Privacy policy

01Who is responsible

Dex is built and operated by an individual developer, Illia Pavelko. For the purposes of the EU and UK General Data Protection Regulation, that's the data controller for everything described on this page.

The contact address for any privacy question is [email protected], and a postal address is available on request. There's no separate data protection officer — Dex isn't large enough to require one, so your email reaches the person who wrote the code.

02What we collect

Three kinds of data: what you tell us when you sign up, what you create while studying, and a small amount of technical data needed to keep the service running and secure.

Signing in with Google or Apple

You can sign in with Google or Apple instead of a password. In either case we never receive your password for that account, and we don't touch any other service you have with them — no mail, contacts, files, photos or calendars.

Google. We store your Google account identifier and the email address Google shares with us, so we recognise you next time.

Apple. We store your Apple user identifier, the email address Apple shares with us, and — if you allow it the first time you sign in — the name Apple passes on, which becomes your display name. Apple only ever sends a name once, so if you decline it we simply don't have one.

We also keep the token Apple issues for your account, for exactly one reason: Apple requires an app offering account deletion to revoke that token when you delete your account, and revoking one requires having it. It is never used to read anything from Apple, and it goes when your account does.

Study activity

We record which cards you reviewed and when, how you rated each one, how long each card was on screen before you rated it, and the resulting scheduling state — difficulty, stability and next due date. This exists to decide what to show you next and to show you your own study history, such as how many minutes you studied on a given day. It is not used to profile you, and nothing about it is automated decision-making in the GDPR sense.

Files you upload for AI card generation

Dex can build cards from a photo or document you pick. If you use it, the file is uploaded, held in memory only, and passed to an AI provider to extract the text.

Translation suggestions

When you ask for a translation suggestion, the short piece of text you're translating goes to an AI provider. Suggestions are cached on our servers so the same phrase doesn't need translating twice — that cache holds the text and its translations, with nothing tying it to you.

Card audio

Tapping the speaker on a card sends that card side's text to Google Cloud Text-to-Speech, which returns a recording. The audio is cached on our storage in Germany under a name derived from a cryptographic hash of the text and the voice used — not from you, your account or your deck. Cached audio therefore carries no link to your identity, and two people writing the same card reuse the same file. We keep only aggregate monthly counters to stay inside a usage budget.

Nothing is synthesised in advance. Audio is generated only when you press play.

Technical and security logs

Our servers keep ordinary operational logs — IP address, browser or device type, timestamp, and which API endpoint was called — to keep the service running and to investigate faults and abuse. They're deleted automatically after 30 days.

Usage statistics

To understand how many people use Dex and whether they come back, we record, for each day you use it, that you were active that day and on which platform (web, iOS or Android). We work out the platform from the type of app or browser making the request and store only that one word. Nothing else is kept, so there is no record of which screens you opened or what you did. These records stay on our own servers, are never shared, are only looked at as totals (such as how many people were active this week), and are deleted with your account.

What we don't collect

• No advertising or marketing identifiers.
• No location data, contacts, calendar, microphone or health data.
• No camera access. AI card generation reads a photo or file you pick yourself.
• No analytics or crash-reporting SDKs — there are none in the app at all.
• No cross-app or cross-site tracking, so nothing to ask you to consent to.

03Decks you share publicly

Every deck starts private. Nothing you create is visible to anyone else unless you deliberately publish it. On the Dex website you can switch a deck to public, which gives it a link at dex.cards/d/… that anyone can open without a Dex account.

Public really does mean public

• Search engines can index a shared deck. The page is crawlable, so its title, description and card text may show up in Google and other search results.
• Other people can copy it. A signed-in visitor can add a public deck, which puts an independent copy of its cards in their own account.

Making a deck private again

You can flip a deck back to private at any time, and it immediately stops being viewable. What that can't do is undo copies people already made — those belong to their accounts and stay there — and search engines may take a while to drop the page from their results.

04Data stored on your device

Some things stay on your own device and never reach us:

• Sign-in tokens — in the iOS Keychain or Android Keystore on mobile, and in your browser's local storage on the web, so you don't have to log in every time.
• A local cache of your decks and cards, so studying keeps working when you're offline or on a bad connection.
• Your interface language preference.

Deleting the app, or clearing your browser's site data, removes all of it.

05Legal bases

Under Article 6 GDPR, everything we do with your data rests on one of these:

Where we rely on consent you can withdraw it at any time, without affecting anything that already happened. Not using the optional feature, or setting a deck back to private, is all that takes.

06Who your data is shared with

We don't sell, rent or trade personal data, and we don't share it for advertising. A short list of providers handles infrastructure and optional features on our behalf:

Your account and content are stored in Germany. When an optional feature sends something to a US provider, that transfer is covered by the European Commission's Standard Contractual Clauses and the provider's own commitments. Content sent to the AI providers for these features is not used to train their models.

We may also disclose data where the law genuinely requires it — for example a valid court order.

07How long we keep it

08Deleting your account

You can delete your account yourself, at any time, from inside the app: Profile → Delete account. You confirm once. No support ticket, and no waiting on a human.

• Your folders, decks, cards, study history and progress are removed immediately.
• Any linked Google or Apple sign-in record goes with it. For Apple, we also revoke the token Apple issued for Dex, so the link is severed on Apple's side too.
• Public deck links stop resolving immediately.
• Encrypted backups age out on their rolling schedule.

This cannot be undone. If you'd rather we did it for you, email [email protected] from the address on the account.

09Your rights

If you're in the EEA or the UK, the GDPR gives you the rights below. Similar rights exist in many other places, and we apply them to everyone regardless of where you live.

• Access — get a copy of the personal data we hold about you.
• Rectification — correct anything inaccurate.
• Erasure — have your data deleted, as in section 8.
• Portability — receive your decks and history in a machine-readable format.
• Restriction & objection — ask us to pause or stop a particular use.
• Withdraw consent — for any optional feature, at any time.

Email [email protected] and we'll respond within 30 days. You also have the right to complain to your local data protection supervisory authority.

10Security

• Encrypted in transit — all traffic between the apps and our servers runs over HTTPS/TLS.
• Passwords are hashed with bcrypt, never stored in readable form. We can't recover one for you, only reset it.
• Sign-in tokens live in secure device storage — the iOS Keychain or Android Keystore.
• Backups are encrypted and stored separately from the live database.
• Access to production systems is limited to the operator.

No system is perfect. If a breach puts your data at risk, we'll notify the supervisory authority and tell you directly, as the law requires. If you've found a security problem, please email [email protected].

11Children

Dex isn't directed at children under 13, and we don't knowingly collect personal data from them. There's no advertising, no profiling, and no social feature that could put a younger user in contact with strangers.

If you're a parent or guardian and believe a child has created an account, email [email protected] and we'll delete it and its contents.

12Changes to this policy

When this policy changes, the "last updated" date at the top changes with it. For anything material — a new category of data, a new provider, a new purpose — we'll announce it in the app or by email before it takes effect.

13Contact