Privacy
What Solid Memo does with personal data: where what you study is stored, what stays in your browser, what the site's host and other servers see, and what the project itself has published.
In short: Solid Memo has no server of its own and no accounts. What you study is stored in your own pod, or, before you log in, in your browser. The app has no analytics, sets no cookies and does not track you.
In your pod
When you are logged in, everything Solid Memo knows about your study is
in your pod, in an instance folder
(solid-memo/<name>/ by default): your decks and cards, the review
state of each card, the log of your answers, your preferences, your
drafts and a digest that makes the next visit faster.
data-model.md lists every document. Solid Memo reads
and writes them from your browser, straight to your pod's server. It
keeps no copy anywhere else.
Your pod's server decides who else may read them. Solid Memo registers the review states, the answers and the drafts only in your private type index, since they say what you studied and how well (data-model.md). The one thing it makes public is a release you publish from the Studio: it is meant to be read by others, and it carries the authors' names, and their email addresses when you give them.
Each answer in the log says which card you answered, when, and how well. Since vocabulary 1.19 it also says how long you took to recall the answer and, in study, to grade it (not counting the time the app was hidden, nor a wait of more than ten minutes), the day the card was due, and your device's offset from UTC when you answered, which hints at the time zone you were in (data-model.md, statistics.md). The app records them with every answer, in study and in a course, with no setting to turn it off. They say how fast you remember and at what hour you study, so they are as personal as the rest of the log, and stay in the same private documents.
In the browser
Before you log in, you study as a guest, in a pod kept in the browser's
IndexedDB (database solid-memo-guest-pod,
indexedDbResourceStore.ts,
guest-mode.md). It stays on that device until you move
it into your own pod, or clear the site's data.
The app also keeps a few choices on the device, in localStorage, so
they hold before any pod is reached and stay out of your pod:
| Key | What | Written by |
|---|---|---|
solid-memo:language | the language you chose | localStorageLanguagePreference.ts |
solid-memo:theme | light, dark or the browser's | localStorageThemePreference.ts |
solid-memo:recentLanguages.deck, solid-memo:recentLanguages.own | languages you picked lately for text | remembered.ts |
solid-memo:collapsedGroups.<instance URL> | which deck groups you folded | remembered.ts |
solid-memo:update:<…> | a guest's study being moved or added, so another tab knows | localStorageUpdateJournal.ts |
solid-memo:studioLayout.v1, solid-memo:studioRecent.v1, solid-memo:studioInstances.v1 | the Studio's layout; the commands you used last in its palette; and, by instance URL, your saved views, your pins and the decks and drafts you opened last | prefs.ts |
During a login, sessionStorage holds the page you were on
(solid-memo:login-hash), to bring you back to it
(solidSessionGateway.ts).
The authentication library (@inrupt/solid-client-authn-browser) keeps
what it needs to restore your session, such as your identity provider
and the app's registration with it, in the browser's storage.
None of this leaves the device. Clearing the site's data removes it all, the guest's pod included.
What the site's host sees
The site is static files on GitHub Pages (deployment.md). Loading a page sends GitHub the usual request: your IP address, your browser's user agent and the address asked for, under GitHub's privacy statement. The deck library is served from the same site, so GitHub also sees which deck versions the app fetches. GitHub never sees your pod's data: the app speaks to your pod directly.
A copy of Solid Memo run by someone else is served by their host, and
may read its deck library from another address
(VITE_LIBRARY_INDEX_URL, deck-library.md).
Other servers your browser contacts
The app contacts these from your browser, each when it is needed:
- Your WebID's server, to read your profile when you log in (authentication.md).
- Your identity provider, which handles the login itself. It sees
that you logged in to Solid Memo. A provider you pick from the
suggestions (onboarding.md) is one of the providers
in
podProvider.ts; none of them is run by the project. - Your pod's server, for everything you study.
- The servers of pictures on cards. A card's picture is loaded
from where it is: for the library's decks, image hosts such as
flagcdn.com,upload.wikimedia.org,thumb.wikimedia.organdiiif.micr.io; for your own cards, wherever their pictures are. Each sees a request from your browser. - The address of a deck or release you add by link (deck-library.md).
Links you follow, such as a deck's sources, take you to those sites as any link does.
No analytics, no cookies, no tracking
The app runs no analytics or tracking script, and sets no cookies of
its own. Its Content Security Policy lets the page run scripts from
the site alone, and one inline script it names by its hash (apps/web/index.html, checked
by build.test.ts). The project
learns nothing about who uses the app.
What the project has published
The library's deck versions name who compiled them. Each published
version so far names the maintainer, Anton Wiklund, as its creator,
with his email address as foaf:mbox, and the library's index repeats
it. A published version is never edited
(deck-library.md), so those versions keep
it. Future versions name a project contact instead: a
dcat:contactPoint that points at the
issue tracker, with no
personal email address.
The maintainer's email address is also published, on purpose, in CODE_OF_CONDUCT.md, as the private contact for code of conduct reports. Mail to that address about anything else, such as a deck published with it, is answered with a pointer to the public channels (GOVERNANCE.md).