Privacy Policy

1. Scope and contact

This Privacy Policy describes the current information practices of the Deckumi website at deckumi.app. Deckumi offers flashcard creation, organization, favorites, search and review, with optional account sign-in. Deckumi is maintained by the Deckumi team, which can be contacted about privacy at the address below.

For privacy questions or account data requests, contact [email protected].

2. Account and security information

When you create an account, we process your name, email address, verification status and registration time. For email and password accounts, the server stores a password hash to verify sign-in. Do not put passwords in flashcards or support messages.

Account services also process sessions, IP addresses, browser information and necessary security records. At registration, we may record your interface language and a referral marker, if present, to operate accounts, investigate security issues and understand registration sources.

We use this information to manage accounts, verify email addresses, recover passwords, keep you signed in and respond to support requests.

For signed-in Web users, we also record daily activity and practice timestamps linked to the Deckumi user ID. These records count signed-in visits and whether a user submitted a flashcard rating on a UTC day, for service operation and reporting. This does not upload flashcard text, answers, notes or rating values; guest activity is not included in these account statistics.

3. Google and Apple sign-in

When a provider is available and you choose to use it, we receive the account identifier, name, email address, verification status and any profile image that Google or Apple makes available with your authorization. We also process credentials needed to complete authentication.

Google sign-in requests only openid, email and profile identity permissions. We do not request access to Gmail messages, contacts, Google Drive or calendars. We use Google account data for sign-in, account identification and security, not advertising targeting, sale or training general-purpose artificial intelligence models.

If you choose Apple's Hide My Email, we receive the relay address supplied by Apple. You can manage or revoke authorization in your Google or Apple account settings. Revoking authorization does not automatically delete your Deckumi account or flashcards stored in a browser.

4. Flashcards and browser storage

Signed-in Web libraries are saved to your account. Guest Web libraries and the current native app libraries remain on the device. Account libraries include study sets, cards, favorites and review records. Access is restricted to the owning account; card content and review details are encrypted by the application before database storage. This is not end-to-end encryption because the server processes your requests.

Existing browser or native libraries do not upload automatically when you sign in. Guest data and account-specific local data remain separate. Native sign-in does not enable native cloud sync. Website requests, sign-in operations and materials submitted to support travel over the network.

Clearing site or app data, or changing device, can make device-local cards unavailable. Signing out does not delete local content. The device owner can inspect its local data; account separation is not device encryption.

Uploaded source documents

When you choose to upload a file, we store its original in a private Cloudflare R2 bucket and save extracted text and available document structure in our PostgreSQL database. Originals and extracted content are encrypted by the application before storage. Metadata such as file name, size, a content fingerprint and processing status is retained to manage your files and reuse identical uploads within your own account. Storage paths use random identifiers rather than your email address. Access requires your authenticated account.

Document encryption is not end-to-end encryption: our server decrypts files to read them or send them to the configured MinerU parser. The production parsing service receives the document and processes it under its own terms and retention practices. TXT and Markdown are read directly without OCR. Do not upload material you are not entitled to process or sensitive information unsuitable for this service. Uploaded document storage and account flashcard storage are separate; uploading alone does not create or publish flashcards.

5. Cookies and necessary technologies

We use necessary cookies to maintain sessions, protect social sign-in redirects and remember preferences such as language. Browser storage holds flashcards and settings such as appearance.

You can manage these technologies in your browser. Blocking necessary cookies may prevent sign-in. Clearing local site data may also remove saved flashcards.

6. Service providers and disclosure

Hosting infrastructure processes account and website requests. Cloudflare provides network proxy, security and private R2 document storage services; MinerU processes documents submitted for cloud parsing; Resend processes verification and password recovery emails. If you use Google or Apple sign-in, the selected provider processes that request under its own policy.

We provide information needed for these services, such as a recipient address and verification or recovery email content for email delivery. We do not sell personal information. We may also disclose necessary information to meet legal requirements, address abuse or protect users and service security.

7. Retention, access and deletion

Account details and necessary authentication records support your account and service security. Sessions and verification links have their own expiration periods. We retain relevant information for the time needed to maintain accounts, handle support requests and protect service security. After verifying a deletion request, we process the account data concerned. Information needed to meet legal requirements or address security incidents, and backup copies not yet cleared through maintenance, may remain for the necessary period.

Start deletion from your profile or security settings on Web, or More → Account → Delete account in the app. Confirmation permanently deletes the account and associated server-side profile, credentials, sessions, roles and activity records, and revokes Apple authorization. A current password or recent sign-in verifies the request. Retention exceptions and backup copies follow the rules above. Contact the address above for access, correction or other privacy requests. You can also contact us about deletion of uploaded originals and extracted content; these requests require separate storage cleanup. Leaving the page or clearing browser data does not cancel processing or delete server-side files. Automatic document expiry is not currently available.

Manage or clear browser flashcards in the relevant browser. Deleting a server-side account, signing out or revoking Google or Apple authorization does not automatically clear local copies on every device.

8. Location and protection

The current account service is hosted in the United States. The document bucket uses Cloudflare’s Western North America location hint, which is a placement preference rather than a data residency guarantee. Network and email providers may process requests in other regions, so account and security information may be processed across borders. We handle cross-border data requests under applicable requirements and provide necessary information and assistance.

We use measures such as HTTPS, access controls and credential protection to reduce risks, but no network or storage system is completely secure. Protect your devices and accounts, and avoid retaining sensitive learning content on shared devices.

9. Updates

When the service or its practices change, we will update this page and its date, and provide additional notice or obtain permission where required. Unreleased features, including Plus, quizzes and mind maps, are outside this description of the current service.

Read the Terms of Service for the scope and responsibilities of using Deckumi.