Privacy Policy

Last updated: 8 October 2026

We take your privacy seriously. This policy explains what data we collect, why we collect it, and how it is used and protected.

1. Who we are

Sirius Study is an IB Physics revision platform operated by Sirius Study ApS, a Denmark registered company (CVR no. 46715187). Our platform is designed to help International Baccalaureate students understand Physics theory and prepare for their examinations. We are committed to protecting your privacy and handling your data responsibly, particularly because many of our users are students.

Our registered address is Skovgårdsvej 36, st., 2920 Charlottenlund, Denmark. If you have any questions about this policy, please contact us at [email protected].

2. Information we collect

We collect information you provide directly to us when you create an account, complete onboarding, or contact us for support.

Account information: your name and email address. Sign-in is handled by Clerk, our authentication provider. If you sign in with a password, Clerk stores it as a secure hash; we never see or store your password.

Contact information: when you use our contact form, your email address and message are transmitted through Amazon Simple Email Service (AWS SES) and delivered to our support mailbox. We do not store contact submissions in the Sirius Study application database.

Onboarding information: your IB year, exam session, Physics level (SL or HL), and self-reported confidence level. This information is used solely to personalise your course experience.

Usage information: which lessons you have watched, quiz results, and progress through the course. This data is stored to maintain your progress across sessions and devices.

Payment information: if you buy Plus, payment is processed by Stripe. We keep a record of each purchase: the package, amount, currency, billing country, payment status and the date your Plus access ends. Your card details are held exclusively by Stripe and are never transmitted to or stored on our servers.

Marketing attribution: if you reach sign-up through a button on our website, we record which button you clicked, which plan it offered, and the campaign (UTM) parameters of the link that brought you to our website. These are stored with your account when you sign up.

Product analytics: we record a small number of events linked to your account: signing up, completing onboarding, starting a checkout, and completing or refunding a purchase. Each event carries the relevant details, such as your IB year, level and exam session when you finish onboarding, or the package, price, discount and billing country of a purchase.

Page views: while you are signed in to the Sirius Study app, we record each page you open: the page address, the address of the page you came from, the time, and whether you are using a phone, tablet or computer (worked out from your screen width). Each page view is stored with your account identifier in our own database on AWS. Your browser also sends its user agent, which we do not store. Page views are not sent to PostHog or any other analytics provider.

3. How we use your information

We use the information we collect to provide, maintain, and improve the Sirius Study platform.

Specifically, we use your information to: maintain your course progress and lesson completion state; personalise your experience by showing the correct SL or HL content; send you important account and service communications; respond to your support requests; measure and improve how well signing up and buying Plus work, using the marketing attribution and product analytics described above, which are linked to your account.

Our legal basis for marketing attribution and product analytics is our legitimate interest in understanding which of our marketing reaches students and where people give up while signing up or buying, so we can fix it (GDPR Article 6(1)(f)). While your account exists, these events are recorded when you sign up, finish onboarding, start a checkout, or complete or refund a purchase. You have the right to object to this at any time by emailing [email protected]; we will then delete the analytics data linked to your account in PostHog. When your account is deleted, we delete your PostHog analytics profile and its events.

Our legal basis for recording page views is our legitimate interest in understanding how the app is used, so we can improve it and diagnose problems (GDPR Article 6(1)(f)). Page views are visible only to our team, in an internal dashboard.

We do not use your personal information to build advertising profiles, sell your data to third parties, or send unsolicited marketing communications.

4. Data storage and security

Our application data is stored on Amazon Web Services (AWS) servers in Frankfurt, Germany, within the European Economic Area. We use industry-standard security measures including HTTPS encryption for all data in transit and regular security reviews of our infrastructure.

We share personal data only with the service providers we need to run Sirius Study, each acting on our instructions: Clerk (sign-in and account management), Stripe (payments), Amazon Web Services (hosting, and email delivery through AWS SES), Sentry (error monitoring, including recordings of a sample of browsing sessions that help us find and fix bugs) and PostHog (product analytics, hosted in its EU cloud in Frankfurt, Germany). Clerk and Stripe may process your data outside the European Economic Area, including in the United States, and PostHog, a US company, may access analytics data from outside the European Economic Area, for example to provide support. Where they do, the transfer is protected by safeguards recognised under the GDPR, such as the EU–US Data Privacy Framework or the EU Standard Contractual Clauses.

Course progress data is also stored locally in your browser (localStorage) to ensure the platform continues to work smoothly even in low-connectivity situations. You can clear this local data at any time by clearing your browser storage.

5. Cookies

We use only essential cookies required for the platform to function — specifically, session cookies to keep you logged in between page loads. We do not use advertising cookies, tracking pixels, or any third-party analytics cookies.

Our marketing website measures visits and button clicks without cookies and without storing anything on your device. To tell visits apart, PostHog combines your IP address and browser details with a salt that changes every day and hashes them on its servers; your IP address is not stored. The Sirius Study app itself loads no third-party analytics scripts: the product analytics events described in section 2 are sent from our servers, and page views are sent only to our own servers.

You can control cookie behaviour through your browser settings, though disabling essential cookies will prevent you from staying logged in.

6. Your rights

Under the EU General Data Protection Regulation (GDPR) and the Danish Data Protection Act (databeskyttelsesloven), you have the right to access the personal data we hold about you; to request correction of inaccurate data; to request deletion of your account and associated data; to receive a copy of your data in a portable format; to object to processing of your data in certain circumstances.

To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days.

When your account is deleted, we also delete the analytics data linked to it that is held by PostHog, including your analytics profile and the events recorded for your account.

If you believe we have processed your personal data unlawfully, you have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet), www.datatilsynet.dk.

7. Retention

We retain your account information for as long as your account is active. If you delete your account, we will remove your personal data within 30 days, with two exceptions: financial records, which we are required to retain for 5 years from the end of the financial year under the Danish Bookkeeping Act (bogføringsloven); and individual page views, which are not deleted early and expire on their normal 90-day schedule described below.

Individual page views are deleted automatically 90 days after they are recorded. Daily totals per page (number of views, number of distinct visitors and device type, with no personal identifiers) are deleted automatically after about 13 months.

Anonymised, aggregated usage data (with no personal identifiers) may be retained indefinitely for platform improvement purposes.

8. Changes to this policy

We may update this Privacy Policy from time to time. If we make significant changes, we will notify you by email and display a notice in the platform at least 14 days before the changes take effect. The date of the most recent update is shown at the top of this page.

Questions about this policy? Email us at [email protected]