Privacy policy

Last updated 6 November 2026

1. Who we are

Nerdy is an open-source study planner for Windows. This policy covers the Nerdy desktop app, the Nerdy online service it signs in to and syncs with, and this website.

Nerdy is run by Nicholic, who is responsible for your personal data (the "controller" under data-protection laws such as the GDPR). "We" and "us" in this policy mean Nicholic. You can reach us at mail@nicholic.com.

Anyone can run their own copy of Nerdy with their own server, because the source code is public. If you use a copy that connects to someone else's server, that person is responsible for your data there, and this policy doesn't apply to it.

2. What we collect

Your account

• Email address and display name.
• Password, if you create one. It is stored only as a one-way hash, so nobody, including us, can read it.
• Role (student, teacher, researcher or lifelong learner), whether you've confirmed your email and finished setup, and when you joined.
• Failed sign-in attempts, to lock an account for 5 minutes after 5 wrong passwords.

If you sign in with Microsoft or Google, they tell us your name, your email address and an ID for your account with them. For Microsoft accounts we use your account's sign-in name as your email. We don't get your Microsoft or Google password, and we don't receive or keep your profile picture, contacts, files or mail.

To suggest a role during setup, the server looks at the part of your email after the "@" (for example, a university domain suggests Student). This guess isn't stored, nothing is looked up elsewhere, and you choose the role yourself.

What you put into Nerdy

This is copied to the server so it syncs to every PC where you sign in:

• Topics and subtopics, your progress, and what's due.
• Calendar events and study blocks: title, details or location, times, repeats, reminders and whether a focus session starts automatically.
• Reminders: title, due date, notes, starred and done.
• Notes: text, formatting and checklists, including quick notes you jot down during a focus session.
• Focus sessions: the task, topic, mode, planned and actual time, when it started and ended, and how it ended. If you leave an Ultra-Focus session early, the reason you picked (including medical or family emergencies) and any explanation you typed are kept in your focus history.
• Settings: appearance, study hours, notification choices, the AI exit review switch, the websites you allow during focus, and the apps you allow during focus. For each allowed app this includes where the program is installed on your PC, and that file location can contain your Windows user name.

Classes

If you create or join a class: the class name, subject, colour and join code; who is in it and since when; assignments (title, description, due date); and who has completed each one. Whether you share your focus progress with the class is your choice (see Who can see it).

Technical data

• Sign-in tokens that keep you signed in. The server stores only a fingerprint (hash) of each one. They expire after 30 days.
• Service logs. Our hosting provider records requests to the service, errors and timings. That includes the address requested and an approximate location (city, region and country) worked out from your IP address. Your IP address itself is not stored in these logs. Some entries contain your account ID.
• Your IP address is used for a moment to limit how often sign-in can be tried from one place. It isn't saved.

We don't collect advertising IDs, contacts, location from your device, or anything about your other apps beyond what's described in the next section.

3. What stays on your PC

The app keeps its files in %LOCALAPPDATA%\Nerdy on your PC:

• A copy of your planner, so it works offline. This file is protected by your Windows account but isn't encrypted on its own, so anyone who can sign in to your Windows account can read it.
• Your sign-in tokens, encrypted with Windows so only your Windows account can use them.
• Log files with your account ID, the names of apps closed during focus sessions, and error details. They're deleted after 14 days and never uploaded. If you report a problem and choose to attach them, you decide what to send us.

Focus mode. To hide or close apps you didn't allow, Nerdy looks at the windows that are open: which program each belongs to, where it's installed and its window title. This happens in memory while a session runs, and isn't saved or sent anywhere. To add an allowed app, Nerdy lists the shortcuts in your Start menu.

What Nerdy never does. Nerdy doesn't record your keystrokes, screen, camera, microphone, browsing history or network traffic. To decide whether to start a scheduled session automatically, it checks only how long it has been since you last used the keyboard or mouse and whether your PC is locked.

4. How we use it

Where the law asks for a reason (a "legal basis"), it's given in brackets.

• To run Nerdy for you: your account, syncing, classes, reminders and focus sessions (to provide the service you signed up for).
• To send account emails: confirming your email address and resetting your password. These are the only emails Nerdy sends. There's no newsletter or marketing (to provide the service).
• To review early Ultra-Focus exits, described in the next section (to provide the service you chose; you can switch it off).
• To keep Nerdy secure and working: logs, sign-in limits and account lockouts (our legitimate interest in protecting the service and your account).
• To meet legal obligations, when a law requires it.

We don't sell or rent your data, show ads, build marketing profiles, or use your data to train AI models.

