Privacy

Your study progress

Your answers, scores, streak, XP, flashcard schedule, readiness estimate and the exam date you enter are saved in your browser's local storage. That copy is the one the study tools read and write, which is why they keep working offline and without an account.

When you are signed in, the same information is also copied to our database while you study and again when you leave the page, and it is merged back into your browser the next time you sign in. That copy is the point of having an account: it is what lets a new phone pick up where the old one left off.

Signed out, none of it is sent anywhere, and clearing your browser data erases it permanently with no server copy to restore from. Signed in, clearing your browser does not lose it — the server copy comes back at your next sign-in.

Other users cannot read your progress; the database enforces that row by row. We can. The keys the site runs on and the database dashboard can both read it, so treat your progress as visible to the person who runs this site.

Your account

An account stores your email address, a scrambled (hashed) version of your password, your language, and which of our sites you first arrived through. Sign-in is handled by Supabase, our accounts provider, and your actual password is never visible to us.

If you sign in with Google, Google tells us your email address and the name on your Google profile, and we store those. We do not receive your Google password and we get no access to anything else in your Google account.

We also store one row for each thing you buy: which site it covers, when the access expires, and the Stripe identifiers for the payment. That row is what restores your access on a new device.

Cookies

Only cookies that make the site work. There is no advertising cookie and no third-party tracker.

Access: one cookie holds the signed token that proves you paid. It is set when you buy or restore a pass, and it expires when the pass does.

Sign-in: while you are signed in, Supabase sets session cookies that keep you signed in and refresh themselves. Signing out clears them.

Starting a sign-in: a one-time verifier cookie is set the moment you begin signing in, and is used to finish it. If you start a sign-in and abandon it, that cookie can sit in your browser for up to about a year, until you clear it or complete a sign-in.

Where you were going: a short-lived cookie remembers the page you were heading to when you were asked to sign in. It lasts thirty minutes.

Analytics

Aggregate page-view and page-speed data is collected through Vercel Analytics and Speed Insights, which are cookieless and do not build a profile of you or follow you across other sites.

Payments

Payments are processed by Stripe. Your card details go to Stripe directly and are never seen or stored here.

We send Stripe the email address on your account and an internal account id, so a payment can be matched back to the right account. Stripe tells us whether the payment succeeded and, on a monthly plan, whether it renewed. Stripe keeps its own record of the transaction under its own privacy policy.

Who else is involved

Vercel hosts the site and processes standard server request logs.

Supabase runs the accounts, the purchase records and the server copy of your progress, on servers in the United States. Your browser talks to Supabase directly while you are signed in, so Supabase also sees your IP address.

Stripe processes payments. Google is involved only if you choose to sign in with Google.

That is the complete list — no data is sold, and nothing is shared with anyone else.

Deleting your account and your data

There is no delete button yet. Write from your account address to the contact address published on the site, and we will delete the account, the progress copy and the purchase records.

Deleting the purchase records also ends any access still attached to them. Stripe keeps its own record of the payment itself, and that is not ours to delete.

Contact

A contact address is published on the site before any purchase is possible.