Privacy Policy
Decked — Daily System Design Practice · Last updated: October 12, 2026
This policy explains what personal data Decked ("we", "us") collects when you use decked.pages.dev, why we collect it, and the rights you have under the EU General Data Protection Regulation (GDPR) and similar laws.
1. Who is responsible for your data
The data controller is Decked, an independent project operated by Vinit Asher. For any privacy question or request, contact vinitasher@gmail.com.
2. What we collect and why
You can practice without an account. Without one, we use a random device identifier stored in your browser to keep your progress and daily limits working.
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Device identifier (random, stored in your browser) | Keep progress, bookmarks, and daily usage limits working without an account | Legitimate interests (running the service you request) |
| Account details from GitHub (account ID, email) — only if you sign in | Sync progress across devices and manage your Pro plan | Performance of a contract |
| Learning data (progress, answers, bookmarks, custom cards, session state) | Adaptive practice and spaced repetition | Performance of a contract / legitimate interests |
| Subscription data (Stripe customer and subscription IDs, plan status) — only for Pro | Process your subscription; we never see or store your card number | Performance of a contract |
| Advertising data (cookies and identifiers set by Google AdSense) — free tier only | Show ads that keep the free tier available | Consent (EEA/UK/Switzerland); legitimate interests where permitted otherwise |
| Server logs (IP address, request time, requested page, quota counters) | Security, abuse prevention, reliability, and enforcing daily limits | Legitimate interests |
| Feedback you send | Respond to feedback and improve the app | Consent / legitimate interests |
AI generation. Card content is generated with AI assistance. When you request a card, the topic or scenario text you provide is sent to our AI provider to produce the content. Do not include personal information in custom scenarios.
Feedback. Feedback you submit may be filed as a public issue in our GitHub repository. Do not include information you do not want published.
3. Cookies and local storage
We use your browser's local storage for essential features (device identifier, theme choice, cached cards, session state). We do not set our own tracking cookies.
Advertising cookies are set by Google AdSense on the free tier. In the EEA, UK, and Switzerland, personalized ads are shown only with your consent through Google's consent message, and you can change or withdraw your choice at any time using the consent controls on the page. Pro subscribers see no ads.
4. Who we share data with
We use service providers that process data on our behalf:
- Cloudflare — hosting, key-value storage, and network security
- Supabase — sign-in and account authentication
- Stripe — payment processing and subscription management
- Google AdSense — advertising on the free tier
- AI model providers — generating card content from the topic you request
- GitHub — issue tracking for feedback you submit
We do not sell your personal data. Some providers process data outside the EU/EEA; where they do, transfers rely on appropriate safeguards such as the EU Standard Contractual Clauses or an adequacy decision (for example, the EU-US Data Privacy Framework).
5. How long we keep data
- Device identifiers and daily quota counters: short-lived (counters expire after about three days)
- Learning data: until you clear it or ask us to delete it
- Account data: until you ask us to delete your account
- Payment records: as long as tax and accounting obligations require
- Server logs: a short period for security and troubleshooting
6. Your rights
If you are in the EU/EEA (and in similar jurisdictions), you have the right to:
- access the personal data we hold about you
- correct inaccurate data
- delete your data (the right to erasure)
- restrict or object to processing
- receive your data in a portable format
- withdraw consent at any time, for example for personalized ads
To exercise any of these rights, email vinitasher@gmail.com. You also have the right to lodge a complaint with your local data protection supervisory authority. You can clear device-based data yourself at any time from your browser settings.
7. Children
Decked is not directed at children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us data, contact us and we will delete it.
8. Changes to this policy
We may update this policy as the service evolves. The current version is always posted here with its update date.