Privacy policy

Last updated 16 October 2026

Catleya is a study app for students. The short version: you sign in with an account so your notes are saved to it and sync across your devices, each device keeps a copy so the app works offline, we don’t run ads or analytics, and we never sell anything about you.

Your account

You need an account to use Catleya. We store:

• your email address and a password (handled by our login provider, Supabase; we never see the password itself),
• the name and course & year you enter,
• a copy of your notebooks, files, PDFs, quizzes, schedule, planner and settings, so they sync across your devices.

Your synced data is private to your account: database rules only let your own signed-in account read or change it, and your files sit in a private storage folder.

If you choose to sign in with Google or Apple (where offered), that company tells us your email address and name; we don’t get your password.

On your device

Each device you sign in on keeps a copy of your data and your login in the browser’s storage, so Catleya works offline. Changes you make offline wait on the device and upload to your account when you’re back online. Untick Keep me signed in on a shared computer so the login is forgotten when the browser closes. Signing out ends the login on that device.

Things other people can see

Bulletin board announcements and shared links are public to everyone using Catleya, along with the author name shown on them. Don’t put private information in them.

Outside services the app uses

• Vercel hosts the website. Like any web host it keeps short-lived request logs (such as IP address and browser type).
• Supabase stores accounts, synced data, files, announcements and links.
• Gmail sends the sign-up, sign-in and password-reset emails with your 6-digit codes.
• Google handwriting recognition: when you use Neat text, the pen strokes you selected are sent to Google to be read. Nothing is sent unless you use that feature.
• Google Fonts, cdnjs and jsDelivr deliver fonts, the PDF reader and the sync library.
• Google’s favicon service and Simple Icons load the small website logos on the Links page.

These services receive your IP address when your device contacts them, as with any website.

Notifications

Alarms and class reminders are scheduled on your device. Allowing notifications doesn’t send us anything.

Cookies and tracking

Catleya uses no advertising or analytics cookies and no tracking pixels. It uses your browser’s storage only to keep your data and stay signed in.

Children

Catleya is made for school and college students. If you are under the age where your country requires a parent’s consent to use online services, ask a parent before making an account.

Your choices

• Export everything at any time from Settings → Backup.
• Delete any notebook, file or post in the app and it is removed from your account too.
• To have your whole account deleted, or to ask what we hold about you, contact us (below) from the email address on the account.

Changes

If this policy changes, we’ll update the date at the top. Big changes will be announced in the app.

Contact

Questions or deletion requests: open an issue on GitHub (don’t post personal details there; we’ll reply with a way to reach us privately), or ask your class officers.