Privacy policy

Last updated 13 September 2026

Machi.study is a study app for students. Most privacy policies are a template with a product name pasted in. This one describes what this software actually does, checked line by line against the code that does it.

The short version. Without an account, your sets live in your browser and we hold nothing that says who you are. When you finish studying we count that a session happened — four numbers, nothing that could point back at you or your browser (section 1). If a set code you type doesn’t work, we keep a scrambled form of your internet address for up to a day, only to stop bots guessing codes (also section 1). With an account, your sets follow you between devices and only you can read them. We ask for the year you were born and never your birthday. When you ask Machi.study to make cards from notes you paste, a reading, or a topic you type, that text is sent to DeepInfra, which runs an open-source AI to write the cards, and nothing else about you goes with it (section 6). We don’t sell anything about you, and there’s nobody to sell it to.

1. Using Machi.study without an account

Without an account you can paste your notes and study the set Machi.study makes from them, practice problems, and open, copy and study a set somebody sent you. That much asks nothing of you at all. Making a second set of your own and carrying your progress between devices ask you to make an account. The account is free and there’s no card. Reading this page, or the terms, never asks you to sign in.

Whatever you do without an account is kept in your own browser, on your own device, and none of it reaches us:

  • Your sets, your cards, and the progress behind them.
  • Your study sessions: what you answered and when.
  • The year you were born, and the name you put on sets you share.
  • Which color theme you picked.

Because it’s in your browser, clearing your browsing data deletes it. Settings has a button that saves all of it to a file so you have a copy.

A signed-out browser talks to our server at four moments. One is when you send feedback (section 7). One is when you open a link somebody shared with you, or type a set code, which asks our server for that one set (section 4). One is when you ask Machi.study to make cards from notes you paste, a reading, or a topic you type, which sends that text through our server to DeepInfra (section 6). The fourth is below.

Counting that a study session happened

When you finish studying without an account, we add one line to a counter. It says four things: which study screen you used, how many cards you answered, how many minutes you were actually answering, and whether the set came from somebody else’s link. That’s the whole line.

It doesn’t say who you are, and it can’t be made to. There’s no name, no email, no account, no ID for your browser, no cookie set for this, and not even which set it was. We don’t store your IP address with it. Two sessions by you and one session each by two people look exactly the same to us, and that isn’t something we plan to fix — it’s the point. We can count that studying happened. We can’t follow a person doing it, join these lines to each other, or link one to an account you make afterwards.

Why we do it at all: studying without an account is the main way people meet Machi.study, and before this we genuinely could not tell whether a shared link was ever opened and used. Nothing is stored about you, and nothing here changes if you never sign up.

When a set code doesn’t work

When a set code you type doesn’t open a set, we keep a scrambled copy of your internet (IP) address and the code you typed for up to a day, only to stop bots from guessing codes. The key that scrambles it is replaced every day and the old key is deleted, so after that it can’t be turned back into your address. A code that works is not recorded. This happens whether or not you have an account.

2. What an account stores

An account exists for one reason: so your sets are on your phone as well as your laptop, and survive a lost device. If you have one, this is what’s stored on our server:

  • Your sign-in details. Your email address, and a password you can never read back. It’s stored scrambled by our sign-in provider, not by us. If you sign in with Google we get your email address from Google instead, and never a password.
  • Your account record. The year you were born, the name you chose for shared sets, and the date you signed up. Nothing else. There’s no photo, no bio, no “about me”.
  • Your sets. The title, the subject, and a picture if it’s a diagram set.
  • Your cards. Each term and definition, whether you starred it, and the numbers that decide when you next see it.
  • Your sessions. When a study session started and ended, which mode it was, and what you answered in it.

The database refuses to hand any of it to anyone but you. That’s not a rule the app has to remember to apply. The database enforces it every single time, which is why a bug in the app can’t show your sets to somebody else.

We don’t store your location, your contacts, your school, your real name, or anything from another app. We never ask for them.

