Privacy Policy

This policy is adapted from the Creative Commons Privacy Policy, used under CC BY 4.0. It explains what boksen (the “Service”) collects, why, and what you can do about it.

Our approach

We built the Service around three commitments:

1. Say it in plain language. This policy describes what the software actually does, not the widest set of things we could reserve the right to do.
2. Collect as little as possible. The Service is identity-free by design: we never store your email address, and there is no name, photo, or profile beyond an avatar you pick from a fixed set.
3. No tracking. There is no analytics service, no advertising, no tracking pixel, and no third-party script — the app ships no client-side JavaScript at all. Every asset a page loads comes from boksen.org.

1. Information you give us

• Your email address — used, then discarded. When you sign in we normalise the address (trim and lowercase) and derive a keyed hash of it (HMAC-SHA256 under a secret key that only we hold). That hash is your account ID. The address itself is used only to send you a six-digit login code and is then discarded: it is never written to our database and never written to our access log. Because the key is secret, the hash cannot be reversed by trying a dictionary of addresses against it.
• Your avatar. One picture chosen from a fixed set, saved on your profile. It is the only thing resembling an identity that we keep.
• Decks you import. The question and answer text of any CSV you upload or paste. These decks are private to your account.
• Your study activity. Which cards you reviewed, when, the grade you gave (Again / Good / Easy), and the schedule that resulted. This is what makes the scheduler and the stats page work.

2. Information collected automatically

We write one log line per request. It records the HTTP method, the route template (/study/:deckId, not the deck you were studying), the response status, how long the request took, whether it was a cold start, and your account hash. These logs are kept for one year and then deleted.

We do not log your IP address. On sign-in requests only (/auth/…) we log a pseudonym of it instead — a keyed hash, where the key is random, kept for up to a few days, and then thrown away. While that key lives, the pseudonym lets us see that one source is making many sign-in attempts. Once it is gone, those entries cannot be traced back to an address by anyone, ourselves included. Beside it we record a short label for which key was used, so we can tell which entries are comparable with each other; the label is derived from the key and says nothing about you. Every other request — studying a deck, your stats, reading this page — carries no network identifier at all.

We want to be straightforward about what remains. Your account hash still makes the log a record of your activity for the year we keep it, and both it and the sign-in pseudonym are still personal data under the GDPR and the CCPA — hashing reduces what the log exposes if it ever leaks, but it does not put the log outside those laws. We keep it to operate and secure the Service: diagnosing faults, and detecting abuse such as automated sign-in attempts.

Two things are deliberately excluded from the log: request bodies, so the address you type on the sign-in form is never written to our access log; and cookies, because the session and form-security tokens they carry are credentials. We also do not enable our content delivery network's own access logs.

We do not use cookies, pixels, fingerprinting, or any third-party service to profile you or to measure engagement.

3. Cookies

The Service sets three cookies, all strictly necessary:

• sid — your signed session token, set when you sign in and valid for up to 30 days.
• csrf — a signed token that protects forms against cross-site request forgery.
• pending — short-lived, set between entering your email address and entering the login code.

All three are HttpOnly, Secure, and SameSite=Lax. None is used for advertising or analytics and none is readable by a third party. There is no cookie banner because there are no non-essential cookies to consent to.

4. How we use information

• To run the Service: signing you in, scheduling your cards, showing your stats.
• To send login codes. These are the only emails we send; there is no marketing list.
• To keep the Service secure and available: rate limits, the sign-in verification challenge, and investigating abuse.
• To comply with the law and to enforce our Terms of Service.

We do not sell personal information, share it for cross-context behavioural advertising, or use it to build an advertising profile.

5. How we share information

• Amazon Web Services. The Service runs entirely on AWS in the United States — compute, database, content delivery, secret storage, logging, and the email service that delivers your login code. AWS processes this data on our instructions as our service provider.
• Your email provider. A login code is an email; once we send it, its handling is subject to your own provider's practices.
• Legal requests. We may disclose information if required by law, or where we believe in good faith that it is necessary to protect rights, safety, or the integrity of the Service.
• A successor. If the Service is transferred to someone else, this information may transfer with it, subject to this policy.

