1. Overview
This Privacy Policy describes how Anneal("we", "us", or "our") collects, uses, and protects your information when you visit our website (anneal-os.vercel.app), use our personal operating system, or authenticate via external OAuth providers such as Google.
2. Information We Collect
A. Account & Authentication Data
When you create an account or sign in using Google Sign-In, we receive your basic profile information: your email address, display name, and avatar image URL. We use this solely to create your account and verify your identity.
B. Application Event Log & Study Data
To provide our personal operating system capabilities, we store the items you create: habits, daily rituals, flashcard decks, study notes, review history, and FSRS (Free Spaced Repetition Scheduler) memory intervals.
C. Technical & Security Telemetry
We collect coarse, privacy-respecting session information (coarse device signals, session tokens, and anonymized access timestamps) strictly to enforce session security, prevent automated brute-force attacks, and protect against unauthorized account takeover. We never perform canvas fingerprinting or cross-site tracking.
3. Google API Services Compliance & Limited Use
Anneal's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
- We only request basic authentication scopes (
openid,email,profile) to facilitate secure sign-in. - We do not transfer or disclose Google user data to third parties for advertising or commercial profiling.
- We do not use Google user data to train generalized artificial intelligence or machine learning models.
- Human access to your data is strictly prohibited unless required to resolve critical security incidents or comply with legal mandates.
4. How We Use Your Information
- To provision, maintain, and authenticate your account.
- To synchronize your personal study cards, habits, and progress across your devices.
- To calculate spaced-repetition schedules using the FSRS memory algorithm.
- To enforce strict tenant isolation via Row-Level Security (RLS) in our database.
5. Data Storage & Security
All user data is encrypted in transit using TLS 1.3 and encrypted at rest using AES-256. Database tables are gated behind PostgreSQL Row-Level Security (RLS), guaranteeing that queries can only access records owned by the authenticated user ID.
We retain your data for as long as your account is active. If you delete your account, all associated profiles, habits, decks, and logs are permanently purged from active storage.
6. Your Rights & Data Portability
You maintain complete sovereignty over your information:
- Full JSON Export: You can export your entire library, habits history, cards, and FSRS scheduler state directly from your Profile at any time.
- Right of Deletion: You can initiate a complete account deletion at any time, which permanently removes your records.
- Revoke OAuth Access:You can revoke Anneal's access to your Google account anytime via Google Account Security Settings.
7. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or your data, please contact our support team directly: