KokuPrivacy Policy
Last updated: March 20, 2026
This Privacy Policy describes how Koku (“we,” “us,” or “our”) collects, uses, and protects your information when you use the Koku website and application at koku.cards (the “Service”). Koku is operated by an individual developer, not a corporation or LLC.
By using the Service, you agree to the collection and use of information as described in this policy.
Information We Collect
Account Information
When you create an account, we collect:
- Email address — provided through Google OAuth or magic link authentication
- Google profile information — if you sign in with Google, we receive your name and email address as provided by Google's OAuth service
User-Generated Content
When you use the Service, we store:
- Flashcard content — decks, cards (including front/back text in Markdown format), and tags you create
- Images — photos or images you upload to your cards (limited to JPEG, PNG, and WebP formats, up to 5 MB each)
- Card templates — reusable templates you create for card formatting
Study Data
We collect data related to your study activity, including:
- Review history — timestamps, ratings (Again, Hard, Good, Easy), and the card state at the time of each review
- Spaced repetition scheduling data — stability, difficulty, interval, repetition count, lapse count, and due dates for each card, used by the FSRS algorithm to schedule your reviews
Preferences and Settings
We store your chosen settings, including:
- Theme preference (light, dark, or system)
- Accent color and font preferences
- SRS interval settings and daily new card limits
- Default card template selection
- Vacation mode status
Locally Stored Data
The Service uses IndexedDB in your browser to temporarily queue review data when you are offline. This data is stored locally on your device and is automatically synced to our servers when your internet connection is restored. We also request persistent storage permission from your browser to prevent this offline queue from being cleared unexpectedly.
Cookies
We use cookies strictly for authentication and session management. These cookies are set by Supabase (our authentication and database provider) and are necessary for the Service to function. We do not use advertising cookies, tracking cookies, or any third-party cookies for analytics or marketing purposes.
How We Use Your Information
We use the information we collect solely to:
- Provide and operate the Service (authentication, storing your flashcards, scheduling reviews)
- Sync your study progress across devices and after offline sessions
- Apply your personalization settings
- Enable data import and export features
We do not use your information for advertising, marketing, profiling, or any purpose unrelated to providing the Service.
Data Sharing and Third Parties
We do not sell, rent, or share your personal information with third parties for their own purposes.
Your data is processed by the following service providers, solely to operate the Service:
Supabase
Cloud database and authentication provider. Your account information, flashcard content, images, and study data are stored in Supabase's infrastructure. Privacy policy
Vercel
Hosting and deployment platform for the Service's website and application code. Privacy policy
If you sign in via Google OAuth, Google processes your authentication. Privacy policy
Data Security
We take reasonable measures to protect your data, including:
- Row Level Security (RLS) — enforced at the database level, ensuring that each user can only access their own data
- Encrypted connections — all data transmitted between your browser and the Service is encrypted via HTTPS
- Scoped storage — uploaded images are stored in user-specific directories with access policies that restrict access to the owning user
No method of transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.
Data Retention and Deletion
We retain your data for as long as your account is active.
You can delete your account and all associated data at any time through the Settings page in the application. When you delete your account:
- Your user account is permanently removed
- All decks, cards, tags, review history, templates, and settings are permanently deleted
- All uploaded images are permanently removed from storage
This deletion is irreversible.
Data Export
You can export your flashcard data at any time in multiple formats, including Anki (.apkg), CSV, and JSON. This ensures you are never locked in to the Service and can take your data with you.
Children's Privacy
The Service is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us and we will delete it.
Your Rights
Depending on your location, you may have the right to:
- Access the personal data we hold about you
- Correct inaccurate personal data
- Delete your account and personal data (available directly in the app via Settings)
- Export your data (available directly in the app)
- Object to or restrict certain processing of your data
To exercise any of these rights, please contact us using the information below.
California Residents
Under the California Online Privacy Protection Act (CalOPPA), California residents have the right to know what personal information is collected and how it is used. This policy fulfills that requirement. We do not track users across third-party websites, and we do not respond to Do Not Track signals because we do not engage in cross-site tracking.
Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will update the “Last updated” date at the top of this page. Your continued use of the Service after changes are posted constitutes your acceptance of the updated policy.
Contact
If you have questions about this Privacy Policy or your personal data, you can reach us at:
Email: help@koku.cards