We share it with no one else — no data brokers, no advertisers, no analytics vendors.

One limit applies to all of the above: what our providers do internally is outside our control. We do not enable delivery-event logging on the email service, so it does not report the addresses we send to back to us — but AWS keeps its own operational records on its own schedule, and once a login code reaches your mailbox its handling is your mail provider's business rather than ours.

6. Legal bases for processing (EEA and UK)

• Performance of a contract — providing the Service you asked for.
• Legitimate interests — keeping the Service secure, preventing abuse, and keeping it working, balanced against your rights.
• Legal obligation — where the law requires us to retain or disclose information.

7. How long we keep information

• Login codes are stored hashed and expire automatically ten minutes after they are issued.
• Request logs are kept for one year.
• The key behind the sign-in IP pseudonym is kept for up to a few days and then discarded, after which the pseudonyms it produced can no longer be linked to any address.
• Your profile, schedules, and imported decks are kept until you delete them or ask us to delete your account.
• Review history is append-only. Deleting an imported deck removes the deck, its cards, and their schedules, but the review entries — a grade and a timestamp, referring to a card that no longer exists — remain. A full account-deletion request removes those too.
• Backups held by our cloud provider may persist for a limited period after deletion.

8. Your rights and choices

• You can delete any deck you imported from within the app, and correct the text of your own cards while studying.
• Signing out clears the session cookie from your browser.
• You can ask us to access, correct, export, or delete your information, to object to or restrict processing, or to withdraw consent, by writing to hello@boksen.org.

Please write from the address you sign in with. Because accounts are identified by a keyed hash, we find your data by recomputing that hash from the address your message came from — we do not need to keep the address itself, and we will not. We may be unable to act on a request sent from a different address, since we would have no way to link it to an account.

If you are in the EEA or the UK you also have the right to complain to your data protection supervisory authority. If you are a California resident, you have the right to know, delete, and correct your personal information, and not to be discriminated against for exercising those rights; we do not sell or share personal information and offer no financial incentives for it.

9. International transfers

The Service is operated from the United States. If you use it from elsewhere, your information is transferred to and processed in the United States, where data protection law may differ from your own. Where required, we rely on appropriate safeguards for such transfers, including the standard contractual clauses in our cloud provider's data processing addendum.

10. Security

The measures we take include:

• HTTPS everywhere, with HSTS.
• Email addresses are never stored — only the keyed hash described above, whose secret key is held in a managed secret store.
• Login codes are stored hashed, expire in ten minutes, allow five guesses, and are rate-limited per account.
• A verification challenge on the sign-in form, which makes it impractical to automate sending login codes to addresses that did not ask for them. It raises the cost of that abuse rather than ruling it out: a determined attacker can still solve the challenge, and anyone can type someone else's address by hand. The per-account rate limit above is what bounds how many codes that can produce.
• Session and form tokens are signed; cookies are HttpOnly, Secure, and SameSite=Lax; every form is protected against cross-site request forgery.
• A strict Content Security Policy. Because the app ships no client-side JavaScript, scripts are blocked outright, which removes a whole class of attack.

One limitation worth stating plainly: sessions are stateless signed tokens valid for up to 30 days. Signing out clears the cookie from your browser, but a token copied from your device beforehand would stay valid until it expires. Treat it as you would a password, and avoid signing in on devices you do not trust.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Children

The Service is not directed to children under 13, and you must be at least 13 to use it. We do not knowingly collect personal information from children under 13 (or under 16 in the EEA where local law sets that age). If we learn that we have, we will delete it promptly. If you believe a child has given us information, write to hello@boksen.org.

12. Links to other sites

Deck content may contain links to other websites. We are not responsible for their privacy practices; review their policies before giving them information.

13. Changes to this policy

We may update this policy. We will post the revised version here with a new effective date, and that date also appears in the footer of every page — so a change is visible from anywhere in the Service without opening this page, and stays visible rather than lapsing after a notice period.

We cannot email you about a change, because we do not keep your email address. That is a direct consequence of collecting as little as we do, and it is the reason the date sits in the footer instead. If it matters to you, check it from time to time.

14. Contact

Questions about privacy, or a request about your information: hello@boksen.org.