Privacy Policy for AI Flashcards - CardForge AI

Introduction

We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, and safeguard your information when you use our service.

Information We Collect

We collect the following types of information to provide and improve our service:

1. Account Information — Your name, email address, and other details you provide when creating an account.
2. Usage Data — Information about how you interact with the service, including features accessed, frequency of use, and interaction patterns.
3. Study Card Data — Reviewed card sets and card edits you choose to save to your account. We do not store uploaded files, pasted source text, filenames, page references, or source quotes.
4. Device Information — Device type, operating system, and browser type, used to optimize compatibility and performance.
5. Cookies — Small data files stored on your device to remember preferences and improve your experience.
6. Payment Information — Billing details handled by trusted third-party payment processors such as PayPal, Creem, or other supported payment platforms. We do not store full card numbers on our servers.

How We Use Your Information

We use the data we collect to:

• Provide, maintain, and improve the service.
• Process transactions and send related confirmations.
• Send technical notices, security alerts, and support messages.
• Respond to your questions, feedback, and support requests.
• Detect, prevent, and address fraud and abuse.

Data Sharing

We do not sell your personal information. We may share data only in these limited cases:

• With service providers who help us operate the service, under confidentiality agreements.
• To comply with legal obligations or respond to lawful requests from public authorities.
• To protect our rights, property, or safety, or that of our users.

Data Security

We implement industry-standard security measures including encryption in transit, access controls, and regular reviews. No method of transmission over the Internet is 100% secure, but we work continuously to protect your information.

Your Rights

You have the right to access, update, export, or delete your personal information. You can do this through your account settings or by contacting us at the email address below.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by updating the date at the top of this page and, where appropriate, sending a notice through the service.

Contact Us

If you have questions about this Privacy Policy, please contact us through the Contact page or email support@cardforgeai.com.

Service Operator and Privacy Contact

CardForge AI is currently operated as a small independent online software service, not as a hospital, school, bank, law firm, or licensed professional service provider. For privacy, billing, copyright, or account questions, use the Contact page or email support@cardforgeai.com. We may need to verify that you control the relevant account email before acting on access, deletion, export, or billing-related requests.

Uploaded Source Files and Temporary Processing

CardForge AI processes readable PDFs, Word documents, text files, spreadsheets, and pasted notes only for the active card-generation request. We do not retain the uploaded file, full extracted text, filename, page reference, source quote, or a reusable copy of your source material after that request completes.

If you save a card set to your account, the saved record contains only the card fronts, backs, cloze text, tags, review state, deck name, and Extra content that you choose to keep. It is not a document library and cannot recreate an uploaded source. Do not upload material that you are not permitted to process, and remove sensitive personal information before using the service.

AI Processing and User Instructions

When you use AI card generation, the text extracted from your selected source material and the instructions you provide may be sent to a configured AI model provider for that request. The instruction may describe the type of cards you want, such as vocabulary cards, bilingual cards, professional definitions, cloze deletions, or concept cards.

We use AI processing to create draft study cards. We do not use uploaded content to create medical, legal, financial, or professional advice. The generated cards are educational drafts that you should review before export. If you upload regulated, confidential, or sensitive information, you are responsible for ensuring that you have the right to process that information through the service.

We may store non-source usage metadata related to AI requests, such as credit consumption, request status, generated card count, and error category. This helps us prevent abuse, calculate credit balances, troubleshoot failures, and improve reliability. We avoid storing API secrets, full payment credentials, and source files or source text.

Account Data and Saved Card Sets

When you create an account, we store the information needed to identify you, authenticate your session, and provide account features. This may include your email address, display name, verification status, account creation date, and related security metadata.

If you save card sets, those card sets may be available across devices after you sign in. Saved card sets can include card content, card type, tags, card status, deck name, creation time, and edit history or deletion status where supported. Original files are not treated as the permanent account record. The saved card set is the account asset.

We may also record whether a card set was generated by AI, imported from a built-in deck, or created through another workflow. This helps organize the account center, billing history, and support requests.

Credits, Billing, and Payment Metadata

CardForge AI uses AI Credits and may offer optional Pro subscriptions for paid AI generation. When you purchase credits or subscribe to a plan, payment may be processed by third-party providers such as PayPal, Creem, or other supported payment platforms. These providers may collect payment details, payer account information, card information, billing address, tax information, and transaction identifiers according to their own policies.

We may store payment-related metadata that is necessary for delivery, reconciliation, support, fraud prevention, subscription management, and refund handling. This can include provider name, provider transaction ID, order ID, subscription ID, invoice ID, payment status, amount, currency, purchased credit amount, plan name, renewal period, delivery time, and limited payer information returned by the payment provider. We do not store full credit card numbers or full payment credentials on our servers.

