Privacy Policy

What we collect

When you use Words on Repeat, we store the following data:

• Email address — used for login and account identification
• Password — stored as a bcrypt hash, never in plain text
• Display name — shown in the app interface
• Vocabulary and decks — the words, translations, example sentences, and tags you create
• Review history — your grades, review timestamps, and FSRS scheduling state
• Study sessions — session start/end times, duration, and cards reviewed
• Push notification subscription — if you enable notifications, we store a browser-generated endpoint URL and encryption keys to deliver daily reminders. No personal data is included in notification payloads
• Daily study goals — your per-deck goal settings (e.g., 20 cards/day)

How we use it

Your data is used solely to provide the app's functionality:

• Account authentication — verifying your identity when you log in
• Spaced repetition scheduling — the FSRS algorithm uses your review history to calculate optimal review intervals
• Progress tracking — displaying retention rates, study time, and review statistics

We do not use your data for advertising, profiling, or any purpose beyond operating the app.

Cookies

Necessary cookies

Words on Repeat uses an authentication cookie to keep you logged in. This cookie:

• Contains a JWT (JSON Web Token) identifying your session
• Expires after 7 days
• Is set with httpOnly and sameSite=strict flags for security

This cookie is strictly necessary for the site to function and cannot be disabled.

Analytics cookies (optional)

With your consent, we use Google Analytics 4 to understand how the site is used. Google Analytics sets the following cookies:

• _ga — distinguishes unique users. Expires after 2 years.
• _ga_* — maintains session state. Expires after 2 years.

These cookies are only set if you click "Accept All" or enable analytics in the cookie preferences. You can change your choice at any time by clicking the "Cookie Settings" link in the page footer. For more information, see Google's Privacy Policy.

Local storage

Words on Repeat uses browser localStorage to persist your preferences locally on your device. This data is never sent to our servers:

• Theme preference — your light/dark/system choice
• Active deck — which deck you last selected
• Cookie consent — your analytics cookie preference
• Onboarding state — which getting-started steps you've completed

You can clear this data at any time through your browser settings.

Progressive Web App

Words on Repeat can be installed as a Progressive Web App (PWA) on your device. The service worker caches static assets (CSS, JavaScript, icons) for faster loading and basic offline support. No personal data or vocabulary content is cached offline — study features require an internet connection.

Data storage

All data is stored in a SQLite database on the server. We use third-party email delivery services — currently Mailgun (Sinch Email) and/or Amazon Web Services Simple Email Service (AWS SES) — to send transactional emails, including account verification, password reset, and contact form notifications. These providers process only the recipient email address and message content necessary for delivery. With your consent, we use Google Analytics 4 to collect anonymized usage data (see Cookies section above). No personal data is shared with third parties for marketing or advertising purposes. There are no ad networks or data brokers involved.

We use the Web Push protocol to deliver daily study reminders to users who opt in. Push subscriptions (browser endpoint URLs and encryption keys) are stored in the database and deleted when you disable notifications or when your browser revokes the subscription.

Server logs

The web server (Nginx) records access logs for operational purposes. These logs may include IP addresses, request paths, and user-agent strings. Logs are used only for aggregate analytics (via GoAccess) and troubleshooting. They are not shared with third parties.

Data retention

Your data is kept for as long as your account is active. If your account is deleted by an administrator, all associated data — decks, words, review history, study sessions, and API keys — is permanently removed from the database.

Your rights

You have the right to:

• Access your data — all your vocabulary, decks, and progress are visible in the app, and you can export your data as JSON from the Settings page
• Correct your data — you can edit your words, decks, and account details at any time
• Delete your data — contact the administrator to request full account deletion

To exercise these rights or ask questions about your data, contact the site administrator.

Changes to this policy

This policy may be updated from time to time. The date below reflects the most recent revision.

Last updated: May 22, 2026