Terms, privacy, and cookies

1About ChemDeck

ChemDeck ("the app", "we", "us") is a free flashcard study tool for organic chemistry, built and maintained as an independent project. It is not affiliated with, endorsed by, or operated on behalf of any university, publisher, exam board, or employer.

The app runs entirely in your browser. It is hosted as a static site, and it uses Google Firebase for sign-in and for storing your flashcards.

2Accepting these terms

You are asked to accept these terms once, the first time you sign in. Ticking the box on the confirmation screen means you have read this page and agree to it. If you do not agree, do not sign in.

If these terms change materially, the version number at the top of this page changes, and you will be asked to read and accept the new version the next time you open the app. Until then, you will not be asked again.

You must be old enough to agree to a contract where you live, and at least 13 years old. If you are under 16 in the UK or the EEA, please ask a parent or guardian before signing in.

3Your account and email

ChemDeck has no passwords of its own. You sign in with Google, and Google tells the app three things about you: a unique account identifier, your email address, and (if you have one set) your display name and profile picture. ChemDeck never sees your Google password.

Why we confirm your email

On your first sign-in, the app shows you the email address Google returned and asks you to confirm it is yours before any flashcards are created. This exists for two reasons. It stops you from quietly building a set of cards under a second Google account you did not mean to use (easy to do on a shared or school computer), and it makes the account your data is tied to explicit rather than assumed.

The app also requires that the address is one Google has verified. If Google reports the address as unverified, or returns no address at all, sign-in is refused and you are signed straight back out.

Keeping the account secure

You are responsible for the security of the Google account you sign in with. Anyone who can use that Google account can read, change, and delete your flashcards. If you sign in on a device that is not yours, sign out when you are finished.

4Acceptable use

Use ChemDeck to study. Do not:

• Upload or store content that is illegal, or that you do not have the right to store.
• Attempt to access another person's account, cards, or data.
• Probe, scan, or attack the app or its Firebase backend, except as described under Security below.
• Use automated tooling to create accounts or to generate storage volume in bulk.
• Resell or redistribute the app as your own service.

Accounts that are used to attack the service or to store unlawful content may be removed without notice.

5Your content

Your flashcards, drawings, deck names, and folder names are yours. You keep every right you already had in them. You grant us only the permission technically required to run the service: to store your content and to send it back to your own devices when you sign in.

We do not read your cards for any other purpose. They are not used to train models, they are not analysed for advertising, and they are not shared with anyone.

You are responsible for what you store. Please do not use flashcards to store passwords, financial details, medical records, or anyone else's personal information.

6Availability

ChemDeck is free and provided on a best effort basis. It may be offline for maintenance, may change without notice, and may be discontinued. There is no uptime guarantee and no support commitment.

7No warranty

The app is provided "as is" and "as available", without warranty of any kind, express or implied, including any implied warranty of merchantability, fitness for a particular purpose, accuracy, or non-infringement.

Chemistry content in your cards is content you or others typed. Nothing in the app is checked for scientific accuracy, and none of it is academic, medical, or professional advice.

Nothing here removes rights you have as a consumer that cannot be excluded under the law that applies to you.

8Limitation of liability

To the fullest extent the law allows, we are not liable for lost data, lost study time, lost grades, lost profits, or any indirect or consequential loss arising from your use of the app, or from being unable to use it.

We do not exclude liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot lawfully be excluded.

9Ending your account

You can stop using ChemDeck at any time. To remove your data:

1. Delete your cards, sets, and folders inside the app. Deletions are applied to cloud storage as well as to the device you are using.
2. Remove ChemDeck's access from your Google account permissions.
3. Ask us to delete the remaining account record, using the contact route in section 14.

We may suspend or delete an account that breaches section 4.

10Changes to these terms

These terms may be updated. Every version carries a version number and an effective date at the top of this page. A material change bumps the version, and you are asked to accept the new version on your next sign-in. Continuing to use the app after that means you accept it.