5. AI exit review

Ultra-Focus is designed to be hard to leave. When you ask to leave early and pick Urgent school or work matter or Something else, Nerdy asks Claude, an AI made by Anthropic, whether it can reasonably wait until the session ends. Nerdy tells you before you type that Claude will read your explanation.

• What is sent: the reason category, your explanation (up to 1,000 characters), the session's task name and the minutes left and planned.
• What is never sent: your name, email, account ID, notes or anything else in your planner. Medical or safety and Family emergencies are never sent and always let you out straight away.
• The answer is a suggestion to stay or go, with a short message. It isn't stored. If the review fails or takes too long, you're let out. You can always leave by choosing an emergency reason.
• At Anthropic: under Anthropic's commercial terms the request isn't used to train their models. Anthropic deletes it within 30 days, unless its automated safety systems flag it as breaking its usage policy (then up to 2 years) or the law requires keeping it. See Anthropic's Privacy Center.
• Turning it off: the review is on by default. Turn it off in Settings → Focus. When it's off, nothing is sent and early exits aren't reviewed.

Your explanation is kept in your own focus history only if you actually leave the session (see What we collect).

6. Who can see it

Teachers in your classes

When you join a class, its owner can see your display name, email address, when you joined, and how many of the class's assignments you've completed.

Your focus progress is shared only if you turn on sharing for that class. It's off until you do. When it's on, the teacher sees your focus minutes, number of sessions, the share finished as planned, and minutes per day, counting only sessions from the moment you turned sharing on. If you turn it off and on again, it starts over. They never see your tasks, notes, topics or exit reasons. You can turn sharing off at any time.

Other students in a class don't see your email address.

Service providers

These companies process data for us under their own data-protection terms:

If you sign in with Microsoft or Google, they also know you've signed in to Nerdy, under their own privacy policies.

Legal requests

We'll disclose data only when a valid law or court order requires it, and we'll tell you unless we're legally not allowed to.

7. Where it is stored

The Nerdy service and its database run in Microsoft Azure's Southeast Asia region in Singapore. Account emails are processed in Azure's Asia Pacific region. AI exit reviews are processed by Anthropic in the United States.

So your data may be handled in countries other than your own. Where the law requires safeguards for this, we rely on our providers' data-protection terms, which include the European Commission's Standard Contractual Clauses.

8. How long we keep it

9. Your choices and rights

In the app

• Edit or delete anything you've added.
• Turn the AI exit review off in Settings → Focus.
• Turn class focus sharing on or off on the class's page.
• Delete your account in Settings → Account → Delete account. This removes your account and all its data from the server, including classes you own along with their assignments and members' completions, and Nerdy's copy on that PC.

By email

Depending on where you live, you may have the right to:

• get a copy of your data;
• correct it, for example to change your email address;
• delete it;
• unlink a Microsoft or Google sign-in;
• object to or restrict how we use it;
• take your data elsewhere.

Email mail@nicholic.com from the address on your account. Some of these can't be done in the app yet, but we'll handle them for you. We'll reply within 30 days. We may ask you to confirm the request comes from you.

You can also complain to the data-protection authority where you live, for example the Personal Data Protection Commissioner in Malaysia or your national authority in the EU or UK. We'd appreciate the chance to sort it out with you first.

10. Security

• All connections to the Nerdy service use HTTPS.
• Passwords and sign-in tokens are stored only as hashes.
• The database accepts only Microsoft Entra identities, with no shared database passwords.
• Service secrets are kept in Azure Key Vault, and the service signs in to Anthropic without a stored key.
• On your PC, your sign-in tokens are encrypted by Windows.

No system is perfectly secure. If a breach affects your data, we'll tell you and the authorities as the law requires.

11. Children and teenagers

• 18 and over: you can use Nerdy on your own.
• Under 18: you need permission from a parent or guardian, who agrees to this policy for you.
• Under 13, or under the age of digital consent where you live: a parent or guardian must give consent before you use Nerdy.

If we learn that a child under 13 is using Nerdy without a parent's or guardian's consent, we'll delete the account.

Parents and guardians can email us to see, correct or delete their child's data.

12. Cookies

• This website uses no cookies, analytics or outside fonts.
• Microsoft or Google sign-in: the Nerdy service sets one encrypted cookie that lasts at most 10 minutes and is removed as soon as sign-in finishes. The sign-in system also sets a few short-lived security cookies.
• Nerdy uses no tracking or advertising cookies anywhere.

13. Changes to this policy

When this policy changes, we'll update the date at the top. For important changes, we'll email you before they apply.

Every earlier version is kept in the project's history on GitHub.

14. Contact

Questions or requests about your data: mail@nicholic.com.