Data Sovereignty

Privacy Policy

1. Introduction

Welcome to Open Study Deck ("we", "our", "us"). This Privacy Policy explains what happens to your information when you use our study studio. Open Study Deck uses a browser-first architecture: we do not operate an account database or a cloud database for your decks. That said, the app does rely on a handful of third-party services (Google Gemini, FormSubmit, Razorpay, and a few CDN-hosted libraries) to function, and this page explains exactly what each of them sees.

2. No Account Database

Open Study Deck has no user-account system and no cloud database of your decks. There is no signup, login, or profile. We do not collect an email address, name, or other identifying information just to let you use the study tools.

3. Two Ways to Generate a Deck

Open Study Deck offers two access modes, and they handle your content differently. Your library and interface state remain browser-first either way — AI generation itself always requires sending content to Google Gemini, either directly in BYOK mode or through the protected Open Study Deck guest gateway. Neither mode should be described as fully local.

4. Guest Access (no API key)

  • The text or image you submit is sent from your browser to an Open Study Deck Cloudflare Function.
  • That Function forwards your content to Google Gemini using a shared, server-side credential and returns the generated deck to your browser.
  • Open Study Deck does not intentionally retain your submitted content or the generated response — there is no database storing guest generations.
  • Cloudflare and Google process the request as infrastructure/service providers under their own applicable terms.
  • Guest Access is protected by Cloudflare Turnstile, a bot-verification challenge. Turnstile runs in your browser and is verified server-side before any request is processed.
  • To enforce a daily generation limit, Open Study Deck temporarily stores a salted, one-way hash of your IP address plus the current date in Cloudflare KV, along with a generation count. Your raw IP address is never stored. This record automatically expires and is used only for quota enforcement, not identification.
  • Ordinary server metadata (such as request logs) may exist transiently at the Cloudflare/Google infrastructure level, outside of any Open Study Deck-controlled database.

5. Bring Your Own Key (BYOK)

  • By default, your Gemini API key is kept in your browser's sessionStorage for the current tab, and clears when that tab or browser session ends.
  • If you check "Remember this key on this device," the key is instead saved in your browser's localStorage so it persists across visits on that browser. Only enable this on a device you trust.
  • Your key and your submitted text/image are sent directly from your browser to the Google Gemini API over HTTPS. Open Study Deck does not proxy, intercept, or receive the BYOK request — it never touches an Open Study Deck server.
  • Google processes that content and key according to its own applicable terms and privacy policies, which we do not control. Review Google's terms if you have concerns about sensitive material.
  • Open Study Deck does not retain a copy of what you submit or what Gemini returns. The generated result is rendered and stored only in your browser.

6. Local Browser Storage & Data Retention

Your generated study decks, theme/model/access-mode preferences, and (in BYOK mode, depending on your "Remember this key" choice) your API key are stored locally in your browser using localStorage and/or sessionStorage. This data can be erased by you at any time — via the "Clear Key" or "Clear All Decks" buttons in Settings — and can also be erased by ordinary browser behavior you don't control from our side: clearing site data, browser cleanup tools, private/incognito sessions ending, or switching to a different device or browser.

7. Cookies & Analytics

Open Study Deck uses consent-based Google Analytics (measurement ID G-LTBKKM734X) to understand aggregate product usage, such as which study modes are used and whether generation succeeds. It is implemented with a Basic Consent Mode approach:

  • Analytics is not loaded and no request is sent to Google until you click "Allow Analytics" on the consent banner shown on your first visit.
  • If you decline (or take no action), Analytics stays unloaded and no Analytics cookies or requests occur.
  • When enabled, Analytics is limited to ordinary page-view and product-event measurement. We do not enable advertising features, Google Signals, or personalized-advertising signals, and we do not create a user ID.
  • Study content, generated answers, API keys, filenames, deck titles, subject context, pasted text, image data, email addresses, donation messages, and raw error messages are never intentionally sent as analytics data. Custom events use only controlled values like a study mode name or a generic failure category.
  • You can change your decision at any time via the "Analytics Preferences" link in the site footer. Declining after previously allowing Analytics stops future events and attempts to remove first-party Google Analytics cookies from your browser.

8. Information You Voluntarily Provide

Some parts of the site collect information only because you choose to submit it:

  • Contact form: the name, email address, and message you enter are sent via FormSubmit to the developer's inbox.
  • Donations: if you choose to support the project financially, payment details are handled by Razorpay's checkout flow. Open Study Deck does not directly collect or store your card or payment information.

9. Third-Party Services

The application currently relies on the following third-party services. Each can receive ordinary technical request information (such as your IP address, browser/user-agent string, and the resource requested) as a normal part of serving their content, in addition to anything described above:

  • Google Gemini API: processes the text/images and, in BYOK mode, your API key, to generate study decks. Governed by Google's terms and privacy policy.
  • Cloudflare (Pages Functions, KV, Turnstile): hosts the Guest Access gateway, temporarily stores hashed guest-quota records, and verifies the Turnstile bot-protection challenge.
  • Google Analytics: aggregate product analytics, loaded only after you grant consent. See Section 7.
  • FormSubmit: forwards Contact page submissions (name, email, message) to the developer's inbox.
  • Razorpay: processes payment information for voluntary donations.
  • Google Fonts: serves the Inter and JetBrains Mono webfonts used across the site.
  • jsDelivr: a CDN used to load the html2canvas library and the Google GenAI SDK used to call Gemini in BYOK mode.
  • Tailwind CDN: loads Tailwind's utility CSS engine used for portions of the layout.

10. AI-Generated Content

Study decks are generated by an AI model and can be inaccurate, incomplete, or outdated. Always verify important facts before relying on generated content for exams or academic submissions.

11. Contact Us

If you have any questions regarding this Privacy Policy, you can reach out via our contact portal or by emailing the developer directly at harukiwaves@zohomail.in.