FiveboxesPrivacy Policy
Last updated: July 26, 2026
The short version
We collect the minimum we need to run a flashcard app: your email, your decks and cards, and your study activity. We never sell your data, we don't run ad trackers inside the app, and you can export everything as CSV or ask us to delete your account at any time.
Who we are
Fiveboxes ("we", "us") is a vocabulary study service built on the Leitner box system. If you have any question about this policy or your data, email us at [email protected] and a human will reply.
What we collect
- Account data: your email address and a password. Passwords are stored only as bcrypt hashes — we cannot read them. If you sign in with Google, we receive your email address from Google; we never see your Google password.
- Study content: the decks and cards you create or import via CSV, and which starter decks you clone.
- Study activity: your review answers, each card's box position, streaks, session history, and your timezone (used only to compute daily streaks correctly).
- Purchase data: if you buy the Lifetime plan, we store your plan status and an order reference from our payment processor. Card numbers never touch our servers.
- Technical data: standard server logs (IP address, request path and time) kept for security and debugging, and one essential session cookie that keeps you logged in.
What we do not do
- We do not sell or rent your personal data to anyone.
- We do not run third-party analytics or advertising trackers inside the app.
- We do not read your decks for any purpose other than storing and showing them to you.
One exception worth being explicit about: our public pages (the homepage, the sign-up and log-in pages, and this policy) use Google Analytics to measure visits, and may use Google Ads conversion measurement, which sets a cookie so we can tell whether our ads work. Neither runs inside the app after you log in.
How we use your data
- To run the service: scheduling reviews with the Leitner method, computing streaks and statistics, and syncing your progress.
- To send transactional email: account verification, password resets, and — if we add them — optional study reminders you can turn off.
- To process Lifetime purchases and honor the money-back guarantee.
- To keep the service secure and comply with the law.
Services we rely on
- Resend — delivers our transactional emails (they process your email address to do so).
- Lemon Squeezy — our checkout and merchant of record for Lifetime purchases; they handle card details and receipts.
- Google — if you choose "Continue with Google" for sign-in, and for Google Analytics and ad conversion measurement on our public pages (never inside the app).
- Our hosting provider — the servers and encrypted backups the service runs on.
Cookies
The app uses a single essential session cookie so you stay logged in. It is not used for tracking and is not shared with anyone. Our public pages additionally set Google Analytics cookies to measure visits, and may set a Google Ads conversion cookie, as described above.
How long we keep data, and how to delete it
We keep your data for as long as your account exists. To delete your account, email us from your account address and we will remove your account and study data from the live database promptly; residual copies in backups are removed as backups rotate out on their normal schedule. Server logs are kept only briefly for security purposes.
Your rights
You can access and correct your data in the app, export your decks as CSV at any time on every plan, and request a copy or deletion of everything we hold about you by email. If you are in a region with specific data-protection rights (such as the GDPR), we honor access, portability, rectification, deletion and objection requests regardless of where you live.
Security
Passwords are hashed with bcrypt, traffic is encrypted with TLS, and we deliberately collect little — the best way to protect data is not to have it.
Children
Fiveboxes is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.
Changes to this policy
If we make material changes, we will update the date at the top of this page and notify you by email before the changes take effect.
Contact
Questions, requests, complaints: [email protected].