Skip to content
StudyMap

Docs/Privacy & Your Data

Privacy & Your Data

What StudyMap stores when you sign in: saved places, home location, calendar events, competition saves, and how it's protected.

StudentSuite Team · · 2 min read

The map, calendar, and competitions catalog are fully public and need no account. Signing in only unlocks a handful of private, per-user features - this page is what those store.

What's stored, and why
Supabase (Postgres) tables, one row per user per item

  • user_places

    Private places you've added for yourself - name, type, and coordinates.

    Never shown on the public map, only to you.

  • user_home

    One lat/lng, if you've set a home location (powers "Near me" sorting).

  • user_events

    Personal calendar events you've added on top of the public exam calendar.

  • competition_saves

    Which competitions you've saved - just a list of ids, nothing else.

  • user_profiles

    Graduation year and exam board, if you've set them.

    Used to tailor what the calendar and competitions catalog show you.

How it's protected
Row-level security, scoped per user

Every table above has row-level security enabled, with every policy scoped to auth.uid(). You can only ever read or write your own rows - not even a maintainer can query another user's saved places through the app's normal API surface.

Each table's user_id references your Supabase auth account with on delete cascade: if your account is deleted, every row above is removed with it automatically, nothing has to be cleaned up by hand.

Password resets
Attempts are rate-limited, not your email itself

Password-reset requests are throttled per email to stop abuse. What's stored for that is a one-way hash of the email address and a timestamp - never the address in plain text, and never the password or reset token itself.

Want your account and data gone?
No self-serve delete button yet - email works just as well

There's no in-app delete-account flow today. Open an issue on GitHub or reach the maintainer directly, and the account (and everything tied to it, per the cascade above) gets removed.

Ready to use what you just read?

Open the mapCheck the calendarBrowse competitions