Privacy

Vercel Web Analytics records anonymous page views, broad referrers, country, device type, and a small number of coarse interaction events. It uses no third-party analytics cookies and does not receive deck codes, card lists, search text, feedback answers, account data, or API keys from this site.

To understand whether the tools are useful over time, this browser keeps a random anonymous identifier. The server stores only a keyed hash of it alongside daily aggregate membership, validation outcomes, and short-lived correction journeys. Deck and lineup uniqueness use keyed fingerprints; raw deck codes are not retained in analytics. Pseudonymous daily data is retained for up to 13 months and active correction journeys for up to 31 days.

Metrics are approximate: separate browsers count separately, clearing storage creates a new identifier, and privacy tools can block events. Raw IP addresses are never stored for analytics.

Google sign-in collects a verified email, display name, and Google subject. We do not store Google access or refresh tokens. Identity is keyed by Google issuer plus subject, never by email alone.

API keys are shown once. Only a hash is stored. Usage counters and hashed client IPs are kept in short-lived Redis windows for rate limits. Backups of the developer store can include emails, names, and key hashes.

You can revoke keys or delete the developer account from the dashboard. Deletion revokes active keys and removes the live profile. Encrypted backups may retain copies after live deletion; access and disposal follow the operator’s backup policy. Revoked key metadata and pseudonymous security audit events may remain in the live store for operational integrity; they do not contain the plaintext key or Google subject.

Contact the site operator through the Community page if you need help with deletion or a quota question.