Privacy Policy
Last updated: 2026-08-27
Kwipsy has not launched yet. No accounts exist today, and this policy describes how your data is handled starting from the moment an account can first be created, written in the present tense as a plain description of how the service works rather than as a promise about something already running.
Who we are
Kwipsy is operated by 큅시 (Kwipsy), a sole proprietorship registered in the Republic of Korea (사업자등록). Registration number: 736-49-01198. Registered address: 203, 49 Yeondaedongmun-gil, Seodaemun-gu, Seoul, 03721, Republic of Korea. General contact: [email protected].
Kwipsy is offered worldwide, with no country restriction. The minimum age to use Kwipsy is 16.
What we collect and why
| Data | How it is collected | Purpose | Legal basis | Required or optional | Retention |
|---|---|---|---|---|---|
| Email address and account identifier | You provide it when you sign in | Create and secure your account, send you a sign-in link | Contract | Required | Until account deletion |
| Decks, cards, notes and tags | You create or import them | Store and sync your study content | Contract | Required | Until account deletion |
| Uploaded and imported media (images, audio) | You add it to a card, or it arrives inside an imported .apkg file |
Store and sync your study content | Contract | Required | Until account deletion |
| Review history and scheduling state | Generated as you study | Run spaced-repetition scheduling (FSRS-6) and sync it across your devices | Contract | Required | Until account deletion |
| Device and synchronisation metadata | Generated automatically by the app | Keep your devices in sync and detect sync conflicts | Contract | Required | Until account deletion |
| Diagnostic and crash data | Generated automatically when the app encounters an error | Find and fix bugs, keep the service secure and reliable | Legitimate interests | Required | 90 days |
| Analytics events | Generated as you use the app, only if analytics is enabled | Understand which features are used, improve the product | Consent, where required by your location | Optional | 12 months |
We do not collect payment information: Kwipsy has no paid plans at this time.
Who receives your data
We do not sell your data. Depending on the feature you use, the following categories of recipients may receive it:
- Hosting provider — runs the sync server and database, on servers located in Canada.
- Object storage for media — Cloudflare R2, for uploaded and imported media such as images and audio.
- Site host and mail service — Cloudflare, for this website and for Kwipsy's sign-in emails.
- Analytics — if you have analytics enabled, to understand which features are used.
- Crash reporting — to find and fix bugs.
Recipients are listed here by category, not by naming every company, because the specific provider within a category can change without changing what this policy promises. The current, named list — including each provider's actual status — is on our Service Providers page.
Where your data is processed
Your data is processed in Canada and in the Republic of Korea. Both have adequacy decisions from the European Commission, which means a transfer from the European Economic Area to either country needs no additional transfer safeguard.
How long we keep it
Your account and content are deleted from active systems within 30 days of a confirmed deletion request. Backup copies are not deleted individually — they expire on their own fixed rotation, within a further 30 days after that, and a backup is never restored back into the live service. In total, complete removal — live systems plus backups — takes up to 60 days from your request.
Server logs are kept for 90 days. Analytics data, where analytics is enabled, is kept for 12 months. We do not delete inactive accounts automatically, but we periodically review whether continuing to store an inactive account's data is still necessary.
Your rights
Depending on where you live, you have the right to access, correct, delete, restrict, or object to the processing of your data, to receive a copy of it in a portable format, and to withdraw consent at any time where processing relies on it. To exercise any of these rights, write to [email protected].
We respond without undue delay, and normally within one month. There is no charge for making a request. We may ask you to confirm your identity before acting on a request, to make sure we are not disclosing or deleting the wrong account's data.
If you are in the European Economic Area, you can also complain to your local data protection supervisory authority. In the Republic of Korea, you can complain to the Personal Information Protection Commission (PIPC).
Children
Kwipsy is not intended for anyone under 16. Kwipsy does not knowingly allow anyone under 16 to create an account. If we learn that an account belongs to someone under that age, we close the account and delete the data associated with it. A parent or guardian who believes their child has created an account may contact us at [email protected].
How we protect it
Data is encrypted in transit. Access to production systems is limited to the operator. Backups are encrypted and expire on a fixed rotation.
Changes to this policy
This policy is effective as of the date at the top of this page. If we make a material change to it, we will post the change here and update that date.