Privacy policy

Your study belongs to you

Sprout is run by Oliver Wells, trading as Sprout, who is responsible for your personal data. Contact hello@sproutstudy.app about privacy, access to your data or a complaint. Postal address available on request by email.

Sprout is for ages 13 and over. Your study is private: there are no public profiles, advertising, location tracking or analytics scripts. We do not sell your information. You can turn reminders and device notifications off, change your plan, and delete your account. You do not need to enter sensitive personal information in study notes.

What we collect and why

Your account: email, password hash, preferences and records of agreement to our terms. These let you sign in, recover your account and use the service. Providing an account email and password is necessary to create an account; study notes and ratings are optional. We use legitimate interests to operate a private study tool, taking particular account of younger users’ privacy; we use contractual necessity to provide paid services to adult purchasers.

Your study: subjects, sessions, notes, ratings, assessments, topics, goals, available time and saved plans. Sprout uses these to show your history and provide the study features you request. Your basic plan uses the assessments, targets and study time you enter. Ratings-based priorities and confidence-based review dates are separate optional settings in Me → Privacy & study suggestions; both start off, including for existing accounts after this update. You can switch either off without losing ratings or review history. Garden choices, XP, challenges and freezes support progress features. Challenges do not require you to submit ratings or enable personalisation to earn their rewards. We use legitimate interests for core private study features. Optional ratings-based planning and adaptive review dates use your consent, given through those separate settings; you can withdraw it there at any time. Suggestions use rules based on your own study records; they do not make educational assessments or decisions with legal or similarly significant effects. You can edit your inputs and choose what to study.

Security: sign-in and recovery activity, rate-limit identifiers, session records and technical logs help prevent abuse and investigate faults, on the basis of our legitimate interests in protecting accounts. Rate-limit identifiers are hashed; hashing does not make them anonymous. The hosting server may record your IP address and request details.

Payments: Stripe receives your email and payment information at checkout. Sprout stores payment identifiers, status, plan and access periods to provide membership, handle cancellations, refunds and disputes, meet legal accounting obligations and prevent fraud. Sprout does not receive your full card details. Support messages are used to answer your request and resolve problems.

Reminders and notifications

Optional reminder emails and device notifications are based on your choice and consent. Change email reminders in Me and device preferences in Notifications & celebrations; you can also revoke browser permission. Withdrawing permission does not affect earlier lawful processing or your ability to study.

Background notifications store your browser’s subscription, encryption keys and preferences. Encrypted messages pass through the device provider’s push service, such as Apple, Google or Mozilla. They can appear on your Lock Screen; device settings control previews. Sprout does not include study notes in push messages. Signing out disconnects the subscription bound to that browser session; account deletion removes subscriptions and queued alerts. Password resets revoke older subscriptions when the delivery worker checks them.

Providers and international processing

Sprout uses Unlimited Web Hosting UK Limited for hosting and configured hosting email services. The operator reports that this installation does not use MailChannels. Its hosting infrastructure is advertised as based in Manchester, UK. Authorised hosting support may access data when necessary to operate or support the service. See the hosting provider’s privacy information.

Stripe processes payment and fraud-prevention information under its own privacy terms. Browser push services and payment providers may process information outside the UK. Where restricted transfers apply, appropriate legal safeguards are required, such as approved contractual clauses or an adequacy arrangement; the provider’s privacy information explains its arrangements. Contact us for information about safeguards relevant to your data. We may disclose information when legally required or to protect users against fraud or abuse.

How long information stays

Study records and preferences stay while your account exists, until you delete them or the account. Signing in uses a secure HTTP-only cookie for up to 90 days of inactivity. Password-reset and email-confirmation tokens are stored as hashes and expire after 30 minutes. Email reminders require ownership confirmation. Routine maintenance removes expired reset and email-confirmation tokens, and legacy abuse/reminder delivery records after 30 days and expired rate-limit counters after a further day. Application error logs rotate daily and are removed after 30 days by routine maintenance. Our policy is also to retain historical application and hosting error logs for 30 days, unless specific records are needed longer for a documented security investigation or legal obligation. Hosting access and mail-delivery logs are subject to separate provider controls. Notification delivery records are kept briefly for retries and duplicate prevention. These cleanups depend on the maintenance jobs running.

Deleting an account removes associated study data, preferences, subscriptions and membership records. Recurring billing is cancelled first; retained payment receipts lose their app-account link. Financial records may need to remain for accounting, legal obligations and disputes, including records held by Stripe. Manual hosting backups are stored on UK servers and kept on a rolling 14-day retention schedule. Deletion from the live database does not immediately erase copies in those earlier backups; they expire under that schedule. We apply deletion and privacy-choice changes before a restored backup returns to service. Contact us about hosting retention arrangements or a specific deletion request.

Cookies and offline storage

Sprout uses necessary storage for sign-in, security, your chosen appearance and requested app features. Fonts and app assets are served by Sprout. The service worker caches public assets and the offline screen, not full signed-in pages. Your browser can store a timer snapshot, unsynced timer actions and a finish note; the current tab can keep a note draft and navigation trail. Pending actions are removed when acknowledged by the server. A timer snapshot can remain until finished or you sign out; unsynced actions may remain on the device for recovery.

Use a trusted device. Logging out warns before discarding pending timer changes. Browser storage is not an encrypted vault: another person with access to your device may be able to read it. You can clear Sprout’s site data in browser settings, but that also removes unsynced work. No advertising or analytics consent banner is used because Sprout does not include those technologies.

Your choices and rights

Me → Export my data downloads completed sessions as CSV. You can edit your study records and use Me → Delete account. For a copy of other account information, correction, deletion, restriction, portability where applicable, or to object to processing based on legitimate interests, email us. You can withdraw consent to optional reminders at any time. We may need to verify your identity before disclosing information. We normally respond to rights requests within one month; we will explain any permitted extension or exception.

You can raise a concern with us or complain to the UK Information Commissioner’s Office. We will update this policy when processing changes and explain material changes in the app. See also our terms & cancellation information.