Privacy Policy

Last updated: 27 July 2026

AnkiPaper (the "Service") is a public web application operated at https://ankipaper.study that lets you review your own Anki flashcards through a browser on a e-ink readers. This policy explains what data the Service collects, how it uses it, and what choices you have.

By using the Service you agree to the practices described below.

1. Data we collect

1.1 Account data

To sign in you provide your AnkiWeb username and password. They are sent over HTTPS to AnkiWeb exactly as the official Anki desktop client does, in order to obtain a long-lived token. Your password is not stored. We store the token, encrypted at rest with a Fernet key unique to this deployment.

1.2 Card data

After authentication we download and store your Anki collection (cards, notes, decks, review history) and the media files referenced by your cards (images, fonts). This data is required to render your cards in the browser.

1.3 Technical data

The Service records standard HTTP access logs (timestamp, request path, response status, user agent, IP address).

1.4 Cookies

The Service sets one cookie containing a signed account identifier. It expires at the end of the session.

2. How we use data

We use the data above only to operate the Service: authenticate you against AnkiWeb, sync your collection, display your cards in the Kindle browser, and protect the Service from abuse (rate limiting, brute-force login attempts). We do not profile users, build advertising audiences, or train machine-learning models on your data.

3. Where data is stored and who can access it

Your data lives on servers operated by the Service provider. Access is restricted to personnel who need it to maintain the Service. All stored card data and tokens are encrypted at rest. Backups, if any, are encrypted and retained for no more than 30 days.

4. Third parties

The Service communicates with the following third parties on your behalf:

AnkiWeb — authentication and synchronization of your collection and media.
Hosting and infrastructure providers — compute, storage. These providers process data only on our instructions.

We do not use third-party analytics, advertising, error reporting, or telemetry services.

5. Legal bases (EEA / UK)

If you are in the EEA or the UK, we process your personal data on the basis of:

Contract — to provide the Service you signed up for.
Legitimate interests — to secure the Service and prevent abuse.
Consent — where required by local law, for any optional feature that asks for it.

6. Data retention

Your account data, collection, and media are kept for as long as your account is active.
Signing out does not delete your data; it only clears the cookie. After signing in again you get the same account back.
HTTP access logs are retained for up to 180 days, then deleted or anonymized.

7. Your rights

You can at any time:

Correct inaccurate data by re-syncing from AnkiWeb.
Access the data we hold about you, or delete your account and all associated data — email [email protected] from the address associated with your account.
Lodge a complaint with your local data-protection authority.

8. International transfers

The Service may be hosted in countries other than your own. Where required, we rely on Standard Contractual Clauses or equivalent mechanisms to protect your data in transit.

9. Children

The Service is not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has signed up, contact us and we will delete the account.

10. Changes to this policy

We may update this policy. Material changes will be reflected in the "Last updated" date above and, where appropriate, announced on the Service before they take effect.

11. Contact

Privacy questions and requests: [email protected].

AnkiPaper is not affiliated with Anki or AnkiWeb. Anki® is a trademark of its respective owners.