Privacy policy
Last updated 11 October 2026
- Without an account, your decks and progress stay in your browser on your device. We never receive them.
- With an account, we store your email address and your decks and cards so they can sync between your devices. Nothing is shared or public.
- Your grade history never leaves your device.
- No ads, no tracking cookies, no selling or sharing of your data.
- You can export everything or delete your account at any time from Settings.
Who runs Lietner
Lietner (https://lietner.app) is run by Ahmed Eltigani, Wyoming, United States ("we"). We are the controller of the personal data described here. Contact: hello@lietner.app.
Using Lietner without an account
Anyone can use every feature except sync as a guest. Your decks, cards, progress and settings are kept in your browser's storage (IndexedDB) on your device and are not sent to us. If you clear your browser's site data, they are gone, so export a backup from Settings now and then. The only things we receive from guests are aggregate page-view counts and crash reports, described below, neither of which identifies you.
What we store if you create an account
| Data | Why |
|---|---|
| Your email address. If you sign in with Google: your Google account ID, email address, name and profile picture link, as Google shares them. | To create your account and sign you in. |
| Your decks and cards: deck names, the front and back text of each card, which box it is in, when it is next due, and when it was created, changed or deleted. | To sync your decks and progress between your devices. |
| Sign-in records kept by our authentication provider: time of sign-in, IP address and browser type. | To keep accounts secure and prevent abuse. |
We do not store your grade history (the record of each "Knew it" or "Missed"), your animation speed or which deck you opened last: those stay on each device. Cards are text only; we don't accept uploads.
Legal bases
- Providing sync to account holders is necessary to perform our agreement with you (GDPR Article 6(1)(b)).
- Security records, aggregate page views and crash reports are based on our legitimate interest in running a safe, working app (Article 6(1)(f)). You can object at any time by contacting us.
Page views and crash reports
Vercel Web Analytics counts page views in aggregate. It sets no cookies and does not follow you across sites. Sentry receives a report when the app crashes: the error, the code that failed, and your browser and operating system. IP address storage is turned off, session replay is off, and card text is removed before a report is sent.
Cookies and browser storage
Lietner uses no advertising or tracking cookies, so there is no cookie banner. It uses your browser's storage only for things the app needs to work: your decks (IndexedDB), your sign-in session if you have an account (local storage), and a copy of the app so it works offline (service worker cache).
Who processes your data for us
| Provider | What for | Where |
|---|---|---|
| Supabase | Database and sign-in for accounts | EU (Dublin, Ireland) |
| Vercel | Hosting the website, aggregate page views | Global network; US company |
| Resend | Sending sign-in code emails, and receiving email sent to hello@lietner.app | US company; EU (Ireland) sending region |
| Sentry | Crash reports | EU data region |
| Only if you choose "Continue with Google"; Google's own privacy policy also applies | Global; US company |
Each provider processes data only on our instructions. Where data is handled outside the EU/EEA, the transfer relies on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses. Guests' decks are never sent to any of them, and the Google sign-in script loads only when you open the sign-in screen.
What we never do
No ads. We don't sell your data, share it for marketing, make it public, or use your cards to train AI models.
How long we keep data
- Account data is kept while your account exists.
- When you delete a card or deck, its text is removed from our database right away. A small record (its ID and timestamps) stays so your other devices learn about the deletion, until you delete your account.
- When you delete your account, your account and every deck and card in it are deleted from our database immediately. We do not keep server backups.
- Sign-in records and crash reports are kept for a limited period (crash reports for 30 days; sign-in logs for the few days Supabase keeps its logs), then deleted.
Your choices and rights
- Export: Settings → Export JSON downloads all your decks and cards.
- Delete: Settings → Delete account deletes your account and its data. Your other devices sign out at their next sync.
- You can also ask us to access, correct, delete or hand over your data, or to restrict or stop processing, by emailing hello@lietner.app. We answer within one month.
- You have the right to complain to a data protection authority, for example the one where you live.
Children
Accounts are for people aged 13 or older, or the minimum age for consenting to online services where you live if that is higher (up to 16 in parts of the EU). Anyone may use Lietner as a guest, which sends us no personal data. If we learn that an account belongs to someone below the required age, we delete it.
Security
Everything travels over HTTPS. The database only lets each account read and change its own rows. We keep as little data as the app needs.
Changes
If we change this policy, we update the date at the top. Significant changes are announced in the app before they apply.
Contact
Questions or requests: hello@lietner.app.