Security

This page summarises the security posture of Leitner Learner at a high level. It is not a certification statement and does not cover every control in the system.

Account and access

• Sign-in is handled by Supabase Auth. Passwords are hashed by the auth provider; we do not store plain-text passwords.
• Private decks, cards, and progress use row-level security scoped to the signed-in account. Decks you explicitly share can be previewed by other people.
• Administrative actions use explicit, audited server functions — the normal app does not bypass ownership checks with a broad admin role on user tables.

Data storage and transport

• Traffic between your browser and our servers uses HTTPS.
• Application data is stored in Supabase (PostgreSQL) in the eu-central-1 region.
• The PWA service worker does not cache authenticated API responses — study data is fetched from the network when you use the app.

Payments

Pro subscriptions are processed by Paddle as merchant of record. Card numbers are not stored in Leitner Learner — we keep subscription status and Paddle identifiers needed to grant access. See our Privacy Policy.

AI features

When you use AI-assisted card creation, the text you submit is sent to our AI provider to generate suggestions. Generated vocabulary may be cached in shared lookup tables without user-identifying information. Your study progress remains private to your account.

Reporting issues

If you believe you have found a security vulnerability, contact us through the Contact page. Please do not post exploit details publicly before we have had a chance to respond.