Privacy Policy

01Introduction

This Privacy Policy explains how Simplicité ("we", "us", or "our") collects, uses, stores, and protects information when you use our study-planning, focus, and productivity application ("the Service"). Simplicité is an online service operated exclusively through the internet, with no physical premises.

By creating an account or using the Service, you agree to the practices described in this Policy. If you do not agree with them, you must not use the Service.

This Policy applies to all users, wherever they are located. Where the law of your country grants you stronger protections, those protections remain unaffected.

02Information We Collect

We collect the following categories of information:

• •Account information: name, email address, and password (stored as a secure hash), or the profile information shared by a third-party provider when you sign in with Google or GitHub.
• •Service data: tasks, schedules, course and grade data, notes, focus-session logs, energy and habit tracking data, AI chat conversations, uploaded documents (such as syllabi), and profile images.
• •Usage information: pages visited, features used, and interaction data, collected in a way that does not identify you individually where possible.
• •Technical information: device and browser type, IP address, and session identifiers, used for security, rate limiting, and error diagnosis.
• •Cookies and local storage (first-party only): qu-lang (language preference), qu-theme (theme), qu-device (per-browser security token for new-device sign-in alerts), and NextAuth session cookies (sign-in). We run no third-party advertising or analytics trackers (no Google Analytics, no ad pixels). Error reports via Sentry (Functional Software, Inc., USA) contain only technical diagnostics with credentials and personal content scrubbed.
• •Sign-in security (new-device alerts): a random per-browser token stored only as a SHA-256 hash, plus browser type. Never your password or message content. We keep your last 20 browsers to warn you (in-app + email) when an unknown browser signs in.
• •Contact and scholarship-application data: when you use the Contact form (name, email, company, message) it is emailed to our support inbox and kept there to handle your request. It is not stored in the app database. Scholarship applications (name, email, phone, study details) are kept for selection and, if you are awarded a seat, your name and email are shared with DataCamp to issue the license.
• •Connected accounts (optional Google Calendar sync): with your explicit consent we store encrypted Google access tokens, read your calendar events to show them in your calendar, and mirror study blocks you create into a dedicated "Simplicité" calendar. Disconnect anytime from the calendar page (or revoke in Google); revoking stops all access immediately.

03How We Use Information

We use the information we collect solely for the following purposes:

• •To operate, maintain, and secure the Service and your account.
• •To personalize your experience, including your study plans, AI assistance, and reminders.
• •To send you service-related communications, including deadline reminders and daily summaries that you have enabled.
• •To diagnose technical issues, prevent abuse, fraud, and unauthorized access, and enforce our Terms of Service.
• •To improve the Service through aggregate and de-identified analysis.

04Sharing of Information

We do not sell your personal information. We share information only as described in this Policy:

• •With the following sub-processors that help us operate the Service: (1) Google Gemini API by Google LLC (USA) for AI chat and syllabus parsing; (2) Groq API by Groq, Inc. (USA) as fallback AI chat and syllabus parsing; (3) Neon (USA/EU) for PostgreSQL database hosting; (4) Vercel Inc. (USA) for web hosting; (5) SMTP email delivery via our mail provider (currently Gmail SMTP by Google) for verification, password-reset, and service emails; (6) Cloudflare Turnstile (USA) for bot protection; (7) Sentry (USA) for crash diagnostics (scrubbed); (8) Google/GitHub OAuth, only if you choose social sign-in. Your AI chat text and uploaded syllabus files are sent to (1) and, on failure, to (2), in each case only when you saved that provider’s own key (Settings → AI Keys), solely to generate the response you requested.
• •With third-party identity providers (Google, GitHub) when you choose to sign in with them, in accordance with their own terms and policies.
• •With law enforcement or other authorities only where we are legally required to do so, or to protect our rights, your safety, or the safety of others.
• •With a successor entity in the event of a merger, acquisition, or sale of assets, subject to this Policy.
• •As part of de-identified or aggregated data, which cannot reasonably be used to identify you.
• •With DataCamp, Inc. (USA), and only where you apply for and accept a DataCamp Donates scholarship seat: your name and email are shared to create your license invitation. No payment data is ever shared with DataCamp.

