Last updated: October 2026.

A flashcard app stores things by definition — your cards, your schedule, your lapse history. The question is where it stores them. FlashDeck’s answer is: on your device, in your browser, and nowhere else.

Your decks live in localStorage — here’s what that means

Every deck you create is written to your browser’s localStorage as a small JSON record under keys like flashdeck.v1.deck.<id>. localStorage is a per-site, per-browser, per-device store: the data is readable only by pages on this site’s origin, it persists across visits, and it is never transmitted to us — there is no endpoint that could receive it.

Practical consequences, stated plainly:

• We cannot read your decks. Not the card text, not your grades, not your schedule — they don’t exist on our side.
• You can inspect and erase them yourself. Your browser’s dev tools show every key; “clear site data” deletes all of it permanently. Export CSV from any deck’s Manage view if you want a copy first.
• Other people using this browser profile could see the decks in the same way they could see your open tabs — a shared-profile caveat, not a leak.
• Clearing site data, using private windows, or switching browsers/devices loses the decks. That’s the trade for zero accounts; the CSV page is the backup path.

What reaches our infrastructure

FlashDeck is static files served by Cloudflare. When your browser fetches a page, Cloudflare processes routine request metadata — IP address, user agent, timestamp, requested URL — to deliver the file and defend the site. We run no fingerprinting, no account system, and no server-side storage of study data; the only analytics beacon is the small cookieless page-count ping described on this page. Grades and scheduling never leave the page that computes them.

Usage counts

The only analytics here is a small cookieless ping per page view. It sends the page address, the referring site’s domain, the page language and any campaign tag in the link, and when you leave it sends how many seconds the page was open.

When it arrives, our server adds the time, the country and network provider Cloudflare reports, a device type guessed from your browser’s user-agent (phone, tablet, desktop or bot), what kind of source the visit came from, and a label for filtering out automated traffic. For a count of visitors per day, it saves a hash of your IP address, browser, the date and a secret value instead of the IP itself; the hash is different every day. Grades, test results and anything else you enter are not sent, and there are no cookies.

Advertising

If ads are enabled on this site, third-party networks such as Google AdSense may set cookies or similar identifiers to serve and measure advertising, and — where permitted — to personalize it. You can disable personalized ads in Google’s Ads Settings or with a content blocker; the app behaves identically either way. Ad code cannot read your decks: it sees page context, not localStorage contents.

Questions and changes

Privacy questions: hello@tolerence.net or the contact page. If this policy changes, the updated text replaces this page with a new “last updated” date.