Privacy & terms

What's collected

Guest mode (no account)

Your drills stay in your browser (apart from the anonymous count below). Your deck and number drill progress and results live in your browser's session storage only, and disappear the moment you close the tab.

Building a palace or PAO system as a guest creates an anonymous Supabase session (no name, email or password) so your work can save as you go. Whatever you build is stored the same way as for an account, and deleted - images included - after 30 days without a visit, unless you create an account to keep it.

Anonymous usage counts

To see which parts of the site get used, a few moments are counted, at most once per visit: arriving (with the name of the link you came from, if any), starting or finishing a drill, creating a palace or PAO system, editing a PAO entry, creating an account, and sending feedback. Each count is just the event's name and the time - not linked to you, your account, your IP address or your browser.

If you create an account

Handled by Supabase Auth: your username (used to sign in), your email address if you give one (optional, used only for password resets), and your password - we never see or store the plaintext, Supabase hashes it. Beyond that, we store whatever you actually use the app for: drill run history - deck runs (times, which cards you got right, deck settings) and number runs (how many digits, how many you got right, times, settings) - and anything you build in the Palace or PAO Builder (names, descriptions, stops, cards and numbers, hint and suit theme choices, and any images you upload).

If you use the Feedback form

Your message, an optional email address if you choose to leave one, the page you were on, and your browser's user agent - filed as an issue in this project's GitHub repository (currently private, so only the maintainer sees it).

Who else touches it

A handful of services run this site. None of them get more than they need to do their one job:

• Supabase - hosts your account, drill history, and Palace/PAO data. Staging and production are entirely separate projects.
• Resend - sends the two auth emails (confirm your address, reset your password). Sees your email address for that only.
• Cloudflare - hosts the site and runs the Feedback form's backend. If Cloudflare Web Analytics is enabled, it counts visits without cookies and without identifying you individually.
• Sentry - if something breaks, an error report (stack trace, browser/OS, the page you were on) is sent so it can get fixed. Not your account data.
• GitHub - Feedback form submissions become issues in this project's repository, as described above.

Cookies & local storage

No advertising or cross-site tracking cookies, ever. Locally in your browser: your light/dark theme preference; your last-used deck and number drill settings; whether the PAO Builder shows images or words; as a guest, your made-up display name (like "calm-otter-22") and a count of today's drills for the daily limit; for the current tab only, guest drill history and which anonymous counts were already sent this visit; and (if signed in, or building as a guest) Supabase's own session token so you stay logged in. That's the complete list.

Deleting your data

There's no self-serve "delete my account" button yet. Until there is, ask through the Feedback form and it'll be handled by hand - account, drill history, and any Palace/PAO data and images removed.

Terms

Free to use, no account required for guest play. The source is licensed under AGPL-3.0, in a repository that's currently private. This is a memorization training aid provided as-is, with no warranty - back up anything irreplaceable elsewhere too.