Privacy policy

What we collect, why, and what you can do about it, in plain English.

Last updated 25 October 2026.

StudyDeeper is a small ministry. We collect as little as we can, we don’t sell or share your details for advertising, and we don’t use analytics or tracking cookies.

Who we are

The data controller for this website is Eric Louw, based in United States. For anything about your data, email contact@studydeeper.org.

What we collect, and why

Your account

When you sign up, we keep:

  • your name and email address;
  • your password, stored only as a scrambled one-way hash (we can’t read it);
  • your Google account id, if you sign in with Google;
  • when you joined and when you last signed in;
  • whether you gave money when you signed up (yes or no only);
  • whether and when you agreed to course emails;
  • which course episodes you’ve played, and when, so your progress follows you across devices (and, if you tick the box, so we can remind you where you left off);
  • any email addresses you used with us before, if you change yours, so we know the account is still yours.

We use these to run your account: to sign you in, show you the courses and keep your account secure. The lawful basis is contract: it’s what you asked for when you signed up. If an admin added your account for you, or it moved over from our old website, the basis is our legitimate interest in continuing the membership you already had.

If your account moved over from our old website, we sent you one email about the move and how to sign in, and we note that it was sent so nobody gets it twice.

While you’re signed in, your browser holds a session cookie. We keep only a scrambled copy of it, for up to 30 days. Sign-in links we email you work once and expire after 15 minutes.

Course emails

We email you about course updates and progress only if you tick the box when you sign up, or turn it on under Account. Course updates means new courses and changes to existing ones; progress means an occasional reminder about a course you’ve started.

The lawful basis is your consent. You can withdraw it at any time by unticking the box under Account, or by asking us. Sign-in links, notices about your account, and replies when you write to us are sent whether or not you tick it, because they’re part of running your account.

Paid sign-ups

If you give when you sign up, your account is created only after the payment goes through. Until then we hold your name, email, password hash and your answer to the email box, for at most a day. After a day the details are deleted, whether or not you finished.

The same goes for donations: if you’re signed in, or give with your account’s email, your account is marked as having given (yes or no only).

Your card details go straight from your browser to Stripe. They never reach our website, and we don’t keep amounts or receipts: those stay with Stripe, along with your name and email, so we can see who gave and Stripe can send your receipt.

Messages you send us

When you use the contact form or email us, we keep your name, email address, subject and message so we can answer you. If you were signed in, the message is linked to your account. The lawful basis is our legitimate interest in answering people who write to us. The message is also forwarded to our email inbox.

Security limits and logs

To stop people guessing passwords or flooding the site, we record failed sign-ins, sign-in links sent and contact messages sent, against the email address used, and refuse too many in a short time. These records are deleted after a day. The lawful basis is our legitimate interest in keeping the site and your account safe.

When an admin adds or removes an account, or changes someone’s role, we log the email address, the change and the date, so we know who did what.

We also keep a short log of what happens on your account: when you joined, gave, set or changed your password, or changed your email address, with the date. Admins use it to spot problems and to help if something goes wrong. If you delete your account, your entries go with it; we keep only a note, without your details, that an account was deleted.

Visiting the site

Our hosting provider, Cloudflare, handles every visit and sees your IP address and browser details in order to deliver the pages and block attacks. We don’t keep server logs of our own, and we don’t use analytics.

Who helps us run the site

These companies process data for us, only to provide their service:

  • Cloudflare: hosting, our database, and receiving email sent to our address.
  • Resend: sending our emails (sign-in links, email-change confirmations, contact messages).
  • Google (Gmail): the inbox where we read and answer your messages.
  • Stripe: card payments. Stripe is also a controller of your payment details in its own right, under Stripe’s privacy policy. Stripe’s card form loads on the Donate page, and in the sign-up form only when you choose an amount above Free; Stripe may set its own fraud-prevention cookies then.
  • YouTube (Google): our course videos. Nothing loads from YouTube until you click play; then the video plays from YouTube’s privacy-enhanced (youtube-nocookie.com) player, under Google’s privacy policy.
  • RefTagger (Faithlife): on article pages, turns Bible references into links that show the verse when you hover. Its script loads from Faithlife’s servers, which see your IP address and browser details, under Faithlife’s privacy policy.
  • Google sign-in, only if we offer “Continue with Google” and you choose it: Google tells us your name, email address and Google account id.

We don’t sell your data or share it with anyone else, unless the law requires us to.

International transfers

Cloudflare, Resend, Stripe and Google are based in the United States, and Cloudflare serves the site from data centres around the world, so your data may be processed outside the UK and the European Economic Area. These companies protect such transfers with the EU–US Data Privacy Framework (and its UK extension) and/or the European Commission’s Standard Contractual Clauses.

How long we keep it

  • Your account: until you delete it, or we remove it.
  • Sessions: up to 30 days, or until you log out or set a new password.
  • Sign-in links: deleted soon after they expire (15 minutes). Links to confirm a new email address expire after an hour.
  • Your previous email addresses: as long as your account exists.
  • Unfinished paid sign-ups: one day.
  • Security records (failed sign-ins and the like): one day.
  • Messages: until we’ve dealt with them, then one more year. Copies in our email inbox are tidied by hand.
  • Admin log and account activity log: one year.
  • The note that we sent you the email about our move: as long as your account exists.
  • Backups: our database provider keeps restore points for up to 30 days, after which deleted data is gone from them too.
  • Payments: kept by Stripe for as long as financial law requires.

Deleting your account deletes your sign-in details, sessions, sign-in links, messages, course progress, previous email addresses and account activity straight away.

Cookies and browser storage

We use only what the site needs to work, so there’s no cookie banner:

  • sd_session: keeps you signed in (30 days, can’t be read by page scripts).
  • sd_member and sd_admin: tell the page whether to show the member or admin menus. They grant nothing on their own.
  • Your browser’s local storage holds your light or dark theme, your course-player and Text Tool settings, and a copy of which episodes you’ve watched. The settings never leave your device; when you’re signed in, the episodes are also saved to your account, and the copy is cleared when you log out.

YouTube and Stripe may set their own cookies, but only after you play a video or choose to pay.

Your rights

Under the GDPR and UK GDPR you can:

  • see your data: Account → Download my data gives you a copy;
  • correct it: change your name under Account, or ask us to change your email;
  • delete it: Account → Delete my account;
  • withdraw consent to course emails: untick the box under Account;
  • object to what we do on the basis of legitimate interest, or ask us to restrict it;
  • take your data elsewhere: the download is a standard JSON file.

You can also do any of these by emailing contact@studydeeper.org. We’ll answer within a month. If you’re not happy with how we handle your data, you can complain to the data protection authority where you live (in the UK, the Information Commissioner’s Office), though we’d be glad to try to put it right first.

Children

StudyDeeper is meant for adults and families. If you’re under 16, please ask a parent or guardian before you sign up or agree to emails. If you think a child has signed up without that, contact us and we’ll delete the account.

Changes to this policy

If we change what we collect or how we use it, we’ll update this page and the date at the top. If the change is significant, we’ll also tell members by email.

Trailer