Privacy Policy
Effective date: October 11, 2026
This Privacy Policy explains how same3le handles information when you use the website, Progressive Web App, local import tools, voice-study features, analytics, optional memory images, and future account or subscription services.
1. Current prototype versus production accounts
You can study without creating an account. Paste, local Excel, Anki, CSV, TSV, TXT, demo, and ordinary studying remain available while signed out.
If you sign in, Supabase stores authentication information and saved Google Sheet identifiers you choose to save, plus lightweight last-opened progress and the source-row numbers of questions you choose to star in saved Google Sheets. Star records reference the saved deck and row number only; same3le does not store the question or answer text in the star record. If you deliberately attach a memory image to a saved-sheet question, same3le stores the optimized image in private Supabase Storage and stores only the saved-deck reference, source row, question/answer column indexes, a cryptographic question fingerprint, an image fingerprint, and technical image metadata needed to retrieve it. The memory-image record does not store the question or answer text. In Review Images, the current question or answer is requested from the source Google Sheet only when you choose to reveal it. Local imported deck contents remain in this browser in Account Sync v1 and are not uploaded to a same3le application database. same3le does not intentionally store spoken answers, audio, or transcripts.
Google Analytics 4 is used for aggregate website and product analytics. Analytics events are deliberately limited to page paths and coarse non-content fields such as study mode, source category, and question-count range. same3le does not intentionally send question text, answer text, spoken responses, transcripts, filenames, Google Sheet URLs or identifiers, email addresses, account or Supabase user identifiers, deck names, or memory-image contents to Google Analytics.
Paid subscriptions are not active. Legal operator identity, monitored privacy contacts, custom SMTP, and related launch items still need to be completed before public account signup is treated as production-ready.
2. Information handled today
| Information | How it is used | Where it is handled |
|---|---|---|
| Authentication email and session | Optional sign-in so a saved Google Sheet can reopen on another device. | Supabase Auth, if you sign in. |
| Saved Google Sheet identifiers | Remembers a display name, spreadsheet id, sheet tab id, last-opened time, and last source row. | Supabase Postgres with Row Level Security. Raw Sheet URLs and question text are not stored in the saved-source record. |
| Starred question references | Lets a signed-in user mark a question in a saved Google Sheet and review starred questions later or on another device. | Supabase Postgres with Row Level Security. The star record stores only the saved deck reference and source-row number, not question text, answer text, audio, transcript, or raw Google Sheet URL. |
| Optional memory images | Lets a signed-in user attach a personal visual cue to a question and review those images later. The browser resizes and recompresses the selected image before upload; the original file is not intentionally uploaded. Identical optimized image bytes may be deduplicated within the same account. | Private Supabase Storage plus an RLS-protected Postgres metadata record. Metadata contains the saved-deck reference, source row, question/answer column indexes, cryptographic fingerprints, storage path, MIME type, dimensions, and optimized byte size. It does not contain question or answer text. In Review Images, source text is requested directly from the current Google Sheet only after you choose to reveal it. |
| Required legal acceptance and optional marketing preference | Records that you accepted the Terms, Privacy Policy, and Acceptable Use Policy. Marketing consent is separate and optional. | Supabase, if you create an account. |
| Settings and local progress | Remembers mode, speed, timing, voice, matching preference, and current position on this device. | Browser local storage. |
| Aggregate website and product analytics | Measures page views and coarse funnel events such as loading a source, starting or completing a study session, reaching five or ten completed questions, creating an account, or saving a deck. | Google Analytics 4. Page URLs and referrers are reduced to origin and path before being sent; query strings and URL fragments are excluded. Custom event parameters are restricted to coarse study mode, source category, and question-count bucket where applicable, plus, on free tool pages, which tool was used, whether a file was opened with the file picker or by drag and drop, the download format, and whether handed-off cards loaded successfully. |
| Pasted question-and-answer text | Parses structured Q&A into a spoken study session. | Processed locally in browser memory; not uploaded to a same3le account database or intentionally sent to Google Analytics. |
| Local Excel, Anki, CSV, TSV, and TXT files | Extracts structured questions and answers for the study session. | Read and parsed in the browser. File contents and filenames are not intentionally sent to Google Analytics or uploaded to a same3le application server in v1. |
| Free converter tools, such as the Quizlet to Anki, ChatGPT to Anki and APKG to CSV converters | Converts pasted or opened flashcard text or Anki deck files, such as a Quizlet export, cards written by an AI assistant, or an .apkg deck, into an Anki import file, CSV, TSV or text for Quizlet and, if you choose, opens the cards in the study app. | Processed in the browser and not uploaded to a same3le server or sent to Google Analytics. A file name is used only on your device to suggest a deck or file name. If you choose to study the cards, they are passed to the app through that browser tab's session storage and deleted as soon as the app reads them, or when the tab closes. |
| Google Sheet data | Creates the study session and, when requested in Review Images, resolves the current source question or answer for an attached image. | Requested directly from Google by the browser. If you save the sheet, identifiers needed to request it again plus lightweight progress, starred row references, and optional memory-image linking metadata may be stored by Supabase. The saved-source, star, and memory-image metadata records do not store question or answer text. Sheet URLs, spreadsheet identifiers, tab identifiers, and question content are not intentionally sent to Google Analytics. |
| Spoken answers | Converts speech to text for answer matching. | May be processed by the browser, operating system, or speech-service provider. same3le does not intentionally store audio or transcripts or send them to Google Analytics. |
| Technical request information | Delivers and protects the website and third-party code dependencies and supports aggregate analytics. | The hosting provider, Supabase, Google Analytics, and when required for modern Anki decompression the decoder CDN may receive ordinary request information such as IP address, user agent, timestamps, and requested asset as part of providing their services. |
3. Local Anki processing
When an Anki .apkg file contains a legacy SQLite collection, same3le reads that collection locally. Some modern Anki packages contain a zstd-compressed collection. The importer first attempts to use a browser-native decompressor. If that is unavailable, the browser may download a pinned open-source zstd decoder module from a third-party CDN. The deck file itself is not intentionally sent to that decoder CDN; the downloaded code runs against the deck in the browser. If the decoder cannot be loaded, the user is instructed to export an older-compatible Anki package instead.
