Privacy policy

What is Stu-Decks

Stu-Decks is a flashcard study website run by yours truly, Avram Plager. I am the data controller for the personal information described in this policy, which explains what the site collect, why, who the site shares it with, and the choices you have.

For any privacy question or request, write to [email protected], or see the contact page. Your rights, and how to use them, are set out under your choices and rights below.

Information the site collects

You can search and study the decks students have shared without an account. Your scores and progress are then held only in the server's memory, under a random id in the strictly necessary cookie described below, for as long as your browser session lasts; they are never written to the site's database, and nothing identifies you. Of the list below, only the technical information and your cookie choice apply to guest session.

• Your account: your email address and your password. The site database never stores your password itself, only a one-way hash of it, so no one can read it.
• Your decks: the flashcards you create, each deck's name, the university and course number you tag it with, and whether it is private or shared.
• Your study activity: test scores and times, Quick Match times, Build Understanding progress, study settings such as time limits, and which decks shared by other students you have added to your home page.
• Feedback you give us: if you are logged in, the voting page lets you say whether a feature is working for you. You can submit a note along with a thumbs down vote so I can fix any issues or concerns you have. Your answer and that note are stored with your account so I know what to fix. Your vote is never shared with anyone other students on the site.
• Technical information: like most websites, the hosting provider for this stie keeps short-lived server logs of requests, including IP address, browser type and the pages requested. The site uses these only to keep the site running and secure.

How the site uses collected information

• To run your account, keep you logged in, and save your decks and progress.
• To let other students find and study the decks you choose to share.
• To keep the site secure and fix problems.
• If the site starts showing ads to pay for itself, to show them, and only if you have agreed to advertising cookies (see below).

The site does not sell your personal information, and your email address is never shown to other students.

Legal bases (GDPR)

If you are in the European Economic Area or the United Kingdom, the General Data Protection Regulation requires me to say which legal basis we rely on for each use:

• Performance of a contract: running your account, saving your decks, keeping your scores and progress, and keeping you logged in. Without this the site cannot provide the service you asked for.
• Consent: advertising cookies. You give it by choosing "Accept all", and you can withdraw it at any time from Cookie settings, with no effect on your use of the site.
• Legitimate interests: keeping the site secure, preventing abuse, and the short-lived server logs our host keeps. The site balances these against your rights, and they do not involve profiling you.
• Legal obligation: where the law requires the site to keep or disclose something.

The strictly necessary cookies and storage described below are exempt from consent because the site cannot work without them.

Shared decks

New decks are shared by default; you can make any deck private when adding it or later. A shared deck, including its cards, name, university and course, can be seen, searched and studied by anyone who visits Stu-Decks, whether or not they have an account. Your own scores and progress are always private to you. Don't put personal information in decks you share.

Cookies and similar technologies

The banner gives you two choices: Strictly necessary and Accept all. "Strictly necessary" is not an option for no cookies at all. The site needs the few listed below to work, and they stay in place whichever choice you make; what "Strictly necessary" does is keep the site to those and nothing more. "Accept all" adds advertising cookies on top of them.

Strictly necessary. These are the ones the site cannot run without, so they do not need your consent:

• Your session (a cookie named session): keeps you logged in for up to 30 days, or until you log out. If you study without an account, the same cookie instead holds a random id so the site can give you back your own temporary scores and progress, and it lasts only until you close your browser. It is marked HttpOnly and SameSite=Lax, and it carries no advertising identifier.
• Your cookie choice (studecks-consent, kept in your browser's local storage rather than in a cookie): records which of the two buttons you chose and when, so the site does not ask on every visit. It stays until you clear your browser's storage for this site.
• A deck you are part-way through writing (studecks-draft, also local storage): while you are building or updating a deck, your browser holds the unfinished deck so you do not lose it if you close the tab. It stays in your browser, reaches the site only when you save the deck, and is removed when you save it or log out.

None of these are used to profile you, build an advertising audience, or follow you to other websites.

Advertising (only with your consent). Stu-Decks does not show ads at the moment, so no advertising cookies are being set on anyone's browser today. Ads are how the site is meant to pay for itself, so that may change. If it does, an advertising partner may use cookies and similar technologies to show ads, limit how often you see the same ad, measure how the ads perform and, depending on your settings with that partner, personalise ads based on your visits to this and other websites. That only ever happens if you chose "Accept all". Before the first ad is shown, this policy will name the partner, link their own privacy policy, and the banner will ask for your choice again.

If you choose "Strictly necessary", the site loads no ad code at all, so no advertising cookies are set and no ad request is made. Every part of the site keeps working either way, and nothing about your choice changes what you can study or save.

You can change your choice any time: Cookie settings. You can also turn off personalised ads from many advertising companies at once at aboutads.info.

Who the site shares information with

The site uses these service providers to run Stu-Decks. They process information only to provide their service to the site:

• Heroku (Salesforce): hosts the website and its server logs.
• MongoDB Atlas: stores accounts, decks and study progress.
• Ko-fi: handles donations, if you choose to make one. You donate on Ko-fi's own site under Ko-fi's privacy policy. Neither I nor the Stu-Decks website ever receive your card or bank details, only what Ko-fi shares with the people it collects for, such as your name and message if you add them.

There is no advertising company on that list, because the site is not showing ads yet. If that changes, the partner will be named there, with a link to their own privacy policy, before any ad is served.

The site may also disclose information if the law requires it, or to protect the safety of our users or the site.

How long the site keeps it

The site keeps your account, decks and progress until you ask us to delete them. Deleting a deck removes it, along with everyone's scores and progress for it, straight away. Scores and progress from studying without an account are held only for your browser session and are never stored, so they go when the session ends or the site restarts. Feedback you leave on the voting page is kept with your account until you change your answer or ask me to delete it.

Your choices and rights

You can see and change your decks at any time, and delete any deck you own. To get a copy of your information, correct it, or delete your account and everything in it, email me at [email protected] and I will respond within 30 days. Depending on where you live (for example the EU, UK or California), you may have further rights under local law, including the right to complain to a data protection authority.

Security

The site is served over HTTPS, passwords are stored only as hashes, and access to the database is restricted. No system is perfectly secure, so please use a password you don't use anywhere else.

Children and young people

Stu-Decks is meant for high school and university students and is not directed at children under 13. The site does not knowingly collect information from children under 13. If you believe a child has given the site information, contact me and I will delete it.

In the European Economic Area, the age at which someone can consent to the use of their information on their own varies by country. In the Netherlands, where a good share of our visitors are, it is 16, and a parent or guardian must authorise consent below that age. If you are under the age of consent where you live, please ask a parent or guardian before accepting advertising cookies. The site does not knowingly use advertising cookies to personalise ads for anyone it knows to be a minor, and it does not build advertising profiles of students.

Changes to this policy

If I change this policy, I will update the date at the top. If the changes affect how the site uses cookies, it will ask for your cookie choice again.

← Back to Stu-Decks