Privacy & Cookie Policy

1. Data We Collect

Account data: Email address, display name, and profile photo from Google Sign-In.

Content: Flashcard decks, cards, and study data you create.

Study data: Review history, spaced repetition state, session scores, streaks.

Transaction data: Purchase records, redemption records, payment amounts. These are permanently retained and cannot be deleted (see Section 5).

Usage data: Pages visited, actions taken, timestamps. Used for product improvement.

2. How We Use Your Data

To provide the flashcard study service, process payments, enforce platform policies, and improve the product. We do not sell your data to third parties.

3. Third-Party Services

Firebase (Google): Authentication and data storage.

Stripe: Payment processing, under Stripe's own privacy policy. We never see or store your card details.

Google Cloud: Infrastructure hosting.

4. Data Sharing

We do not sell your data, and we do not share it with advertisers or data brokers. Data is shared only with the processors above as needed to run the service.

5. Data Retention

Deletable: Your account, decks, cards, and study data can be deleted on request.

Permanently retained: Purchase records, redemption records, refund records, and audit logs are permanently stored and cannot be deleted by any party. This is required for financial compliance, dispute resolution, and fraud prevention.

This is disclosed upfront: by making a purchase or redeeming a code, you acknowledge that the transaction record is permanent.

6. Your Rights

You may request export or deletion of your data (except permanent records noted above) by emailing support@noreread.com.

7. Cookie Policy

We use only strictly necessary cookies and similar storage (e.g. Firebase Authentication session tokens) to keep you signed in and the service secure. Stripe sets its own cookies on its checkout pages for fraud prevention, under Stripe's cookie policy.

We set no advertising, analytics, or cross-site tracking cookies. Because every cookie we use is essential to providing the service you request, no cookie consent banner is required. If we ever introduce non-essential cookies, we will update this policy and ask for your consent first.

You can clear cookies in your browser at any time; doing so signs you out but does not affect your data.

8. Security

Data is encrypted in transit (HTTPS) and at rest (Google Cloud). Admin access is restricted to an allowlist of emails managed via server environment variables.

9. Changes

We may update this policy. Continued use after changes constitutes acceptance.

10. Contact

Privacy questions? Email support@noreread.com.