Privacy

Last updated 12 October 2026.

Who is responsible

Firefly is built and run by one person, Nurah Kamal, in Cape Town, South Africa, not by a company. I am the responsible party and the information officer for your personal information under the Protection of Personal Information Act (POPIA), and the person to contact about anything on this page.

Write to hello@studyfirefly.com. A person reads every message.

What is kept

When you ask for an invite

Your name, your email address, and, if you fill it in, what you are studying. Only I can read invite requests.

When you have an account

• Your account: email address, username, profile picture if you add one, your chosen theme, your semester dates, and whether two-factor sign-in is switched on.
• Your studying: when each study session started, paused and ended, which course it was for, and your weekly goals.
• Your courses: course names, the text of your notes, and the summaries, flashcards, practice tests and study guides made from them, including your test answers, scores and how you rated each flashcard.
• Your planner: calendar events, planned study blocks and your to-do list.
• Your friends and chats: who you are friends with, who you have blocked, group chats you are in, the messages you send, reactions, and how far you have read in each chat.
• Usage: how many times you have generated study material each day, and a technical log of each generation (which kind, which provider, how long it took, how many tokens it used, and any error).
• For running the service: when you signed up, when you last signed in and when you were last active. My admin screen shows these, your email address, and counts such as how many notes and pictures you have. It does not show your notes or messages.

Who can see what

• Only you: your courses, notes, study material, planner, calendar and to-do list. The database refuses these to anyone else.
• Your friends: that you are online whenever you have Firefly open, whether you are studying right now and for how long, your username and picture, your study time, streak and weekly goals (you can make goals private), and short updates when you finish a session, meet a goal or keep a streak. A finished-session update names the course.
• People in a group chat with you: your username and picture, the messages you send there, and, in a study room, whether you are focusing or on a break and which course.
• People you block: nothing. They cannot find you, message you, or see you anywhere.

Whether you are online, and whether you are studying right now, goes out on a live channel of your own, and the database lets only your friends listen to it. It never says what you are studying or where you are.

Your files

When you add a PDF, PowerPoint or Word file, the text is taken out of it inside your browser and only that text is saved. The file itself is never uploaded.

Profile pictures and group chat pictures are cropped and shrunk in your browser before they are uploaded. They are stored so that anyone who has a picture's exact address can open it, which is how pictures load quickly in chats. Nobody can list or browse them.

Generating study material

When you press Generate, the title and text of the notes you chose are sent to an AI provider, which writes the summary, flashcards, test or study guide and sends it back. Firefly uses Groq, and Google's Gemini for longer notes or when Groq is unavailable. For new flashcards, the fronts of your existing cards are sent too, so they are not repeated.

Nothing is sent unless you ask for it. Adding a note or a file and opening a study guide send nothing on their own; Firefly waits until you press a button. Everyone has the same allowance of forty generations a day.

What Groq and Google may do with the text they receive is set by their own terms, not by Firefly: see Groq's privacy policy and the Gemini API terms. Only the text of your notes is sent, from Firefly's server rather than your browser. The file is never sent, and nothing that identifies your account is attached, such as your email address or username. Anything you wrote inside your notes, a name on a cover page for example, goes with the text.

Services Firefly relies on

These companies process some of your information so that Firefly can work. None of them receive it to sell or advertise to you.

• Supabase hosts the database, sign-in and profile pictures.
• Vercel hosts the website, and like any host keeps short-lived request logs.
• Groq and Google (Gemini) receive your notes when you ask for study material to be made from them, as described above.
• Cloudflare Turnstile checks that a person, not a bot, is using the sign-in and invite forms. It receives your IP address and details about your browser.
• Google Fonts, jsDelivr and cdnjs supply the typefaces and some of the code the pages load, so your browser contacts them directly.

Where your data is stored

Firefly's database is hosted by Supabase in Ireland, in the European Union. Some of the services above are based in the United States. Using Firefly means your information leaves South Africa, which POPIA allows when the receiving country or the provider's own terms give it comparable protection.

What is kept on your device

Firefly sets no cookies of its own. It does keep a few things in your browser's local storage: your sign-in session, your theme, which tab you last had open in the planner, and your timer's state and settings. Clearing your browser's site data removes them and signs you out.

Cloudflare may set its own cookies when its part of the page loads.

What Firefly does not do

• No analytics, tracking pixels or advertising of any kind.
• No selling or renting of your information, to anyone.
• No showing your notes, courses or planner to anyone, including friends.
• No reading of your notes or messages by me as part of running Firefly.

How long it is kept

Your information is kept for as long as you have an account. There is no automatic deletion schedule yet.

• When you delete a chat message, its text is removed and only a record that a message was deleted remains.
• The technical generation log is kept after an account is deleted, with nothing left in it that links it to you.
• Invite requests are kept until I delete them by hand.
• Automated backups are not running at the moment. If they are switched on, this page will say how long copies are kept before they start.

Your rights

Under POPIA you can ask to see the personal information Firefly holds about you, ask for it to be corrected, object to how it is used, and ask for it to be deleted.

You can also take your data with you yourself. Download everything, on your profile page, gives you all of it: a complete JSON file and a readable Markdown one.

Deleting your account is done by email for now. Write to hello@studyfirefly.com from the address on your account, I will delete it by hand, and I will write back to tell you when it is done. Deleting your account removes your profile, studying, courses, notes, planner, friendships and messages.

If you are not happy with how your information has been handled, you can complain to the Information Regulator of South Africa at inforegulator.org.za. I would rather hear about it first, so I can fix it.

Age

Firefly is for people aged 18 and over. If you are under 18, please do not ask for an invite. If I learn that an account belongs to someone under 18, I will close it and delete what it holds.

Keeping it safe

Every account is approved by a person. The database checks every request against who is asking, so one person's notes cannot be read by another even if the app itself had a bug. Two-factor sign-in is available in your profile, and I recommend it.

Changes to this page

If this page changes in a way that affects you, you will get an email at the address on your account before the change takes effect, not after. The date at the top always shows when it last changed.