlines. We don’t keep the files; only what you choose to add (plan entries and handbook pages in your notes) is saved to your account.
• Connected uni calendars: the private calendar link you paste (for example from Moodle, Canvas or Blackboard) is saved to your account. Unizy uses it only to read your calendar and add its events to your plan. Disconnect it any time and its events are removed.
• Uni email verification: the university email address you verify and when, so we know you study there. It is never shown to other students, and one uni email can verify one account.
• Module hubs: posts, replies, shared notes and flashcard sets you post, which hubs you open, and “helpful” votes and saves. Hub posts are visible to verified students at your university, with your display name, course and year.
• Marketplace: your listings (including photos, which are stored publicly so they can be displayed), and messages between you and buyers or sellers. Listings are visible to verified students at your university; messages only to the two people in the conversation. Unizy doesn’t handle payments between students.
• Study rooms: the rooms you make or join, the shared notes you write, flashcards you add to a room’s vault, readings you add, take on or summarise, and your answers in live quizzes. These are visible to the members of that room, with your display name.
• Cohort benchmarks: your topic-test and group-quiz scores for a module, linked to your verified university. Other students only ever see totals (how many students, the average and where you stand), never names or individual scores.
• Lecture packs: when you upload lecture slides or handouts, the file is sent to our tutoring technology provider to write your notes, flashcards and questions. We don’t keep the file. We keep the pack’s title, the topics it covers and short passages from it (with a mathematical index used to search them) so your tutor can quote your slides. Only you can search them, and you can remove a pack at any time.
• Reading lists: if your university publishes reading lists publicly (for example on Talis Aspire), Unizy copies the list for your module and stores which items you’ve ticked as read.
• Opening Unizy from Moodle, Canvas or Blackboard: if your university adds Unizy to its learning platform, opening it from your course sends us your name, university email, the course you came from and your role, so we can sign you in, confirm you study there and open that module.
• Study Mode: focus sessions you finish (module and minutes). While your timer runs, verified students on the same module see your display name and timer status in its focus room. Your weekly focus time can appear on module leaderboards unless you hide yourself.
• Usage information: for signed-in users, the days on which you open the app and whether you’ve completed your first study steps (for example, reviewed flashcards or taken a test). We use this only to understand whether Unizy is useful and to improve it.
• Reviews: if you leave a review, it is shown publicly on unizy.uk/reviews with your first name, the date and, if you choose, your university, course and year. Your email is never shown. You can edit or delete your review at any time.
• Payments: if you buy Unizy Pro, Stripe processes your payment. We receive your Stripe customer and subscription references, what you bought and when it ends. We never receive your full card details.
• Technical data: our hosting providers process your IP address and basic request information to deliver the site and keep it secure.
• Anonymous visit counts: we count events such as home page views, demo steps and sign-up page views as daily totals. No cookies or identifiers are used, nothing is stored on your device for this, and the totals can’t be linked to you. Browsers sending Global Privacy Control or Do Not Track aren’t counted.

We don’t use advertising or third-party analytics trackers, and we don’t sell your data.

Why we use it (lawful basis)

• To provide the service you asked for: your account, saving your work, the tutor and marking (performance of a contract).
• To keep Unizy secure and prevent abuse, including usage limits and moderating group chats (legitimate interests).
• To understand whether Unizy is useful and improve it, using anonymous visit totals, signed-in users’ active days and first study steps, and learning results such as score changes on retested topics, flashcard review results, active study minutes and the optional time-saving survey (legitimate interests). We may publish these only as anonymous totals covering at least 20 students, never about an individual.
• To keep records of payments as the law requires (legal obligation).

Who processes it for us

• Supabase: accounts and database, hosted in London (eu-west-2).
• Cloudflare: website hosting and delivery.
• Our tutoring technology provider: processes what you send to the tutor, marking, lecture packs and 1-click setup to produce a reply. It does not use this to train its systems, and may process data outside the UK under appropriate safeguards.
• Our email provider (Resend): sends sign-in, confirmation and password emails, and uni email verification codes.
• Stripe: payment processing for Unizy Pro. Stripe is an independent controller for some payment data (for example, fraud prevention) under its own privacy policy.
• Google Fonts: serves the site’s fonts, which shares your IP address with Google when pages load.

Browser storage

Unizy uses your browser’s local storage to keep you signed in and to save your work on your device. This is strictly necessary for the service, so we don’t ask for cookie consent. We don’t set tracking cookies.

How long we keep it

We keep your account, study data, friends and group messages until you delete your account (messages you sent stay visible in the group, shown without your name, unless you ask us to remove them). Payment records are kept for 6 years, as UK tax law requires. We delete accounts that have been inactive for 24 months. Tutor usage counts, active days and active study minutes are kept for up to 12 months. Anonymous visit totals contain no personal data.

Your rights

Under UK data protection law you can ask to access, correct, delete or export your data, and object to or restrict how we use it. To delete your account and everything saved in it, or to use any of these rights, email [email protected]. We’ll respond within one month. You can also complain to the Information Commissioner’s Office (ico.org.uk).

Age

Unizy is for university students and is not intended for children under 16.

Changes

If we change this policy we’ll update the date above, and tell signed-in users about significant changes.