Privacy Policy

Floradeck is operated by the Floradeck project maintainer. For privacy requests, contact privacy@floradeck.com.

• Account data: name, email address, password hash for email sign-in, Google account identifier when Google sign-in is used, and authentication sessions.
• Learning profile data: active language, learning mode, vocabulary source, level choices, progress, daily goal, streak, and SUN/XP counters.
• Vocabulary data: saved word states, imported Anki or CSV terms, saved deck settings, dictionary lookup state, queued flashcard drafts, and Anki-compatible exports.
• Reading and review data: generated stories, reader progress, story choices, answers, SRS cards, review logs, contextual review sessions, speaking sessions, and related learning events.
• AI generation inputs and outputs: prompts, topics, levels, vocabulary context, generated stories, generated review extracts, diagnostics, and provider metadata.
• Device and technical data: authentication cookies, local preference storage, request metadata, server logs, and error diagnostics needed to operate and secure the service.

• Provide accounts, sign-in, saved learning progress, vocabulary tracking, reading sessions, and Anki-compatible import/export.
• Generate prototype language-learning stories, review extracts, speaking prompts, and feedback.
• Maintain security, prevent abuse, debug failures, and improve the reliability of the prototype.
• Respond to support, access, export, and deletion requests.

If you choose Google sign-in, Floradeck uses Google only to confirm your account identity. Floradeck requests basic OpenID profile information: your verified email address, display name, and Google account identifier. Floradeck does not request access to Gmail, Drive, Calendar, Contacts, or other Google content.

When remote AI generation is enabled, Floradeck may send your prompt, selected language, level, topic, known vocabulary, target words, and relevant learning context to the configured AI provider. Floradeck does not intentionally send your account email or password to AI providers. Generated content is a prototype aid and may be inaccurate.

The current server supports OpenAI and Gemini provider configurations. For a public 13+ deployment, OpenAI is the preferred remote provider. Gemini should only be enabled if its current terms fit the intended audience and deployment.

Floradeck does not sell personal data. Data may be processed by service providers used to operate the app, including:

• Hosting and deployment providers, such as Vercel.
• Database providers configured for the production deployment.
• Google, when you use Google sign-in.
• OpenAI or Gemini, when remote AI generation is configured and you request generated content.

• floradeck_session: essential sign-in session cookie.
• floradeck_google_state: short-lived Google OAuth state cookie used to protect sign-in redirects.
• Local storage preferences: theme, palette, legacy theme, and labs setting.

Floradeck does not currently use advertising cookies. If analytics or marketing tools are added, this policy will be updated.

Account and learning data is kept while your account exists or while needed to operate the prototype. Auth sessions expire after a limited period. You can request deletion of your account and associated learning data by emailing privacy@floradeck.com. Some server logs, backups, or security records may be retained for a limited period.

• You can use email/password sign-in instead of Google sign-in.
• You can export vocabulary and Anki-compatible data through app features where available.
• You can avoid entering sensitive personal information into prompts, imports, notes, or generated-content fields.
• You can request access, correction, export, or deletion by email.

Floradeck is for users aged 13 and older. If you are under the age of majority where you live, use Floradeck only with permission from a parent or guardian.

Some bundled vocabulary data comes from third-party sources and is described on the third-party notices page.