The current Anki importer does not intentionally persist Anki scheduling data, review history, images, audio, or card-template state in a same3le database. It extracts text needed to create oral-study questions.
4. Account and product information
Current or planned account and product records may include:
- Account identifier and email address in Supabase
- Account creation and last-sign-in timestamps
- Terms and Privacy Policy versions accepted
- Optional marketing consent and preference changes
- Saved Google Sheet identifiers, lightweight last-opened progress, and starred source-row references for saved Google Sheets
- Optional user-selected memory images plus content-free linking and technical image metadata
- Plan name, subscription status, renewal period, and payment-provider customer reference when payments launch
- Privacy-safe aggregate analytics events such as demo start, source category loaded, session start or completion, five- and ten-question milestones, account creation, and deck save
- Account-deletion or privacy-request records
The planned backend is not intended to receive raw payment-card numbers. A payment processor should handle card entry. Question text, answer text, local file contents, filenames, audio, transcripts, raw Google Sheet URLs or identifiers, precise location, advertising identifiers, and cross-site browsing data are not intended to be included in same3le's custom analytics events.
5. Purposes
Information may be used to provide and secure accounts, authenticate users, remember preferences and starred-question selections, store and retrieve user-selected memory images, administer Free and Pro access, process and document subscriptions, measure aggregate traffic and whether core workflows function, answer support or privacy requests, prevent abuse, comply with law, and communicate transactional service information. Promotional email requires separate optional consent where required.
6. Vendors
The Service currently or potentially uses:
- Hosting provider: to deliver static application files and process ordinary server logs.
- Google: to retrieve a link-accessible Google Sheet when you choose that import method, and Google Analytics 4 to measure aggregate website and product usage.
- Browser or operating-system speech services: for speech synthesis and recognition.
- Decoder CDN: only when a modern Anki package requires the optional pinned browser zstd decoder fallback.
- Supabase: authentication, Postgres records for saved Google Sheet identifiers, lightweight progress, starred source-row references, memory-image linking metadata and consent, private Storage for optional memory images, and Row Level Security.
- Email provider: for one-time codes, magic links, security messages, service notices, and separately consented marketing.
- Payment processor: planned for subscription checkout, billing, tax-related transaction records, and billing-portal access. Payments are not active in this version.
7. Sale, sharing, and advertising
same3le does not intend to sell personal information or share it for cross-context behavioral advertising. Google Analytics is configured without Google Signals and without advertising-personalization signals. same3le does not enable Google Ads or remarketing through this analytics implementation. If these practices change, this policy and any legally required opt-out controls will be updated before the change.
8. Retention
Browser settings and prototype access data remain until you remove local access, clear site data, or the browser deletes them. Pasted Q&A and local-file contents are not intentionally persisted by the current import feature after the page or in-memory session is discarded. Saved starred-question references remain with the signed-in account until the user removes the star, removes the saved deck, or the related account data is deleted. Optional memory images and their metadata remain until the user removes the image, removes the saved deck, or the related account data is deleted; deduplicated image objects are removed when no remaining attachment in that account references them. Account, consent, hosting, and analytics information is retained according to the applicable service configuration and operational or legal needs. Final subscription-era retention periods will be documented before paid launch.
9. Your choices and rights
Depending on where you live and which laws apply, you may have rights to access, correct, delete, or obtain a copy of personal information; withdraw marketing consent; appeal a denied request; and opt out of certain sale, sharing, targeted advertising, or profiling. same3le intends to honor Global Privacy Control signals if a legally relevant sale or sharing practice is ever introduced, but no such practice is planned.
The production account should provide self-service account deletion, marketing preference controls, and a documented privacy-request process. Identity verification may be required before fulfilling a request.
10. Children
The Service is not directed to children under 13 and the planned account service is restricted to users age 18 or older. We do not knowingly collect personal information from children through production accounts. If you believe a child’s information has been provided, email info@same3le.com so it can be deleted.
11. Security
Planned safeguards include HTTPS, Supabase authentication, Row Level Security, least-privilege access, private object storage for memory images, separate public and server secrets, rate limiting, secure authentication redirects, dependency and secret scanning, limited data collection, and an incident-response process. Local processing reduces application-server collection but does not eliminate browser, device, extension, hosting, analytics, speech-provider, storage-provider, or network risks. No security measure can guarantee absolute protection.
12. International and regional use
The prototype is intended for access from the United States. Internet routing and vendors may process request information in other locations. A regional gate is not proof of citizenship or residence. International expansion would require an updated legal and privacy review.
13. Changes
This policy may be updated when Supabase accounts, email, subscriptions, analytics, storage features, or new features launch. Material changes will receive a new effective date and, when appropriate, account holders will be notified or asked to acknowledge the revised version.
14. Contact
For privacy questions and requests, such as access, correction, deletion, or a copy of your information, or to appeal a decision on a request, email info@same3le.com. Please put “Privacy request” or “Appeal” in the subject line. The same monitored inbox handles support, accessibility, and security reports, as described on the contact page.
The legal operator’s name and mailing address will be added here before paid checkout or production account collection begins. Until then, the current browser-first prototype should not be treated as a production subscriber database.