Privacy Policy

What we collect

When you use Words on Repeat, we store the following data:

• Email address — used for login and account identification
• Password — stored as a bcrypt hash, never in plain text (accounts created with Google Sign-In have no password until you set one)
• Google account identifier — if you sign in with Google, we store your Google account ID to link your Google account to your Words on Repeat account (see "Sign in with Google" below)
• Display name — shown in the app interface
• Vocabulary and decks — the words, translations, example sentences, and tags you create
• Review history — your grades, review timestamps, and FSRS scheduling state
• Study sessions — session start/end times, duration, and cards reviewed
• Push notification subscription — if you enable notifications, we store a browser-generated endpoint URL and encryption keys to deliver daily reminders. No personal data is included in notification payloads
• Daily study goals — your per-deck goal settings (e.g., 20 cards/day)

How we use it

Your data is used solely to provide the app's functionality:

• Account authentication — verifying your identity when you log in
• Spaced repetition scheduling — the FSRS algorithm uses your review history to calculate optimal review intervals
• Progress tracking — displaying retention rates, study time, and review statistics

We do not use your data for advertising, profiling, or any purpose beyond operating the app.

Sign in with Google

You can optionally sign in with your Google account. When you do, Google shares the following with us: your name, email address, and a Google account identifier. We use this data solely to authenticate you and to create or link your Words on Repeat account. We never see your Google password, and we do not request access to any other Google data (no contacts, files, calendar, or anything else). Google's own use of your data is governed by Google's Privacy Policy.

• Account linking — if a Words on Repeat account already exists with the same email address, signing in with Google links the two so both sign-in methods reach the same account. We notify you by email when this happens.
• Setting a password — accounts created with Google have no password. You can set one at any time in Settings → Set Password (or via the password reset email); we send a security notification email whenever a password is set or changed.
• Disconnecting Google — you can disconnect Google Sign-In in Settings → Connected Accounts once a password is set (so you never lose access to your account). Disconnecting deletes the stored Google account identifier. You can additionally revoke this app's access in your Google Account security settings.
• Retention — the Google account identifier is kept only while Google Sign-In is connected, and is removed when you disconnect it or when your account is deleted.

Cookies

Necessary cookies

Words on Repeat uses an authentication cookie to keep you logged in. This cookie:

• Contains a JWT (JSON Web Token) identifying your session
• Expires after 7 days
• Is set with httpOnly and sameSite=strict flags for security

This cookie is strictly necessary for the site to function and cannot be disabled.

Analytics cookies (optional)

With your consent, we use Google Analytics 4 to understand how the site is used. Google Analytics sets the following cookies:

• _ga — distinguishes unique users. Expires after 2 years.
• _ga_* — maintains session state. Expires after 2 years.

These cookies are only set if you click "Accept All" or enable analytics in the cookie preferences. You can change your choice at any time by clicking the "Cookie Settings" link in the page footer. For more information, see Google's Privacy Policy.

Local storage

Words on Repeat uses browser localStorage to persist your preferences locally on your device. This data is never sent to our servers:

• Theme preference — your light/dark/system choice
• Active deck — which deck you last selected
• Cookie consent — your analytics cookie preference
• Onboarding state — which getting-started steps you've completed

You can clear this data at any time through your browser settings.

Progressive Web App

Words on Repeat can be installed as a Progressive Web App (PWA) on your device. The service worker caches static assets (CSS, JavaScript, icons) for faster loading and basic offline support. No personal data or vocabulary content is cached offline — study features require an internet connection.

Data storage

All data is stored in a SQLite database on the server. We use third-party email delivery services — currently Mailgun (Sinch Email) and/or Amazon Web Services Simple Email Service (AWS SES) — to send transactional emails, including account verification, password reset, and contact form notifications. These providers process only the recipient email address and message content necessary for delivery. With your consent, we use Google Analytics 4 to collect anonymized usage data (see Cookies section above). No personal data is shared with third parties for marketing or advertising purposes. There are no ad networks or data brokers involved.

We use the Web Push protocol to deliver daily study reminders to users who opt in. Push subscriptions (browser endpoint URLs and encryption keys) are stored in the database and deleted when you disable notifications or when your browser revokes the subscription.

AI content extraction and uploaded files

When you use AI extraction (uploading a file, pasting text, or entering a URL), we do not store the uploaded file. The content is held in memory only for the few seconds needed to extract vocabulary, then discarded when the request finishes. Nothing is written to disk or saved in our database. The extracted text is sent to our AI provider (Anthropic Claude, via Amazon Web Services Bedrock) to identify vocabulary; per AWS Bedrock's terms, this content is not stored by the provider and is not used to train models. Only the resulting flashcards (words, translations, and examples) are saved to your deck.

Server logs

The web server (Nginx) records access logs for operational purposes. These logs may include IP addresses, request paths, and user-agent strings. Logs are used only for aggregate analytics (via GoAccess) and troubleshooting. They are not shared with third parties.

Data retention

Your data is kept for as long as your account is active. If your account is deleted by an administrator, all associated data — decks, words, review history, study sessions, and API keys — is permanently removed from the database.

Your rights

You have the right to:

• Access your data — all your vocabulary, decks, and progress are visible in the app, and you can export your data as JSON from the Settings page
• Correct your data — you can edit your words, decks, and account details at any time
• Delete your data — contact the administrator to request full account deletion

To exercise these rights or ask questions about your data, contact the site administrator.

Changes to this policy

This policy may be updated from time to time. The date below reflects the most recent revision.

Last updated: July 19, 2026