Privacy Policy

Google sign-in and account information

When you choose Google sign-in, Google provides basic identity information through Supabase Auth: your Google account identifier, email address and verification status, and basic profile information such as your name and profile picture when supplied. Cogninara uses this to authenticate you, associate you with your saved work and maintain your account. Cogninara does not receive your Google password.

The application uses Google for identity sign-in only. It does not request access to Gmail, Drive, Photos, Calendar, contacts or other Google content, and it does not call those APIs. Google identity data is not sent to the optional flashcard-generation service.

Supabase stores account and provider identity information in its authentication system. The application creates a profile associated with your account ID, using your supplied name as an initial display name when available. It does not automatically select a username or copy your Google picture into your public profile. You can edit your profile separately; signing in again does not overwrite those edits. Email registration and password recovery are also handled by Supabase Auth and its configured email service.

Information you provide and activity you create

Cogninara stores decks, cards, notes, course organization, tags, uploaded card media, scheduling preferences, review results and study-session records so you can save, organize, recover and study your work. Content revisions support recovery. Imports and restored backups create records in your account.

If you use community features, the service stores profile details you supply, sharing choices, saved-deck references, group membership and invitations, friend/follow relationships, blocks and notifications. Reports, when submitted through the supported service, are restricted to the reporter and privileged operators.

Grade calculators, timers, word counting and citation formatting operate in your browser; the tool implementations do not submit your entered values to a database. Loading the site still involves normal network requests to its infrastructure.

Storage, cookies and service providers

Account and study records are stored in Supabase databases; uploaded card images and audio are stored in a private Supabase Storage bucket. Authentication uses browser cookies for session tokens and sign-in state, including session refresh. The browser SDK can read those cookies. Session responses may include provider tokens returned by Supabase; Cogninara does not use them to access additional Google services.

Your browser stores appearance/layout preferences and, when you explicitly save an offline session, that session’s content and queued review actions. Editor drafts use browser session storage. Signing out clears local offline study data and drafts; preferences may remain. Clearing site data removes local copies and may lose unsynced work. These local copies are not an encrypted backup. The service worker caches a public offline shell and static assets, not private API, media or authenticated-page responses.

Supabase, the website’s hosting infrastructure and the configured authentication email service process the information needed to operate their parts of Cogninara. Network requests may expose technical information such as IP address, browser details and request timing to those providers. Hosting regions and provider log/backup retention depend on the deployed service configuration; no universal location or retention period is promised here.

If configured and you choose generation from notes or photos, the submitted notes or processed images are sent to the OpenAI API to produce draft flashcards. The request disables response storage with store: false; this does not establish zero provider retention. The generation endpoint does not save the submitted source as a deck; you choose whether to save the resulting cards. Note-image usage counts are recorded for account quotas. Generation is unavailable when its server credentials are not configured.

When you import a deck from a URL, the server requests that URL from its host. When you use an externally hosted profile image, a visitor’s browser may request it from that image host. Avoid putting private credentials in links or image URLs.

Sharing and public visibility

Private decks are restricted to their owner. Publishing a deck makes it discoverable; an unlisted shared link can be opened by people who have it. Shared decks can be copied, and later making your original private or deleting it does not remove copies saved by others. Private media does not gain cross-account access just because a deck is shared.

Profiles start with public visibility and discoverability enabled, while activity sharing starts off. A username is not assigned automatically. Profile identity can appear in permitted links, relationships and group membership. You can change visibility, discoverability, public-deck display and activity sharing in Edit profile. A private profile still exposes a limited identity in supported relationship views; it does not make all social activity anonymous. Your email is not included in public profile projections.

The application has no advertising, sale-of-data or third-party marketing-tracker integration. Sharing implemented by the application is for authentication, service operation, features you choose and the visibility controls above. Providers operate under their own terms and privacy policies.

Retention, deletion and your controls

Account and study data remain stored until removed; the application has no automatic inactivity-deletion schedule. Trashing a deck or card is recoverable and does not permanently erase it. Library recovery controls let you restore or permanently delete trashed items. Permanent deletion removes related review/revision history for those items. Uploaded media can remain after card deletion because another card or revision may reference it; automated media cleanup is not implemented.

You can export your active decks and cards through library backup tools, edit your profile, change sharing settings, and sign out through the account menu. Export files are your responsibility to store safely. JSON backups include media references rather than the underlying media files.

There is no self-service account-deletion button. To request account deletion, access, correction or removal of residual media, use the contact method below; account ownership may need to be verified. An operator must handle these requests. Provider backups and operational logs may outlast deletion from the live application, and their retention/removal timing must be confirmed for the deployed services. We do not promise immediate removal from every backup or from copies made by other users.

You can also remove Cogninara’s connection in your Google Account’s third-party connections controls. This does not itself delete your Cogninara account or previously saved work; sign out and request deletion separately if that is your intention. Privacy rights and available remedies depend on your location.

Security and appropriate use

Cogninara uses authenticated requests, database ownership/row-level access policies and private media access controls. Production authentication cookies use Secure on HTTPS and SameSite settings. No internet service or browser storage is risk-free. Protect your device and account, sync before signing out, and avoid submitting sensitive personal information in cards, public content or generation requests.

Changes to this policy

Changes will be published on this page with an updated effective date. Check the policy when deciding what information to provide or share. See also the Terms of Service.

Contact

For privacy, account-deletion, content or terms questions, email: hanidawsonnoaholiver@gmail.com.

Do not send passwords or sign-in codes with a request.