Privacy

Your learning progress is saved in your own browser. You can use the whole free course without an account, and without giving us anything at all. If you do make an account, we hold your email address and a backup copy of your progress, and you can delete both at any time.

Every card you review, your schedule, your streak and your settings are stored using your browser’s local storage, on your device. Without an account this data is never transmitted to us and we cannot read it.

Two consequences worth understanding. Your progress does not follow you between devices, so your phone and your laptop keep separate histories. And if you clear your browser data, use private browsing, or switch browsers, that progress is gone and we have no copy to restore. The settings page has a backup export you can use to keep your own copy.

Signing in is by a link sent to your email address, so we never handle a password. We store your email address and a copy of your progress bundle: which cards you have seen, their review schedule, your daily activity counts and your settings. That is the whole of it. We do not store your name, and we never ask for one.

Your browser stays the original; the cloud copy is a backup that lets your progress follow you between devices. Nobody but you can read it. Access is enforced by the database itself rather than by our application code, so a bug in the app cannot expose one person’s progress to another.

Payments are handled entirely by Stripe. Your card number never reaches our servers and we could not store it if we wanted to. What we keep is the identifier Stripe gives us for your customer record, your plan, whether it is active, and when the current period ends. That is what tells the course to unlock, and it is all we need.

Stripe holds the billing information itself, including your card and your billing address, under its own privacy policy. Receipts come from Stripe to the email address on your account.

If you report a problem with a card, we receive the text you write, the identifier of the card you were looking at, and the category you chose. That is stored in a private spreadsheet we use to fix the course, and it is not published or sold. Please do not put personal information in the feedback box, since there is no reason for us to have it.

To stop the form being flooded, your IP address is held briefly in server memory to count recent submissions. It is not written to disk and it disappears when the server restarts.

We use a small number of services, and each one only sees what it needs to do its job.

Vercel hosts the site and keeps standard server request logs, including IP addresses, for security and reliability. Its analytics measures page views and loading speed in aggregate, without cookies and without building a profile of you. Supabase stores accounts and the progress backup described above. Stripe processes payments. Google Sheets receives card feedback. We do not run advertising or third-party tracking scripts of any kind, and we do not sell or share your data with anyone.

The course sets no tracking or advertising cookies, and there is no cookie banner because there is nothing to consent to. Signing in stores a session in your browser so you stay signed in, and site analytics is measured without cookies. The only other cookie the site can set is an administrative one we use to reach internal tooling, never set for ordinary visitors.

Your account and its progress backup are kept for as long as the account exists. If a subscription ends, the backup is retained for 90 days so that resubscribing restores your progress, and the free course keeps working from your browser throughout. Records of payments are kept for as long as tax and accounting rules require.

You can delete your account yourself from the settings page. It removes the account, your email address and your progress backup immediately, and it cancels any subscription. If you cannot sign in, write to support@kvela.app from the address on your account and we will do it for you and confirm when it is done.

Deleting the cloud copy does not touch the progress in your own browser, which stays until you clear it. If you want to keep your history before deleting, export it from the settings page first; that file is yours and it can be imported back at any time.

You can ask us for a copy of what we hold, ask us to correct it, or ask us to delete it. The export button on the settings page already gives you your progress in a portable file without having to ask. For anything else, write to us at the address above.

If you are in the UK or the EU, you also have the right to complain to your data protection authority.

The course is not directed at children under 13, and no account is required to use the free levels. We do not knowingly collect information from children.

If this policy changes materially, the date at the top of this page changes with it, and anyone with an account is told by email before the change takes effect.

Kvela is operated by Kvela LLC, which is the data controller for everything described here. Questions about privacy, or a deletion request: support@kvela.app. The refunds and cancellation page covers what happens to your data when a subscription ends.