Your notes are yours

BlueSquareis a study workspace, run by a small team from Morocco at bluesquare.space. This policy covers the website, the app, and everything you do inside a workspace. Where it says "we", it means the team behind BlueSquare, and we are the data controller for the information described here.

It sits alongside our Terms of Service, which cover accounts, plans and billing.

We collect four things, and nothing beyond them:

• Account details from Google sign-in — your name, email address and profile picture, stored so we can show you your account and keep you signed in. We never see your Google password.
• Workspace content you create — your pages, the questions you ask, the quizzes and flashcard decks generated from them, and the email addresses of people you invite.
• Billing details for paid plans — which plan a workspace is on and the status of its subscription. Card numbers are entered with Paddle and never reach our servers.
• Usage data — pages viewed, features used, how many AI generations a workspace has run, and basic technical information such as browser type and the approximate location behind your IP address.

We use cookies and browser storage to:

• Keep you signed in and protect your session
• Remember preferences, such as the workspace you last opened
• Measure which parts of the product get used

There are no advertising cookies and we do not sell your data to anyone. You can clear or block cookies in your browser settings, but signing in will stop working without the session cookie.

Your data is used to:

• Run and maintain the service, and keep you signed in
• Generate the answers, quizzes and flashcard decks you ask for
• Enforce plan limits and the monthly generation allowance
• Process payments, renewals and refunds through Paddle
• Answer your support emails
• Spot abuse, fraud and technical faults
• Improve features, based on aggregate usage rather than the contents of your notes

Under the GDPR our legal bases are: performance of our contract with you, for running your account and your plan; legitimate interests, for security and product improvement; and legal obligation, for tax and accounting records.

To answer a question or build a quiz or deck, we send the relevant pages from your workspace to a large language model provider — currently Google, and OpenAI where a workspace is configured to use it. This happens only when you ask for it, and only the material needed for that request is sent.

We do not use your notes to train models, and we do not grant providers permission to train on them. While a provider is processing a request, it also handles that material under its own terms.

We keep the list of processors short, and each one only receives what it needs:

• Supabase — hosts our database and handles authentication. Your account and your workspace content live here.
• Google — powers sign-in, and the Gemini models behind the AI features.
• OpenAI — an alternative model provider, used when a workspace runs on it.
• Paddle — merchant of record for paid plans, handling checkout, payment, tax and invoices.
• PostHog — product analytics: page views and feature usage, not the contents of your notes.

Your account and workspace content are held in our Supabase database, behind access rules that make you and the people you invite into a workspace the only ones who can read it.

Some of these providers process data outside your own country, including in the United States. Where that happens, the transfer is covered by standard contractual clauses or an equivalent safeguard in that provider’s terms.

A workspace is shared by design. Anyone you invite can read and edit every page in it, and can see the quizzes and decks generated from those pages. Removing someone from Collab ends their access. Treat a workspace as visible to everyone in it, and keep anything private out of it.

Wherever you live, you can ask us to:

• Give you a copy of your data
• Correct anything that is wrong
• Delete your account and everything in it
• Export the content you have written
• Restrict or object to certain processing
• Withdraw consent, where we relied on it

Email hello@bluesquare.space and we will deal with it within 30 days, free of charge. If you are in the EU or the UK and you are unhappy with how we handled it, you can complain to your local data protection authority. If you are in California, we do not sell or share personal information and never have.

You can delete a workspace at any time from its settings, which removes its pages, quizzes and decks. To delete your account and everything attached to it, email us and we will do it. Deletion is permanent — we cannot bring the content back afterwards.

If a workspace is on a paid plan, cancel that subscription first. Billing runs through Paddle and does not stop on its own.

We keep your content for as long as your account exists. Once a workspace or an account is deleted, its content goes with it, and backups holding a copy roll off within 30 days. Records of payments are kept for as long as tax law requires, which is typically several years.

Data is encrypted in transit, database access is restricted by row-level rules tied to your account, and administrative keys are held server-side only. No system is perfect, so if a breach ever affects your data we will tell you, and the relevant authority, without undue delay.

You need to be at least 16 to hold an account, and at least 18 to buy a paid plan. If you believe someone under 16 has an account with us, email us and we will remove it.

We may update this policy as the product changes. The date at the top always tells you when it last moved, and anything significant will be announced in the app or by email.

For anything about your data — a copy, a correction, or a deletion — write to us at hello@bluesquare.space.