Privacy Policy

1. What we collect

Statesis is built to keep your research data on your device. We collect the minimum needed to run the app's subscription and support features:

• Subscription entitlement status (Free / Student / Pro), managed by RevenueCat so the app knows what you've paid for. RevenueCat caches this on-device so the app keeps working offline.
• Purchase and billing information, handled entirely by Apple's StoreKit (App Store purchases) or, for institutional customers, Stripe. We never see or store your card details ourselves.
• Crash reports and performance data via Sentry, if you opt in. This is anonymised technical data (what crashed, not what was in your dataset).
• A one-time student verification email and passcode, if you use the Student plan. See Student verification below.

2. Your research data stays on your device

The datasets you import, the analyses you run, and the output you generate are processed locally by the app's built-in statistics engine. We do not upload your datasets to a server, and we do not have access to your research data. iCloud sync of your saved projects (Pro) uses Apple's iCloud infrastructure and your own iCloud account, not a Statesis-operated server.

3. Third-party services we use

• RevenueCat: subscription entitlement management across the App Store and direct billing.
• Apple StoreKit: in-app purchase processing.
• Stripe: billing for institutional (B2B) customers, Year 2 onward.
• Cloudflare Workers: processes the one-time student email verification and, for institutional customers, Stripe webhook events. Runs at the edge; does not store your dataset content.
• Resend: sends the one-time passcode email for student verification.
• Sentry: crash and performance monitoring, opt-in.

Each of these processes only the data described above, needed to provide that specific feature.

4. Student verification

To unlock the Student price, you enter your .edu email address. We send a one-time passcode to confirm it's a real institutional address, then store a verification token in your device's Keychain (synced via your own iCloud Keychain, not a Statesis server) for 12 months. We do not retain your email address beyond what's needed to send that one-time passcode.

5. Your rights

TODO: this section needs jurisdiction-specific language (GDPR for EU/UK users, CCPA for California users, etc.) added before launch, covering access, deletion, and portability requests.

6. Changes to this policy

If this policy changes in a way that materially affects how your data is handled, we'll update the date at the top of this page and, where required, notify you in the app.

7. Contact

Questions about this policy can be sent via our contact page. TODO: add a registered legal entity name and business address here before launch.