3. The year you were born

We ask for the year, never the date. It’s used for exactly two things: deciding what advertising you may be shown, and checking you’re old enough for an account. It’s never shown to another person, never attached to a set you share, and never sent to an advertiser.

  • Under 13: no advertising at all, and no account (section 10).
  • 13 to 17: advertising may be shown, and it’s never personalized.
  • 18 and over: advertising may be shown, and it’s still never personalized.
  • If we don’t know your year: advertising may be shown, and we treat you as a teenager — the careful guess on an app for high school students. It’s never personalized. Section 5 says why this changed on 1 September 2026.

4. Sharing a set

Sharing is off until you turn it on for one particular set. When you do, we make a link with a long random code in it. Anybody who has that link can see that one set, without signing in. They can’t use it to find any of your other sets, and the code is far too long to guess.

Whoever holds the link sees exactly this and nothing else:

  • The set’s title and subject.
  • Every term and definition in it.
  • The name you set for shared sets, if you set one. This is the only thing about you that another person ever sees. If you haven’t set a name, the set says nothing about who made it.

They don’t see your email address, your account, the year you were born, how well you know the set, or anything else you’ve made.

You can stop sharing at any time. Press Stop sharing and every link you sent stops working, immediately and permanently. Deleting the set does the same. Sharing again makes a new link, and the old ones stay dead.

What stopping doesn’t do is take back copies. A shared set is copied when somebody saves it, so any copies already made stay with the people who made them, and deleting the original doesn’t remove them.

One exception, and it’s in the past. Until 1 September 2026 Machi.study could also make a link that carried the whole set inside the link itself and never reached our server. It doesn’t make those any more, but ones already sent still open — and since we never held anything, there’s nothing on our side to switch off, so a link of that kind can’t be called back.

5. Advertising

Machi.study is paid for by advertising, through Google AdSense. We don’t charge students to study: no study feature is locked, capped, or held behind a payment.

These are the rules, and they’re built into the app rather than promised loosely:

  • Nothing at all is shown to anyone under 13. In that case no advertising code is loaded and nothing is requested from Google. Not a blank space with a hidden ad in it — nothing.
  • Ads are never personalized, for anybody, at any age. They’re not chosen by who you are, by what you study, or by anywhere else you’ve been. You’re not profiled and you’re not followed.
  • If we don’t know your age, we treat you as a teenager.That’s the careful guess on an app for high school students. Every ad request says so, and Google then applies its protections for teenagers: no personalization, and whole categories of advertising switched off.
  • There is no advertising on a study screen. Flashcards, Review, Learn, Match, the practice test and Find it carry none at all — not beside the question and not underneath it. Advertising lives on your library, your progress page, a set’s own page and the written guides.
  • Ads never interrupt you. Nothing moves, nothing plays sound, nothing covers a question or an answer, and there’s never anything you have to close before you can carry on.
  • We never send your sets, your answers, or your email to an advertiser.

The advertising code itself also loads on the home page, which shows no ad, because a site can’t join an advertising network without the network being able to find its code. The same rule applies there as everywhere else: under 13, nothing is loaded.

Google sets its own cookies to count ads and to stop the same one being shown to you over and over. You can switch those off for every site at adssettings.google.com, and an ad blocker works too. Machi.study keeps working normally either way.

What changed, and when. On 3 September 2026 all advertising was removed from every study screen. It used to carry a banner and, on a wide screen, two narrow ones at the sides. Nothing about what is collected changed — this is less advertising, not different advertising.

Until 1 September 2026 this page said no ad was shown to anyone whose age we didn’t know. That was true, and it also meant that somebody opening a set a friend had sent them saw no advertising at all — which is most of how people first meet Machi.study. We changed the rule, and we’ve changed this page to say so rather than leave the old promise standing. The rule for under-13s did not change, and will not.

