Merit — Privacy Policy

Effective date: July 8, 2026 Publisher: Chen Ye Gan ("we", "us", "our") Contact: ganc56141@gmail.com

Merit ("the App") is an independent app that helps students view their own Schoology grades, assignments, schedule, and course materials in one place. This policy explains exactly what data the App handles and where it goes. We designed Merit to keep your information on your own device wherever possible.

Merit is not affiliated with, endorsed by, or sponsored by Schoology, PowerSchool, or your school. Trademarks belong to their respective owners.

Summary (the short version)

• Your Schoology (and optional PowerSchool) login and password are stored only on your device, in the operating system's secure keychain. They are sent only to Schoology/PowerSchool to log you in — never to our servers.
• Your grades, assignments, schedule, and materials are fetched from Schoology directly by the App and cached only on your device.
• We do not run ads, analytics, tracking, or third-party marketing SDKs.
• The only information that leaves your device to us is feedback you choose to send (a message, and an email address only if you add one).

1. Information stored on your device only (not collected by us)

• Account credentials. Your Schoology email/username and password (and, on macOS, optional PowerSchool credentials) are saved in the device keychain (Apple Keychain). They never leave the device except in the direct, encrypted (HTTPS) login request to Schoology/PowerSchool. We cannot see them.
• Your school data. Grades, assignments, tests, schedule, course materials, attachments, your name, and profile picture are retrieved from Schoology by the App and cached locally so the App works offline. This data is not transmitted to us.
• Preferences. Theme, accent color, sync interval, and app-lock settings are stored locally on the device.

Because this information stays on your device (or travels only between your device and Schoology/PowerSchool), it is not "collected" by us under Apple's App Privacy definitions.

2. Information we do receive: feedback (optional)

If you use the in-app Send Feedback feature, the message text you type — and an email address only if you choose to provide one — is sent to our backend (hosted on Supabase, a third-party database provider) so we can read and act on it. This is used solely to improve the App and, if you left an email, to reply to you. It is not used for advertising or tracking and is not sold or shared with data brokers. If you never send feedback, none of this data is transmitted.

3. How your data is protected

• All network connections use HTTPS/TLS; certificate validation is enabled.
• Credentials use the OS keychain (hardware-backed on modern devices).
• The optional App Lock requires Face ID / Touch ID / passcode (iOS) or a local passcode (macOS) to open the App.
• We do not have servers that store your grades or credentials.

4. Data we do NOT collect

We do not collect location, contacts, photos, health data, advertising identifiers, or usage analytics. We do not track you across apps or websites (no tracking as defined by Apple's App Tracking Transparency).

5. Children's privacy

Merit is a tool for students to view their own school accounts and is intended for use by students of the age served by their school, with school/ guardian awareness. We do not knowingly collect personal information from children beyond the on-device handling described above; the only optional off-device data (feedback) is user-initiated. Merit serves K-12 students and teachers. It does not knowingly collect personal information from children: account data and school data stay on the device and are shared only with the student's own school systems (Schoology/PowerSchool). The only optional off-device data is user-initiated feedback. If you are a parent, guardian, or school and believe a child provided information via feedback, email us and we will delete it.

6. Third-party services

• Schoology / PowerSchool — the App connects to your school's Schoology (and optionally PowerSchool) on your behalf to retrieve your data. Their handling of your data is governed by their own policies and your school's agreements.
• Supabase — hosts the optional feedback we receive. See supabase.com/privacy.

7. Your choices & data deletion

• Sign out in Settings removes your saved credentials and cached data from the device.
• Delete the App removes all locally stored data.
• To request deletion of feedback you sent us, email ganc56141@gmail.com.

8. Changes to this policy

We may update this policy; the "Effective date" above will change and the updated version will be posted at https://gank8818-bit.github.io/StudyFlow-releases/privacy.html.

9. Contact

Questions about privacy? Email ganc56141@gmail.com.