Mora is a modern flashcard app built for language learners. It supports handwriting input, text-to-speech, spaced repetition, and easy CSV import/export.

Can I use Mora for learning Thai, Vietnamese, or Chinese?

Yes! Mora is especially useful for tonal and non-Latin languages. You can write phonetic spellings and hear words pronounced.

Does Mora support handwriting input?

Yes — Mora includes handwriting and stylus support so you can practice characters, symbols, or phonetic spellings directly in your flashcards.

Can I import or export my flashcards?

Yes. You can easily import vocabulary from a CSV file or export your decks anytime to back them up or share them.

Yes — Mora is free to use so you can start learning right away.

Privacy Policy | Mora Flashcards

Introduction

Mora (“we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our language learning application.

By using Mora, you agree to the collection and use of information in accordance with this policy.

Information We Collect

Account Information

When you create an account using Google Sign-In, we collect:

Email address (from your Google account)
Display name (from your Google account)
Profile picture (from your Google account, optional)

Learning Data

We collect data related to your learning activities:

Flashcards you create and study
Study progress and performance metrics
Handwriting data (if you use handwriting features)

Usage Information

We automatically collect certain information about your use of the app:

IP address and browser user agent
Device information and browser type
Usage patterns and study sessions
App performance and error logs

How We Use Your Information

We use the collected information to:

Provide and maintain the Mora service
Personalize your learning experience
Track your progress and provide spaced repetition
Improve our app and develop new features
Provide customer support

Data Security

We implement appropriate security measures to protect your personal information:

Encryption of data in transit and at rest
Secure authentication and authorization
Regular security audits and updates
Limited access to personal data on a need-to-know basis

Security and Abuse Prevention

To protect our services from abuse (e.g., rate limiting, bot/spam prevention, and denial-of-service mitigation), we process limited technical data such as IP address, browser user agent, and timestamps. For authenticated requests, we may associate these events with your account ID.

Purpose: Security, fraud/abuse prevention, and service reliability
Legal Basis (EU/UK): Legitimate interests in securing our services
Retention: Security counters are ephemeral and automatically expire within short windows (typically 1 minute and up to 24 hours for daily limits)

Data Sharing

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances:

With your explicit consent
To comply with legal obligations
To protect our rights and safety
With service providers who assist in operating our app (under strict confidentiality agreements)

Cookies

We use cookies to maintain your authentication session and improve your experience:

Session Cookies: NextAuth.js uses HTTP-only cookies to maintain your login state and authentication session
Duration: Session cookies expire after 7 days of inactivity
Purpose: Authentication and session management only
Third-party: No third-party cookies are used

You can control cookies through your browser settings, though disabling session cookies will prevent you from staying logged in to the application.

Data Processors

We use the following third-party services to process your data:

Google - For user authentication via Google Sign-In. Google processes your email address, display name, and profile picture to authenticate your account. Data is processed in the United States and other countries where Google operates. Please review Google's Privacy Policy for more information about how they handle your data.
Google Fonts - For serving web fonts (Playfair Display, Poppins, Dancing Script, etc.). Google Fonts may collect your IP address and browser information to serve fonts efficiently. Data is processed in the United States and other countries where Google operates. Please review Google's Privacy Policy for more information.
Vercel - For hosting and serving our application. Vercel processes your IP address and usage data to provide hosting services. Data is processed in the United States and other countries where Vercel operates. Please review Vercel's Privacy Policy for more information.
Upstash (Redis) - For rate limiting and abuse prevention. Upstash processes IP addresses and related metadata to enforce request limits and protect the service. Data may be processed in the United States and other regions where Upstash operates. Please review Upstash's Privacy Policy for more information.
Vercel Analytics - For website analytics and performance monitoring. Vercel Analytics collects anonymous usage data including page views, performance metrics, and user interactions to help us improve the application. Data is processed in the United States and other countries where Vercel operates. Please review Vercel's Privacy Policy for more information.
Neon Database - For storing your account information, flashcards, study progress, and learning data in a PostgreSQL database. Neon processes your data in the United States and other countries where Neon operates. Please review Neon's Privacy Policy for more information.
GitHub - For hosting our source code and version control. GitHub may process metadata about our codebase and development activities. Please review GitHub's Privacy Statement for more information.

These processors are bound by contractual obligations to protect your data and may only process it as instructed by us.

Your Rights

You have the right to:

Access your personal data
Correct inaccurate information
Request deletion of your data
Export your learning data
Opt out of certain communications

To exercise these rights, please contact us at hello@usemora.co

Data Retention

We retain your personal information for as long as your account is active or as needed to provide you services. If you delete your account, we will delete your personal data within 30 days, except where we are required to retain it for legal or regulatory purposes.

Children's Privacy

Mora is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the “Last updated” date. We encourage you to review this Privacy Policy periodically.

Contact Us

If you have any questions about this Privacy Policy, please contact us at hello@usemora.co