Privacy Policy

1. Who we are

GlossaGo Cards ("we", "us") is operated by Denis Pilin, an individual based in Cyprus, as data controller for the personal data described in this policy. For any privacy question or to exercise your rights, contact us at [email protected].

2. What data we collect

• Account data: email address, username, and a bcrypt-hashed password. We never store your password in plain text.
• Password reset tokens: if you request a password reset, we briefly store a hashed, single-use token tied to your account. It expires automatically after 1 hour and is deleted once used.
• Content you create: study sets, folders, and flashcards (terms and definitions) you add.
• Learning progress: per-card statistics (correct/incorrect counts, spaced-repetition scheduling, Learn-mode round data) used to power flashcard review and Learn mode.
• Preferences: your interface language, stored in a cookie.
• Session data: a signed session cookie identifying your account so you stay logged in. It contains your account ID and a cryptographic signature, not your password.
• Technical logs: our server records request method, path, response status, and timing for operating and troubleshooting the service. These logs are not used to build a profile of you.

3. Why we process your data

• To provide the service (Art. 6(1)(b) GDPR): creating your account, storing your study sets, and running flashcard/Learn sessions all require processing the data above.
• Legitimate interests (Art. 6(1)(f) GDPR): keeping technical logs and aggregate request metrics to secure the service, prevent abuse, and diagnose problems.
• Consent (Art. 6(1)(a) GDPR): where you tick the consent box on the registration form, and for any optional feature that explicitly asks for it.

4. Sharing your study sets

Study sets default to private. If you set a study set's visibility to "Public" or generate a one-time share link, the set's title, description, and cards become accessible to anyone with that link or (for public sets) more broadly. Only share content this way if you're comfortable with that visibility.

5. Cookies

We use two cookies, both strictly necessary to operate the site (no cookie banner needed, and none are used for advertising or cross-site tracking):

• session — keeps you signed in. Expires after 30 days of inactivity.
• lang — remembers your chosen interface language. Expires after 1 year.

6. Third-party services

Our pages load fonts and JavaScript libraries (Google Fonts, Tailwind CSS, htmx, Alpine.js) from third-party content delivery networks. Loading these resources causes your browser to contact those providers directly, which may process your IP address under their own privacy policies.

We use Brevo (Sendinblue SAS, France) to send account-related emails, such as a welcome message when you register and password reset links. Brevo processes your email address and username as our data processor for this purpose only, and is bound by an EU data processing agreement with us.

7. Where your data is stored

The application and its database run on a server located in Cyprus (EU). Database backups are stored with a cloud provider in an EU region. We don't transfer your personal data outside the European Economic Area, aside from the third-party resources described in section 6, which are loaded directly by your browser rather than sent by us.

8. How long we keep your data

We keep your account, study sets, and progress for as long as your account exists. If you delete your account from Settings, your account, study sets, folders, cards, and all learning progress are permanently and immediately deleted. This cannot be undone.

9. Your rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data (most of this you can edit directly in the app)
• Erase your data (delete your account in Settings, or contact us)
• Restrict or object to certain processing
• Receive your data in a portable format
• Withdraw consent at any time, where processing is based on consent

To exercise any of these rights, email [email protected].

10. Children's privacy

GlossaGo Cards is intended for users aged 14 and older, the digital age of consent under Cyprus law. We don't knowingly collect personal data from children under 14. If you believe a child under 14 has created an account, contact us and we'll delete it.

11. Supervisory authority

If you're unhappy with how we've handled your data, you can lodge a complaint with Cyprus's data protection authority:

Office of the Commissioner for Personal Data Protection
15 Kypranoros Street, 1061 Nicosia, P.O. Box 23378, 1682 Nicosia, Cyprus
Email: [email protected]
Phone: +357 22 818 456
Website: dataprotection.gov.cy

12. Changes to this policy

We may update this policy as the service evolves. Material changes will be reflected by updating the "Last updated" date above.