Privacy Policy
Last updated: 23 August 2026
This policy covers the Buaic app and this website. It describes what we actually collect, why, and what you can do about it. There's a shorter version in plain English on the students' privacy page — it says the same things in about a page.
Who we are
Buaic is an independent app based in Ireland. It isn't a company — one person is the data controller, so if something goes wrong with your data it's one person's responsibility, and they're reachable at:
Apple's App Store listing displays the trader contact information required for customers in the European Union. You can also make a formal data request by email.
Buaic is for people aged 16 and over
The digital age of consent in Ireland is 16, under section 31 of the Data Protection Act 2018. Buaic is built for Leaving Cert students, and you must be at least 16 to create an account.
If you're under 16, don't create an account. If we learn that an account belongs to someone under 16, we delete it and the data attached to it.
What we collect
If you use Buaic without signing up
You can use Buaic as a guest. A guest account is a random identifier — there's no email address or name unless you add one in the app. Your subjects, progress, streak and XP are stored against that identifier so the app remembers where you were.
If you create an account
You can sign in with a secure email link. Apple and Google sign-in are not currently available.
- Email link — we store your email address so we can send a sign-in link and restore your account.
We do not use passwords, so Buaic never receives or stores one.
What the app stores about your studying
| What | Why |
|---|---|
| Subjects and levels you pick | To build and show your study plan |
| Which lesson checkpoints you've completed | To unlock the next one and show progress |
| Your answers to questions | To mark them and to work out what you've mastered |
| XP totals | To show progress and rank the leaderboard |
| Streak count, last active day, whether a streak freeze is available | To run the streak |
| Whether you have premium access | To unlock premium features |
Weekly commitments and Apple Calendar
If you add regular commitments, they are stored on your device to help your plan avoid those times. If you choose to connect Apple Calendar, Buaic reads busy times on your device only to make the same suggestion. If you explicitly choose Add study session to Calendar, Buaic creates that one clearly labelled study event; it never changes your own events. We do not upload or store event names, calendar details, or event records. You can disconnect Apple Calendar in Settings → Weekly commitments, or revoke access in iOS Settings.
Profile and friends
If you use the friends feature, we also store a display name, and optionally your county and school. These appear to other users — your display name is searchable by anyone using the app, and your county shows next to it. Don't put anything in your display name you wouldn't want another student to see.
Contact matching works without us seeing your contacts. If you let Buaic check which of your contacts already use the app, your phone converts each email address into a SHA-256 digest — a fixed-length scramble — and sends only the digests. We compare them against digests of our users' addresses. The contact details themselves never leave your phone, and we can't reverse a digest back into an address. We don't store the digests you send; they're used for the lookup and discarded.
We do store a digest of your own email address, so other people can find you the same way. If that's not something you want, delete your account.
Analytics
We use PostHog to understand how the app is used — which screens people reach, where onboarding loses them, whether the paywall works. It records events like "lesson started", "question answered", "paywall viewed", along with your user ID once you've signed in.
PostHog is configured on its EU hosting (eu.i.posthog.com), so this data
stays in the European Union.
We do not use advertising SDKs, we do not track you across other apps or websites, and we do not show ads. There is no Facebook SDK, no ad network and no data broker in Buaic.
Turning it off: open Settings → Share usage data in the app and switch it off. Nothing further is sent from your phone — the events aren't collected and then discarded, they're never collected. You can turn it back on in the same place, and you can still object by emailing privacy@buaic.app (see Your rights below) if you'd rather we removed what was already recorded.
Payments
Monthly and annual subscriptions are sold through Apple's App Store. Apple handles payment details; Buaic never receives your card number. RevenueCat processes the Apple transaction identifier, product purchased, purchase and expiry dates, refund or cancellation status, price and currency, and your Buaic user ID so Premium can follow your account across devices. Buaic stores only the resulting entitlement status and expiry date in your profile.
This website
This site is hosted by Vercel. Like any web host, it records requests — IP address, browser type, page requested — in server logs for security and troubleshooting. There are no analytics, no cookies and no trackers on this website.
Why we're allowed to use it — legal bases
Under Article 6 of the GDPR:
- Performing our contract with you — your account, subjects, progress, streak, XP, subscription processing and premium-access status. Without these the app can't do what you installed or paid for it to do.
- Consent — access to your phone's contacts. iOS asks you, and you can say no or change your mind in Settings. Saying no only disables contact matching.
- Our legitimate interests — analytics, to make the app work better, and basic security and abuse prevention. We've weighed this against your privacy: the data stays in the EU, it isn't sold or shared for advertising, and you can object.
Who else touches your data
| Who | What they do | Where |
|---|---|---|
| Supabase | Database and sign-in | Ireland (eu-west-1) |
| PostHog | Product analytics | European Union |
| Apple | App distribution | Per Apple's policy |
| RevenueCat | Subscription validation and entitlement management | Per RevenueCat's policy and subprocessors |
| Vercel | Hosting for this website | Global edge network |
These are processors acting on our instructions, except Apple, which is an independent controller for App Store distribution.
We do not sell your data. Not to advertisers, not to schools, not to anyone.
Who can see your information
- Other students see your display name, county and XP if you use friends or the leaderboard. They do not see your email, your school unless you set it, your answers, or which questions you got wrong.
- Your school and your teachers get nothing. Buaic has no school dashboard and no teacher accounts. If your school gave you a code for premium access, we tell them how many codes were redeemed, not who redeemed them or how anyone did.
- Your parents get nothing, unless you show them yourself.
How long we keep it
- Guest accounts and their study data — until you delete them or 24 months after they were created, whichever comes first. Guest accounts have no recovery email.
- Email accounts and their study data — until you delete the account.
- Analytics events — 12 months, then deleted.
- Subscription entitlement records — while the account exists, and afterward only where needed for accounting, fraud prevention, disputes, or another legal obligation. Apple and RevenueCat retain their own transaction records under their respective policies.
- Support emails — 24 months after the conversation ends.
Your rights
Under the GDPR you can ask us to:
- Give you a copy of what we hold about you
- Correct anything wrong
- Delete your account and data — use the deletion page, no login needed. Once we've confirmed the request is really from you, we delete your account and study data within 30 days and email you when it's done
- Restrict or object to processing, including analytics — for analytics you can do it yourself in Settings → Share usage data, no email required
- Port your data to another service in a machine-readable format
- Withdraw consent for contacts access at any time, in iOS Settings
Email privacy@buaic.app. We'll reply within one month. We won't charge you and we won't ask why.
If you're not happy with how we've handled it, you can complain to the Irish supervisory authority:
Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963 — dataprotection.ie
Security
Access to your data is restricted at the database level, so the app can only ever read and write rows belonging to the signed-in user. Some fields are deliberately locked down further — your premium-access status and your email digest can't be written by the app at all, only by the server, so nobody can promote themselves to premium or claim another student's identity.
No system is perfect. If you find a security problem, email privacy@buaic.app and we'll take it seriously.
Changes
If we change this policy in a way that matters, we'll tell you in the app before it takes effect. The date at the top always reflects the current version.