Credit ledger and billing records may show grants, purchases, consumption, refunds, adjustments, subscription renewals, cancellations, and failed or pending events. This allows users to understand their balance and allows support to investigate billing questions.

Cookies, Analytics, and Product Measurement

We may use cookies or similar technologies to keep you signed in, remember preferences, support security checks, measure product usage, and understand how users interact with the site. Analytics data helps us improve page performance, content clarity, conversion flows, and feature quality.

Analytics information may include pages visited, browser type, approximate device information, referrer, event timing, and non-sensitive interaction events. We do not intentionally use analytics to collect source document content, full payment credentials, or private card answers.

You can control cookies through your browser settings. Disabling some cookies may affect login, account center access, payment return flows, or other features that depend on session state.

Email and Support Communications

If you contact us through support, billing, contact, or hello inboxes, we may store your message, email address, attachments you choose to provide, and related support history. This information is used to respond to your request, investigate account issues, confirm payment delivery, or resolve export problems.

Please do not send passwords, full payment card numbers, private keys, or highly sensitive study documents through email. For billing support, include the account email, approximate purchase time, order amount, provider name, and a short description of the issue. That is usually enough to investigate without exposing unnecessary data.

Data Retention

We retain account information for as long as your account remains active or as long as reasonably necessary to provide the service, comply with legal obligations, resolve disputes, prevent abuse, and maintain financial records. Billing and credit ledger records may be retained longer than ordinary product usage data because they support tax, accounting, refund, and fraud-prevention obligations.

Saved card sets may remain in your account until you delete them or close your account, subject to product limitations and backup retention. Deleted records may be soft deleted first to prevent accidental loss, then removed or anonymized according to operational retention schedules.

Temporary processing data, logs, and diagnostic records may be retained for a limited period. We try to avoid logging uploaded filenames, full source text, page references, source quotes, payment credentials, API keys, or private card answers. Operational logs may still include timestamps, request status, file type, file size, page count, generated card count, error category, IP-derived security signals, browser information, and account identifiers needed for fraud prevention or support. Exact retention periods may vary by data category, infrastructure provider, and legal requirement.

Service Providers and Subprocessors

We rely on third-party service providers to operate the product. Depending on the feature you use, this may include Cloudflare for hosting, security, logs, and database infrastructure; Resend or another email provider for account and support email; DeepSeek or another configured AI model provider for the active AI generation request; PayPal, Creem, or another payment provider for checkout, refunds, and payment records; and analytics or webmaster tools used to understand site performance and search visibility.

These providers process data according to their own terms and privacy practices. We share only the data needed for the relevant service, such as extracted study text for a single AI request, email addresses for account email, or payment metadata for billing. We do not sell uploaded source files or saved card content.

International Processing

CardForge AI is an online service and may rely on infrastructure, payment providers, email providers, analytics tools, and AI model providers located in different regions. By using the service, you understand that your information may be processed outside your country or region, subject to safeguards required by applicable law and provider agreements.

We try to choose service providers that follow reasonable security practices. However, each third-party service also has its own privacy terms. When you complete a payment through PayPal or another provider, their privacy policy applies to payment processing.

User Choices and Account Requests

You may request access, correction, export, or deletion of personal data associated with your account where applicable law gives you those rights. We may need to verify your identity before acting on a request. Some records, such as payment, tax, security, or abuse-prevention records, may need to be retained even after account closure.

If you want a saved card set deleted, use the available account controls where provided or contact support. If you want to stop receiving non-essential messages, use unsubscribe controls where available or contact us.

For deletion or export requests, contact support from the email address tied to the account and describe what you want deleted or exported. We will delete saved card sets where available through account controls, and we will review broader account deletion requests subject to payment, fraud-prevention, security, backup, and legal-retention needs.

Copyright, DMCA, and Content Complaints

If you believe content on CardForge AI infringes your rights, exposes personal information, or should be removed for another legal reason, contact support with the page URL, the content at issue, your relationship to the rights or data, and enough detail for us to investigate. Do not send unnecessary sensitive documents. We may remove or restrict content, disable access, or request more information before taking final action.

Children's Privacy

CardForge AI is not directed to children under 13, and it is not designed for users who cannot legally consent to online services in their location. If you are under the age required to use online services without parental or guardian consent, do not create an account or submit personal information. If you believe a child has provided personal information without appropriate consent, please contact us so we can review and take appropriate action.

Policy Scope

This Privacy Policy applies to CardForge AI pages, account features, built-in deck downloads, AI card generation, credit purchases, Pro subscriptions, and support communications. It does not apply to third-party websites linked from our service, including payment processors, external documentation, or Anki-related websites that we do not control.

We may update this Privacy Policy as the product evolves, including changes to AI providers, payment providers, account features, saved card sets, or support workflows. Material updates will be reflected by the updated date above.