Pudding Back to Pudding

Privacy Policy

Last updated: 6 October 2026

Pudding is a study app. This page says what it knows about you, where that goes, and how you stay in control of it.

Who runs Pudding?

Pudding, in full "Pudding for Study", lives at pudding4study.app. It is made and run by one independent developer in Adelaide, South Australia: [[OWNER: legal name]], ABN [[OWNER: ABN if registered]]. On this page "we" and "us" mean that developer.

We aim to handle your information in line with the Australian Privacy Principles. Those are the rules in the Privacy Act 1988 about how personal information is collected, used, stored, corrected and shared. [[OWNER: confirm whether the Privacy Act small business exemption applies to you. This page is written as if it does not.]]

What do you collect about me?

  • Your account. If you make an account, we keep your email address. Your password is stored only as a salted PBKDF2 hash, so we cannot read it.
  • Your plan. Which plan you are on and your payment status.
  • Your study data. Cards, review history, drafts and settings. Before you sign in, this lives only in your browser's storage on your device. From 21 September 2026, once you sign in, it is stored on our server so it follows you between devices.
  • Not your files. The files you add (documents, slides, PDFs, text, photos) are opened in your browser and are never uploaded to our servers for storage. From 6 October 2026 the full text read from them stays on the device you added it on as well: the account backup holds the cards, questions, notes and progress made from a file, not the file or its text. Your profile picture also stays in your browser only.
  • Product analytics. Private events such as which screen you opened, for how long, errors, the build number and a random visitor id. Never the contents of a card, draft, note or recording, never anything you type, and never a recording of your screen.
  • Where you click, only if you turn it on. "Share where I click" in Settings, Your data, is off unless you switch it on. When it is on, we record where on each screen you click and how far you scroll, so broken buttons can be found. Text fields, and the text of your cards, notes, drafts and chats, are never recorded either way.
  • Feedback. Messages you choose to send us.

You can use Pudding without an account. In that case your study data stays in your browser.

Do you see my card details?

No. Payments are taken by Stripe, and Stripe holds the card details. Pudding never sees or stores card numbers. We only keep your plan and payment status, plus the payment and invoice records that tax law requires.

What happens to my lecture recordings?

Lecture audio recordings stay in your browser. They are not uploaded for storage.

[[OWNER: confirm and describe how audio is handled when live transcription is on. That covers the plan-based transcription that runs through Pudding's server and the browser's built-in speech engine, which may use the browser maker's servers.]]

What is sent to OpenAI?

Some features use a language model: answers, marking, generation, speech and transcription. When you use one, the text you give that feature (for example, parts of a file you asked it to build questions from, or a photo you asked it to read) is sent to OpenAI for processing. Pudding's server passes it on and does not keep it. OpenAI's own handling of it is set out in OpenAI's API data policies. It goes through Pudding's own server, not straight from your browser. Live transcription is the one exception: while you record with it switched on, the audio goes from your browser straight to OpenAI, using a key that Pudding's server issues for that session and that expires within a minute. If you do not use these features, nothing is sent to OpenAI.

Why do you use my information?

To run your account, keep your study data in step across your devices, take payment, run the features you ask for, fix problems, improve the app and answer your messages.

We do not sell personal information. Pudding has no advertising trackers and no third-party ad cookies.

Who else handles my information?

Pudding relies on these providers to work:

  • Vercel hosts the site.
  • Cloudflare Workers and D1 run the server and the database.
  • Google, Apple and Supabase provide optional ways to sign in. Their sign-in code is loaded from them (Supabase's from the jsDelivr code network) only when you press that button, and that provider then sees your visit under its own privacy policy. If you sign in with email and password, none of them is contacted.
  • Stripe takes payments.
  • OpenAI processes text for the model features.

Analytics events go to Pudding's own analytics service, not to an outside analytics company.

These providers may process your information outside Australia.

Does Pudding use cookies or trackers?

Pudding itself sets no cookies. It uses your browser's local storage instead, for these things only:

  • Your study data and settings, so the app works: subjects, cards, reviews, drafts, recordings, your theme and similar. This is the app itself; without it nothing could be saved.
  • Your sign-in, if you make an account, so you stay signed in on this device.
  • A random visitor id for the private usage counts described above. It is not your name or email and is not shared with any other company. You can switch the counts off in Settings, Your data, "Send usage counts". Off takes effect at once.
  • Where you click, only if you switch "Share where I click" on.

There are no advertising trackers, no third-party analytics and no ad cookies. If you use Google or Apple sign-in, or pay through Stripe, those companies may set their own cookies on their own pages, under their own policies. Clearing this site's data in your browser removes everything Pudding stored on the device.

How do I see, export, correct or delete my data?

  • Export. Go to Settings, Your data, and export everything as a file.
  • Reset. In the same place you can reset the profile held in your browser.
  • Delete. In Settings, Your data, you can delete your account and its server data. If you have an active Weekly plan, cancel it first. We keep payment and invoice records for as long as tax law requires.
  • Delete without the app. If you cannot reach Settings, for example because you lost access to your account, you can ask us to delete your account and its data: email __SZ_SUPPORT_EMAIL__. Write from the address on the account if you can, so we know the request is yours.
  • Email list. Every email from the list carries a link that removes you straight away, with no login.
  • Usage counts. These are tied to a random id, not to you, so we cannot find them by your name or email. Switching "Send usage counts" off stops them; clearing this site's data in your browser throws the id away.
  • Access or correction. To ask what we hold about you, or to have it corrected, you can email __SZ_SUPPORT_EMAIL__.

How long do you keep it?

Data in your browser stays until you reset it or clear your browser. Server data is removed when you delete your account, apart from the payment and invoice records that tax law requires us to keep.

[[OWNER: state how long you keep server data for inactive accounts, analytics events and feedback messages.]]

How old do I have to be?

Accounts are for people aged 16 and over. When you make an account we ask for your month and year of birth. We check it and do not keep it: nothing about your birth date is stored on our server. If the answer is under 16, no account is made, and that browser remembers only the month from which a new answer could be accepted. Pudding is not directed at children under 13 and we do not knowingly collect personal information from them. If you believe a child under 13 has given us personal information, email __SZ_SUPPORT_EMAIL__ and we will delete it. If you are under 16, please do not make an account. If you are 16 or 17, tell a parent or guardian that you are using Pudding, and ask them to read this page with you. The email list on the phone screen is separate and is only for people aged 18 and over. Every email we send to that list names who it is from, carries a one-click unsubscribe link that needs no login, and gives our postal address. Unsubscribing takes effect straight away.

What if I have a complaint?

Tell us first, so we can fix it. To do that, you can email __SZ_SUPPORT_EMAIL__. We will reply within [[OWNER: reply time, for example 30 days]].

If we do not resolve it, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Will this policy change?

It may, as Pudding changes. When it does, we will update the date at the top of this page.

How do I contact you?

For anything about privacy, you can email __SZ_SUPPORT_EMAIL__.