AI data use and training, key-only and enforced in code. There is no shared quota and no server key: every AI feature runs ONLY on your own saved key (Settings → AI Keys), and refuses without one. Your chat text and uploaded syllabus files are sent to the provider whose key you saved (Google Gemini API by Google LLC (USA), and Groq API by Groq, Inc. (USA) when you saved a Groq key), solely to generate the response you requested. Data use and training are then governed by YOUR terms with that provider, not ours: on Google’s free tier, Google may use your prompts, chats, uploaded files, and generated responses to provide, improve, and develop its products, and human reviewers may read and annotate them after disconnecting them from your account. Paid-tier terms differ, so read your provider’s terms before connecting a key. Never submit passwords, health data, or third-party secrets. Groq processes Customer Data only to return your answer under its DPA: no training on inputs or outputs, and no retention by default. Legal bases are your consent when you submit content to an AI feature, our legitimate interest in operating it (GDPR Art. 6), and your explicit consent under Egyptian Law 151/2020. Cross-border notice (Egypt Law 151 and GDPR Chapter V): providers are located in the USA and EU, and transfers rely on Standard Contractual Clauses and provider safeguards. See Terms, Section 5.

05Data Retention and Deletion

We retain your information only for as long as your account is active, or as otherwise needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements.

If you request deletion of your account (Settings → Delete, or [email protected] from your account email), we delete or de-identify your personal data from live systems within thirty (30) days, except where retention is required by law (e.g. tax records) or for legitimate security and anti-abuse purposes (e.g. fraud logs kept the minimum time required). You can also export your data first from Settings → Export (JSON). Deleted account emails and usernames are kept only as non-recoverable tombstones to prevent re-registration abuse; a tombstone cannot be used to recover anything.

Backups are kept for disaster recovery only and are purged on a rolling schedule within ninety (90) days of live deletion. After that window no recoverable copy remains in our systems.

06Security

We implement administrative, technical, and organizational measures appropriate to the risks, including encryption of data in transit (TLS), hashed passwords, and access controls on our infrastructure.

No method of transmission or storage is completely secure. You are responsible for keeping your credentials confidential and for the security of the device you use to access the Service.

If a personal-data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant authority to the extent required by law.

07Your Rights

Depending on your jurisdiction, you may have the right to access, correct, delete, restrict, or object to the processing of your personal data, and to data portability. This includes rights under Egypt’s Personal Data Protection Law No. 151 of 2020 (the data controller is Simplicité, the early-stage solo project described in Section 11), the EU General Data Protection Regulation (GDPR) for users in the EEA, the California Consumer Privacy Act (CCPA) for users in California, and other applicable local laws.

You may exercise these rights at any time by contacting us. We will respond within the period required by applicable law.

If you believe your privacy rights have been violated, you may lodge a complaint with your local data protection authority. We will not discriminate against you for exercising any of your rights.

08International Data Transfers

The Service operates online and may process your data with providers located in countries other than your own. Where we transfer personal data internationally, we rely on safeguards required by applicable law, including, where applicable, adequacy decisions, standard contractual clauses, or equivalent mechanisms.

09Children

The Service is not directed at children under 13, and we do not knowingly collect personal data from them. The minimum age is 13. If you are under 18 (or the age of majority where you live), you may only use the Service with the permission of a parent or legal guardian who agrees to the Terms on your behalf. If you believe a child under 13 has provided us personal data, contact us, and we will delete it as promptly as practicable.

10Changes to This Policy

We may update this Policy from time to time. For material changes, we will provide notice at least thirty (30) days in advance by updating this page and, where practicable, notifying you through the Service or by email.

Your continued use of the Service after the effective date of any change constitutes acceptance of the revised Policy. If you do not agree, you must stop using the Service.

11Contact Information

Questions, concerns, or requests regarding this Policy or your personal data may be directed to: