// WEBSITE_PRIVACY_POLICY
Privacy Policy for qrflashcards.com
Effective: October 7, 2026 · Covers this website only. Looking for the Android app's privacy policy instead?
This website lets you create an account, publish decks to the community library, and browse, download, and rate decks other people have published. Unlike the companion Android app — which works entirely offline with no account and no server — this website does run its own backend, because accounts and a shared community library require one. This page explains exactly what that backend stores and why.
Overview
You can browse and download community decks without an account. Creating an account is only needed to publish your own decks, rate decks, or manage a profile.
The site runs on Cloudflare Pages with a Cloudflare D1 database. There are no third-party analytics, tracking, or advertising scripts anywhere on this website — see Section 6.
Account information we collect
If you create an account, we store:
- Your email address — used only to log you in and identify your account. Never shown publicly.
- Your password — we never store the actual password. It's run through PBKDF2 (a one-way, salted hash) before it touches the database, so we can verify a login attempt but can't recover or see your real password.
- A display name — shown publicly next to any decks you publish and on your profile page.
- The date you created your account, and the timestamps you accepted the Terms of Service and Deck Publishing Terms.
We don't ask for your real name, address, phone number, or payment details — the website has no purchases.
Content you publish is public
A deck's name, description, category, tags, flashcard questions & answers, and quiz questions are all public the moment you publish it — anyone can browse, download, or scan the QR code for it, logged in or not. Don't put anything in a deck's content you wouldn't want publicly visible.
Cookies & sessions
Logging in sets a single session cookie that just keeps you signed in — it's marked HttpOnly and Secure, can't be read by page scripts, and expires automatically after 30 days. We don't use tracking, advertising, or cross-site cookies of any kind.
Ratings & reports
Rating or reporting a deck doesn't require an account. To stop the same person from rating or reporting one deck over and over, we take your IP address, run it through a one-way salted hash specific to that deck, and store only that hash — never the IP address itself. The hash can't be reversed back into an IP address, and it isn't linked to any account.
What we don't do
- No ads — this website doesn't run AdMob, Google Ads, or any ad network. (The companion Android app does; see its own privacy policy.)
- No analytics or tracking scripts — no Google Analytics, no third-party pixels, no fingerprinting.
- No selling or sharing your personal data with third parties, ever.
Who can see what
| Visible to | What they can see |
|---|---|
| Anyone (public) | Your display name, member-since date, aggregate stats (deck count, total downloads), and any decks you've published — never your email. |
| Site admins | Your email address and account status, used solely to respond to reports and moderate abuse (e.g. banning an account for violating the Terms of Service). Never shown to other users or made public. |
Data retention & account deletion
You can permanently delete your account yourself at any time from the "Danger Zone" on your own profile page, with your password as confirmation. That immediately and permanently erases your email, password, and active sessions from our database.
Decks you've already published stay in the community library — they're public content other people may be studying from — but ownership is cleared, so nothing in our database points back at your deleted account. If you'd rather have a specific deck taken down entirely instead of just unlinked, delete it from your profile before deleting the account, or email us at the address in Section 11.
Children's privacy
This website is not directed at children under 13, and account creation is not intended for them. We don't knowingly collect personal information from children under 13; if we learn an account belongs to a child under 13, we'll delete it.
Changes to this policy
If this policy changes, the updated version will be posted at this same page with a new effective date above. Continued use of the website after a change means you accept the revised policy.
Contact
Questions about this policy, or requests about your account data, can be sent to:
[email protected]