Privacy

• Your cards, review history and settings are private to your account. Nobody else can read them.
• When an assistant saves a word for you, Yafdeck stores the word, not your conversation. What reaches us is the vocabulary item itself and a one-way hash of it, never the surrounding chat.
• Anything you write yourself stays on your own cards and is never shown to another learner.
• Your data lives in the EU, and you can export or delete all of it at any time.
• There is no advertising, no tracking pixels and no third-party analytics.

Yafdeck is operated by an individual based in Austria.

Operator: Smile Egbai
Contact: privacy@yafdeck.com

Decklight Labs is a brand name used by the operator for software projects and products, including Yafdeck. Decklight Labs is not a separately incorporated company or legal entity.

For the purposes of this Privacy Policy, references to Yafdeck, Decklight Labs, we, us or our refer to the individual operator of the Yafdeck service unless the context indicates otherwise. The individual operator is responsible for determining how personal data collected through Yafdeck is processed, subject to applicable data-protection law.

For the purposes of the EU General Data Protection Regulation, the data controller responsible for personal data processed through Yafdeck is:

Smile Egbai
Austria
privacy@yafdeck.com

Decklight Labs is a brand used by the operator and is not a separate data controller or legal entity.

Your account. An email address and a password, handled by our authentication provider. We never see your password. It is stored as a hash we cannot reverse.

Your learning setup. The language you want explanations in, the languages you are learning, your time zone, and your preference for what happens when a deck fills up. The time zone exists so a study streak counts a day in your own calendar rather than in UTC.

Your cards and your progress. Which cards you own, any edits you have made to them, and every review you complete: the grade you gave, and when. The review history is what the scheduling algorithm runs on; without it the product cannot work.

A record of each capture. When a card is saved we log the outcome: which language it went to, whether a card was created or already existed, and whether the content came from the shared library or had to be generated. This is how we tell whether the product is working and what it costs to run.

Crucially, that record contains a hash of the word, not the word itself, and never any surrounding conversation. A hash is a one-way fingerprint. It lets us count how often something happens without storing what it was.

• Your conversations. When you connect an assistant, it sends the vocabulary it just taught you. It does not send the chat, and we do not ask for it.
• Your password. Only an irreversible hash, held by our authentication provider.
• Payment details. The service is free and takes no payments.
• Behavioural tracking. No advertising identifiers, no third-party analytics, no cross-site tracking.

Yafdeck keeps a shared library of linguistic content: words, meanings, example sentences and phrases. It exists so that when one learner looks up a word, everyone after them gets it instantly and at no cost. This library contains language, not people: it holds no account, no identity and no record of who captured what.

Content written by an AI assistant may enter that library, because it is neutral by construction. Content you write yourself never does. If you type your own example sentence or your own wording for a meaning, it is stored against your card alone and is never offered to another learner. That is enforced in the database, not just stated here.

Editing a card changes only your copy. If you report shared content as wrong, we may stop offering it to other learners, but your report is not published.

You can allow an assistant such as ChatGPT to save words into your decks. When you do, you approve it on a consent screen and we issue it a token limited to the permissions shown there. That app never receives your password, and it can only reach the languages you are learning.

You can see everything you have connected, and disconnect any of it, under Settings. Disconnecting takes effect immediately.

We keep this list short on purpose.

• Supabase for the database and authentication. Your data is stored in their Frankfurt region.
• Vercel for hosting the application, served from Frankfurt.
• Anthropic, used only when a word is not already in the shared library and has to be written. What is sent is the word and the language, nothing about you. This is not used to train their models.

We do not sell your data, and we do not share it with anyone beyond the processors above.

Your data is stored in the European Union. We keep it for as long as your account exists. Delete your account and your private data is removed: cards, review history, settings and connected apps.

Shared library content does not carry your identity and is not deleted along with your account: a sentence generated years ago is language, and removing it would break the cards of everyone else using it.

Under the GDPR you can ask for a copy of your data, correct it, delete it, restrict how it is used, or object to that use. Two of those are buttons rather than requests:

• Export, Settings offers a CSV of every card you own, including archived ones.
• Delete, deleting your account removes your private data.

For anything else, write to privacy@yafdeck.com. You also have the right to complain to your local data protection authority.

Yafdeck sets one kind of cookie: the one that keeps you signed in. There are no advertising or analytics cookies, which is why you are not being asked to accept anything.

Yafdeck is not intended for children under 13, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will remove it.

If this policy changes in a way that affects you, we will say so in the app before the change takes effect rather than quietly updating the date at the top.