Privacy notice

The app

• Your progress (which words you've studied, your answers, your review dates, your picture picks) is stored on your phone. It is not uploaded. You can export it to a file and restore from that file; that's the backup.
• An activity mailbox. With your consent, the app sends anonymous study events (word studied, test result, session length) to our server so we can see whether the method works. No name, no email, no device identifier that could be joined to you. You can switch this off in the app at any time and nothing else changes.
• Pairing. If you connect your phone to a community account with a pairing code, your picture picks are counted as your votes, and your plan's limits follow you. Unpairing from the site stops that at once.
• Word pack updates are fetched from our content host. The request carries no personal data.
• The app has no advertising, no third-party analytics, and no voice interface. It plays audio; it never records.

The community site

• Your name is the handle you chose. It appears next to everything you do: votes counts are public, comments, submissions and badges are public under it.
• Your email, if you add one, is used for sign-in links and for notifications about your own pictures (released, chosen, refused, removed). It's never shown to other members and never used for marketing. Sign-in email is sent through Resend.
• A session cookie keeps you signed in. It holds your account id and a signature, nothing else. No tracking cookies.
• Votes, reports and comments are stored with your account and used to compute reputation, credits and standing, by the rules in the reputation guide. Reports also show the moderators who filed them.
• Pictures you submit are stored on our servers and, once released, shown publicly. Every picture is checked before release, by an automated safety service or by a moderator; the service receives the picture and nothing about you.
• Payments go through Stripe. Stripe receives your card details; we receive a customer reference, the plan, and payment events. We never see the card.
• Server logs hold request lines with IP addresses, for keeping the service running and spotting abuse. Rate limits are keyed on IP.

Where it lives

Community data is in a managed Postgres database (Supabase). Pictures are on our own server and, once chosen, on a content host (Cloudflare R2) that phones download from. Email through Resend, payments through Stripe, safety checks through Sightengine or Google Cloud Vision, picture drawing through Google Cloud. Each receives only what its job needs.

Who sees what

Other members see your public activity under your handle. Moderators see reports, held pictures and the audit trail. We see what's needed to run the service. Nobody buys or receives your data for advertising or anything else.

Keeping and deleting

• Delete your account from your account page. This removes your email, your handle, your signed-in sessions and any phone pairing, and cancels a paid plan. Your votes and comments stay under a retired name so tallies and threads don't change. Pictures already released or chosen stay, under the licence in the terms. Pictures still waiting for review are discarded.
• The audit trail is append-only and is kept: it's the record of every moderation decision, including automated ones, and it's what makes the rules checkable.
• Server logs are kept only as long as running the service and investigating abuse needs.
• Your phone is yours. Deleting the app deletes your progress; export first if you want it back.

Children

The community site is for people old enough to be responsible for what they submit and vote on: sixteen and over. The app itself collects nothing about you and can be used at any age.

Questions

Write to us from your account page on the community site. If the law where you live gives you rights over your data (access, correction, portability, deletion), they're honoured through the same route.