Privacy

If you don't sign in, everflip stores everything in your browser's localStorage. Nothing leaves your device. There is no account, no server, no tracking.

If you sign in with Google, we store the following on our server so your progress survives across devices and browser cache clears:

• Your Google account email, display name, and profile picture URL
• Your spaced-repetition state per card (due date, difficulty, stability, review history)
• Your daily counters (new cards introduced today, review limit, etc.)
• If you create child profiles, their names, ages, avatars, and per-language card progress
• If you create custom decks, the deck names, descriptions, card content, and your display preferences
• Which built-in decks you've chosen to hide
• If you request a deck review, Arthur (admin) sees that deck's contents and your email until the request is completed

That's it. We do not use advertising trackers, third-party cookies, session recording, or any cross-site tracking. We do not sell or share your data.

Anonymous counts

To learn which languages people want — so we know which courses to build out next — we keep a few anonymous tallies: how many times a language was started, how many home visits there were, and how many people signed in, each per day. These are plain numbers ("Swahili started 42 times today"). They carry no account id, no IP, no cookie, and no session — nothing that can be tied back to you, signed in or not.

Where it lives

Authentication runs through Auth.js (NextAuth) with Google as the only provider. User data is stored in a managed PostgreSQL database (Neon). The database is hosted in the EU.

How to delete your data

Email arthur.brejon@gmail.com and I'll wipe your account and all associated card state within a few days. You can also revoke everflip's access from your Google account permissions page.

No creepy tracking, by design

There are no ad networks and no third-party trackers — no one is following you across the web. Your study progress lives in your browser (and, only if you sign in, in your own synced account). The only thing we collect is the anonymous per-day counts described above, which can't identify anyone.

Last updated: 2026-06-03.