Your study data: where it goes and what to keep.

Hosted accounts and saved study data

Account registration uses the details you enter, including your email address and name. The server stores password and PIN hashes rather than the original password and PIN. Email verification and password recovery use the configured transactional email provider; this deployment supports Brevo or SMTP.

When you save or sync a hosted workspace, the configured server database stores its study records. Authenticated sessions use HttpOnly cookies. The app also uses browser storage for preferences, local workspace state and working drafts as appropriate to the mode. Other people using the same device may be able to access browser-stored information, so sign out and protect the device.

Public pages and private records

The public homepage, feature pages and guides contain product information. Personal notes, assignments and account data are not inserted into those pages or their search sitemap. Workspace APIs require authentication where applicable.

Search indexing controls are not an access-control system. The app uses account checks for protected data and separately asks search engines not to index the application, API responses and downloadable offline file.

The offline edition and backups

The standalone HTML edition keeps workspace data in the browser on the device where you use it. It does not create a hosted account or upload an entire workspace just because you opened the file. Features that access external services, such as optional AI, still require a connection.

Clearing browser data, changing browsers or losing the device can remove local work. Download a backup and store it somewhere you control. Backup files can contain personal study information; review them before sharing. Deleting an entry locally does not automatically delete copies in backups, undo history or other saved versions.

Optional external services

If Cloudflare Turnstile is enabled, the browser contacts Cloudflare for the anti-abuse check. Email delivery sends the recipient address and message to the selected email provider. The hosting and database providers process service requests and stored records needed to run the hosted app.

If you use optional AI assistance, the prompt or context submitted by that feature is sent to the configured AI provider. Avoid sending information you do not want that provider to process. Saved resource links lead to third-party websites with their own policies. Public informational pages do not embed advertising or analytics tracking scripts by default.

Account or data questions

Use the workspace’s Report issue / feedback form for a question or request about hosted data. Do not include passwords, PINs or verification codes. There is no universal automatic account-deletion control or published retention deadline in this release; requests require action by the deployment operator. The Help page explains where to find the form.