Privacy Policy

Who we are

Deep Sesh (“we”, “us”) runs the website at deepsesh.io and the Deep Sesh apps for iOS and Android. This policy explains what information we collect, why, and who processes it. If you have a question about it, email support@deepsesh.io.

Using Deep Sesh without an account

The timer, flashcards and grades work without signing in. When you use them that way, your settings and what you create are saved in your browser’s local storage on your device, not on our servers.

Information in your account

When you create an account, we store:

• Your email address.
• Profile details Google or Apple share when you sign in with them, such as your name and email address, which Supabase stores with your account. From Google, this includes a link to your Google profile picture. Apple may give us a private relay address instead of your own.
• If you sign in with Apple in the mobile app, a token from Apple. We keep it only so we can ask Apple to revoke Deep Sesh’s access when you delete your account.
• Your study data: focus sessions (the technique, start and end times and length), flashcards, grades, classes, and planner tasks and events with their titles, notes, descriptions and dates.
• Custom music tracks (a name and a YouTube video ID) and custom themes (a name and the background image you upload).
• Scanned pages and the PDFs you make from them.
• Your subscription status: which store or service you subscribed through, the product, when it renews or ends, the customer and subscription IDs from that provider, and the latest event it sent us.
• Billing event records: one for each payment or subscription event Stripe or RevenueCat sends us, containing what the provider sent.

How scanning works

Scanning pages into a PDF is available when you are signed in.

On deepsesh.io, each page photo you take or choose is first uploaded to temporary storage with your account. Our servers then find the edges of the page, straighten it, store the straightened page temporarily with your account and remove the original photo. Original photos you skip before they are straightened, pages you remove before the PDF is built, and pages from a scan you don’t finish stay stored until you delete your account.

In the iOS and Android apps, your phone finds the edges of each page and straightens it. On iOS this uses the scanner built into iOS. On Android it uses Google’s document scanner, which Google Play services downloads to your phone the first time you scan. The photos you take or choose and the straightened pages stay on your phone until you save the PDF, and a scan you haven’t saved stays on your phone until you save it or discard it, or until you sign out on that phone and confirm that it may be lost. If you are signed out in another way, for example by signing out on the website, the scan waits on that phone for your next sign-in. When you save, the straightened pages are uploaded to temporary storage with your account, and the words found on them are sent to our servers, which use them to make the PDF searchable. If saving stops part-way, the pages already uploaded stay there until you save or discard that scan, or delete your account. If your phone is offline when you discard the scan or sign out, they are removed the next time the app is online and signed in to your account.

In both cases the PDF is built on our servers and stored with your account, and the temporary page images are removed once it is built. A PDF you open in the app, or have just saved there, is also kept on your phone so that it opens without a connection. That copy is removed when you delete the PDF in the app or sign out there. If you delete the PDF on the website or on another device, the copy is removed the next time the app loads your list of PDFs.

Text recognition, which makes your PDF searchable, runs on your own device. On deepsesh.io it runs in your browser, which downloads the recognition engine and its English language files from the jsDelivr content delivery network. In the iOS app it uses the text recognition built into iOS. In the Android app it uses Google’s ML Kit. Your page images are not sent anywhere for text recognition. On Android, Google’s scanner and ML Kit send Google information about your device, the app and how the feature performed, such as the device model, the operating system version and error codes.

Focus rooms

When you join a focus room while signed in, other people in the same room see a display name taken from the part of your email address before the @. For example, alex@example.com appears as alex. The display name can’t be changed. Each person in a room is identified by their account ID, so the browsers of other people in the same room also receive your account ID along with your display name.

Payments

Pro bought on deepsesh.io goes through Stripe checkout. Stripe handles your payment details, and we never see your full card number. When you open checkout, we create a Stripe customer record with your email address and account ID.

Pro bought in the iOS or Android app is processed by Apple or Google. RevenueCat receives App Store and Google Play purchase information, and we send it the details of your web subscription, so one Pro status works everywhere. RevenueCat identifies you by your account ID. The RevenueCat SDK in the mobile apps also sends RevenueCat details about your device and the app, such as the device model, operating system and app version, and your language settings. On iOS this also includes your App Store country and a device identifier Apple provides to the app.

Analytics and embedded content

Vercel Web Analytics and Speed Insights measure page views and page performance on the website.

Microsoft Clarity, when enabled, records how pages are used, such as clicks and scrolling, and uses cookies.

Music plays through YouTube’s privacy-enhanced embeds. When music plays, YouTube, a Google service, receives your IP address and may store data on your device.

The mobile apps contain no analytics or advertising SDKs of our own. On Android, Google’s scanner and ML Kit send Google the information described under How scanning works.

Cookies and local storage

• Sign-in cookies keep you signed in on the website.
• Local storage in your browser holds your preferences and the data you create without an account.
• In the mobile apps, your sign-in session and Pro status are kept in your device’s secure storage.
• Microsoft Clarity, when enabled, and YouTube may set cookies, as described above.
• We use no advertising cookies.

Service providers

These services process information for us to run Deep Sesh:

• Supabase: sign-in, database, file storage, focus rooms and server functions.
• Vercel: website hosting and website analytics.
• Stripe: payments on the website.
• RevenueCat: subscription status for App Store, Google Play and web purchases.
• Apple and Google: sign-in, and App Store and Google Play billing.
• Google: the document scanner and text recognition in the Android app.
• Resend: sends sign-in emails.
• Microsoft Clarity, when enabled: website usage recording.
• YouTube: music playback.
• jsDelivr: delivers the text recognition engine files.

Your information may be processed in countries other than yours.

How we use information

We use your information to run Deep Sesh and sync it across your devices, process payments and your Pro status, answer your support requests, understand and improve how Deep Sesh is used, and keep the service secure. We do not sell your personal information and do not use it for advertising.

How long we keep it

We keep your account information and study data until you delete them or delete your account. Billing records, records held by payment providers, and provider logs are kept as described on our delete your account page.

Your choices and rights

You can delete individual items in Deep Sesh at any time, or delete your account. To access, correct or export your data, email support@deepsesh.io.

Depending on where you live, you may have further rights over your data. We answer privacy requests within 30 days.

Security

Information travels to and from Deep Sesh over HTTPS. Database rules limit each account’s data to that account. Payment details are handled by Stripe, Apple and Google, not by us.

Children

Deep Sesh is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has given us personal information, email support@deepsesh.io and we will delete it.

Changes to this policy

When we change this policy, we update the date at the top of this page.

Contact

Email support@deepsesh.io with any question about your privacy. See also our Terms of Use and how to delete your account.