11Privacy notice

What is collected

• Account identity. Your Google account identifier, email address, display name, and profile picture URL, supplied by Google when you sign in.
• Your study content. Card fronts and backs, drawings, scratchpad images, deck and folder names, and their ordering.
• Your consent record. The terms version you accepted and the time you accepted it.

There is no analytics, no advertising network, no session recording, no fingerprinting, and no third party tracker in this app. We do not build a profile of you, and we do not sell or share personal data with anyone for their own purposes.

Why, and on what basis

Account identity is processed to authenticate you and to keep your cards separated from everyone else's. Study content is processed to provide the service you asked for. The consent record is processed to demonstrate that terms were accepted. In UK and EU terms, the basis is performance of a contract with you, and, for the consent record, our legitimate interest in keeping a record of it.

Who processes it

• Google Firebase (Authentication and Cloud Firestore) stores your account record and your cards, and acts as our processor. See the Firebase privacy information.
• GitHub Pages serves the static files. GitHub records server access logs, including IP addresses, under its own policy.
• Google Fonts serves the Newsreader and Schibsted Grotesk typefaces, which means your browser requests files from fonts.gstatic.com.

Data is stored on Google Cloud infrastructure and may be processed outside your country, under Google's standard contractual safeguards.

How long it is kept

Your cards are kept until you delete them or until your account is deleted. The account record is kept while the account exists. Deleting a card removes it from cloud storage; backups held by the infrastructure provider may persist for a short period afterwards under their own retention schedule.

Your rights

Depending on where you live, you may have the right to access, correct, export, delete, or restrict the processing of your personal data, and to object to it. Most of this you can do yourself inside the app. For anything else, use the contact route in section 14. You also have the right to complain to your data protection authority.

Children

ChemDeck is not directed at children under 13, and accounts are not knowingly created for them. If you believe a child's data is held here, contact us and it will be removed.

12Cookies and local storage

ChemDeck does not use advertising or analytics cookies. Everything it stores on your device is required for the app to function, which is why the consent screen has one button rather than a set of toggles. If you do not want any of it stored, the honest answer is not to use the app.

What is stored on your device

• Firebase Authentication session. Set by Google and Firebase in browser storage and cookies on Google's own domains, so that you stay signed in between visits. Strictly necessary. Persists until you sign out or clear site data.
• chemdeck-theme (local storage). Whether you chose light or dark. Persists until cleared.
• chemdeck-sidebar (local storage). Whether the sidebar is open. Persists until cleared.
• chemdeck-cookie-consent (local storage). The version of this notice you accepted, so you are not asked again.
• chemdeck-terms-accepted:<account id> (local storage). A local copy of your terms acceptance, so the app does not have to query the server on every load.

Clearing it

Clearing site data for this site in your browser settings removes all of the above. You will be asked to accept this notice again, and to sign in again. Your flashcards are unaffected, because they live in cloud storage, not on your device.

13Security

Your cards are protected by per user Cloud Firestore rules: a signed in account can read and write only the documents under its own account identifier, and the shape and size of every field is validated server side. Content is served over HTTPS with a content security policy that restricts where scripts, styles, images, and network connections may come from.

No system is perfectly secure, and this one is maintained by one person. If you find a vulnerability, please report it privately rather than publicly, and do not access, modify, or delete data belonging to anyone else while testing. Reports made in good faith are welcome and will not be pursued. The reporting route and the current security posture are documented in SECURITY.md in the project repository.

14Contact and governing law

For privacy requests, security reports, deletion requests, or anything else about these terms, use the ChemDeck feedback form, which reaches the maintainer directly.

These terms are governed by the laws of the State of Illinois, United States, without regard to its conflict of law provisions. The state and federal courts located in Illinois have exclusive jurisdiction, except where the law where you live gives you the right to bring a claim locally.

If any part of these terms is found unenforceable, the rest continues to apply.