6. Who else touches your data

Four companies. Google does two jobs rather than one:

  • Vercel hosts the website. Like any web host, its servers see the requests your browser makes, including your IP address.
  • Supabase runs the sign-in system and the database. It holds everything in section 2, which it only has if you have an account. It also holds the scrambled address from section 1 for up to a day when a set code you type doesn’t work.
  • Google shows the advertising (section 5). Your browser asks Google for an ad, so Google sees your IP address and which page you’re on. It’s not told who you are: we don’t send it your email, your sets, or your answers. Google is also involved if you choose to sign in with Google — then it knows you signed in to Machi.study and tells us your email address. Sign in with an email and password instead and that second part doesn’t happen.
  • DeepInfra, a US company, runs the open-source AI that writes cards. When you ask Machi.study to make cards from notes you paste, questions from a reading, practice problems on a topic you type, or written-answer questions from one of your sets, that text (or that set’s cards) is sent to DeepInfra to run the AI, and nothing else is: not your name, not your email, not your account, not your other sets. Our server passes it on and does not keep it. DeepInfra says it does not store what we send or what the AI writes back, and does not use it to train AI.

Nobody else. We don’t use an analytics company, we don’t use tracking pixels, there is no Google Analytics or anything like it on any page, we don’t profile you for advertising, and we’ve never sold or shared your data with anyone. Our own counting is the counter in section 1 and nothing more: it stays in our own database, it holds nothing that identifies anybody, and no other company is given it.

7. Feedback

If you send feedback, we store the message you typed, the address you typed in the reply box if you filled it in, and which page of Machi.study you were on. If you were signed in it’s linked to your account so we can reply properly.

Nothing is taken from you automatically. We don’t put your email address in it unless you type one. Only the people who run Machi.study can read feedback: you can’t read anyone else’s, and nobody else can read yours.

8. Getting your data out

Go to Settings, find “Your data”, and press the button that saves a backup. You get a file with every set, every card and all your progress in it. You can load it back into Machi.study on any device, and it’s plain text you can open yourself.

This works whether or not you have an account, and we don’t limit how often you can do it.

9. Deleting your account

Deleting a set, or every set, is something you can do yourself in Settings, and it takes the sets with it. Deleting the whole account is in Settings too, under Account. It asks once, and then everything below goes. If you’d rather we did it, email privacy@machi.study from the address on your account.

When your account is deleted, the database removes:

  • Your sign-in details.
  • Your account record, including the year you were born and your name.
  • Every set and every card on the account.
  • Every study session on the account.

Two things survive, and we’d rather say so than not. Feedback you sent is kept, but it stops pointing at you. The message stays, and the link to your account is removed. And a set that somebody else copied stays with them, because it’s their copy (section 4).

Signing out is separate and doesn’t delete your account. It saves everything to your account first, then clears Machi.study out of that browser, so the next person to use the computer sees nothing of yours. If it can’t save, it refuses to sign you out rather than lose your work.

10. If you’re under 13

You need to be 13 or over to have a Machi.study account, and sign-up refuses a birth year that makes you younger than that. This isn’t us being unhelpful: the law in several countries treats storing a younger child’s information as something that needs a parent’s permission, and we’re not set up to ask for that.

You can still study on Machi.study. With no account at all you can paste your notes and study the set Machi.study makes from them, practice problems, and open, copy and study a set somebody sent you. What you make lives in your browser and not on our server. We hold nothing about you. Two things leave your browser, and neither says who you are: the counter in section 1, which says a session happened and four numbers about it, and the text you ask Machi.study to make cards from, which our server passes to DeepInfra and does not keep (section 6). So don’t put your name, your school or anything else about yourself in notes you send. What you can’t do is make a second set of your own or save your progress between devices, because both of those need an account.

If you believe a child under 13 has made an account, email privacy@machi.study and we’ll delete it.

11. When this page changes

The date at the top says when it last changed. If we change something that matters — collecting something new, switching advertising on, adding a company to section 6 — we’ll say so on Machi.study itself, not only here.

12. Contact

Machi.study is run by one person, not a company. For anything about this page, about your data, or to delete your account: privacy@machi.study.

This page was written by the people who built Machi.study, not by lawyers, and it’s not legal advice. It’s meant to be an honest description of what the software does. It should be reviewed by a real lawyer before Machi.study is used at any serious scale.

Privacy policy · Terms of use