Privacy policy

What we store

• Email sign-up. Your email address and a hash of your password. We can't read the password itself.
• Google sign-in. Google gives us your email address, name, profile picture link and Google account ID. We use the email address and ID to sign you in, and we show the email address on your profile page. The name and picture link stay in your account record, and the app doesn't display or use them. We get no access to your Google password, contacts, files or anything else in your Google account.
• Your flashcards. The sets you make and how you organise them, plus languages, terms, translations, any images you upload, and the dates you created and changed them.
• Unfinished trainings. Your place in a training you haven't finished, including a copy of its cards and your answers so far, so you can continue later on any device. We delete it when you finish the training, start a new one or delete its set, so we don't keep your results.
• AI suggestion counts. How many word family suggestions you request each day, so we can apply a daily limit.
• Sign-in records. The time you signed in, and the IP address and browser details of each session. Our hosting providers may also keep standard request logs.

What stays in your browser

Cookies keep you signed in. We don't use advertising or analytics cookies, and the app has no analytics or tracking scripts.

Your browser also remembers your settings, such as sound and training options.

How we use your data

We use it to sign you in, show you your cards, and send the emails that confirm your address or reset your password. We send no marketing email. We don't sell your data or use it for advertising.

Our use of information from Google follows the Google API Services User Data Policy, including its Limited Use requirements. We use it only for sign-in, as described above.

Who else handles your data

Supabase runs our database, sign-in and image storage. Our hosting and email providers serve the website and deliver account emails. Google handles the sign-in if you choose it. OpenAI generates word family suggestions: when you ask for them, it receives that card's term, translation and languages, but not your name or email address. These providers may store data outside your country.

Nobody else receives your data unless the law requires us to hand it over.

Who can see your cards

Other users can't see your sets or cards. Images are different: anyone with an image's exact URL can open it without signing in. The URLs contain random IDs and other users can't list your images, but please don't upload a photo you need to keep private.

Deleting your data

We keep your data until you delete it. Deleting a card or set also removes its images. To remove everything, open your profile and choose Delete account, which erases your account and all its content, images included, straight away.

Copies in our providers' backups and logs expire on their own schedules, and a deleted image can stay in a browser or network cache for a while.

If you signed in with Google, you can also remove our access in your Google account settings. That stops future Google sign-ins but doesn't delete your Flashcards account.

Changes to this policy

If this policy changes, we'll publish the new version here and update the date at the top.

Contact

Questions about this policy or your data? Write to privacy@flashcards.nikitacodes.com.