Privacy
Sirt9ra is a study tracker. It works best when you're honest with it, and that only happens if you trust where the data goes. Here is exactly where it goes.
What is stored
- Your email address, so you can sign in. If you use Google sign-in, we receive your email and name from Google and nothing else.
- What you type in: semesters, modules, tasks, notes, links, flashcards, assessments, events, and the sessions you log.
- Your time zone, detected from your browser. It is used only to decide when your study day starts and ends.
- Derived statistics — streaks, totals, achievements — computed by the database from the sessions above.
What is not stored
- No analytics, page-view tracking, session recording or heatmaps.
- No advertising identifiers, and no third-party scripts on any page.
- No location beyond the time zone name your browser reports.
- No payment details. There is nothing to pay for.
A strict Content-Security-Policy blocks the browser from loading scripts, fonts or images from anywhere except this site and the database. Even if a third-party tracker were added by mistake, the browser would refuse to run it.
Who can see it
Only you. Every table enforces row-level security in Postgres: each query is filtered by the signed-in user's id inside the database itself, before any row is returned. That is not a rule the app follows by convention — it is a policy the database applies to every request, including any request an attacker might craft directly.
Data is stored by Supabase, which hosts the Postgres database and handles authentication. The site itself is served as static files by Cloudflare Pages. Neither is given access to your rows beyond what is needed to store and return them.
Taking it with you
Settings → Your data → Export downloads every row you own as plain JSON. Not a summary, not a report — the actual records, in a format you can read, parse or import elsewhere.
Deleting it
Settings → Your data → Delete accountremoves your account and every row attached to it, immediately. Deletion cascades through every table by foreign key. There is no soft delete, no grace period and no archived copy — once it's gone, we cannot recover it, and neither can anyone else.
Security practices
- Passwords are hashed by Supabase Auth; they are never visible to the application.
- Sign-in uses the PKCE flow, so an access token never appears in a URL, in browser history, or in anything you might paste into a chat.
- Streaks and totals are computed server-side from your session history and are read-only to the browser — they cannot be edited, by you or by anyone else.
- Saved links are restricted to http and https, in the browser and again in the database.
Changes
If this policy changes in a way that affects what is collected, the change will be visible in the project's source history alongside the code that implements it.