Privacy Policy

Last updated: July 2026

1. Information We Collect

Account Information: When you sign in with Google, we receive your name, email address, and profile picture. We do not receive or store your Google password.

Notion Data: When you connect your Notion workspace, we access only the pages you explicitly share with our integration. Your Notion integration token is encrypted using AES-GCM encryption and stored securely.

Study Data: We store your flashcard content, study progress, review history, and deck organization to provide the spaced repetition service.

Payment Information: Payments are processed by Paddle, our merchant of record. We never see or store your card details — we receive only your plan, transaction identifiers, and subscription status.

AI Image Prompts: If you use AI image generation, the text prompt you submit is sent to the Hugging Face Inference API to generate the image. Generated images are stored with your account.

Usage Data: We may collect anonymous usage analytics (page views, feature usage) to improve the service.

2. How We Use Your Information

  • To provide and maintain the flashcard and spaced repetition service
  • To sync your study data across multiple devices
  • To send study reminders (if you opt in to email notifications)
  • To improve the application based on anonymous usage patterns

3. Data Storage & Security

Your data is stored in Supabase (PostgreSQL) with Row Level Security (RLS) enabled, ensuring users can only access their own data.

Notion integration tokens are encrypted at rest using AES-GCM encryption.

All communication is transmitted over HTTPS.

4. Third-Party Services

  • Google OAuth: Authentication provider
  • Supabase: Database and storage
  • Notion API: Content import (only pages you share)
  • Paddle: Payment processing and billing (merchant of record)
  • Hugging Face: AI image generation (receives only your image prompts)
  • Vercel: Application hosting
  • Resend: Email notifications
  • Google Analytics: Anonymous usage analytics

5. Cookies

We use a session cookie (next-auth.session-token) to maintain your login state. This is a functional cookie required for the service to work. We do not use advertising or tracking cookies.

6. Your Rights

You have the right to:

  • Access your personal data
  • Request deletion of your account and all associated data
  • Disconnect your Notion integration at any time
  • Opt out of email notifications

To exercise these rights, contact us at the email listed on our contact page.

7. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of significant changes via email.