Privacy Policy

1. No Cookies or Tracking

We do not use cookies. Period. Our website and app do not:

• Set any cookies (first-party or third-party)
• Use tracking pixels or beacons
• Implement browser fingerprinting
• Use analytics services that track individual users
• Share data with advertising networks
• Build behavioral profiles of users

2. Information We Collect

Guest Users (No Account)

If you use Hashcards as a guest without creating an account:

• All your data (cards, decks, progress) is stored locally on your device only
• We have no access to your flashcards or learning activity—your flashcard content stays entirely on your device
• Each guest is assigned an anonymous ID that ties the learning decks and progress to the device the guest is using
• We store learning activity for app functionality on our servers with this anonymous ID to enable users to become Hashcards users after starting as guests
• If you later choose to create a Hashcards account, we link your email to this anonymous ID—preserving your learning progress and enabling cross-device sync
• No personal information is collected or transmitted while you remain a guest
• You can purchase credits via In-App Purchase, stored locally on your device and with Apple or Google
• To sync purchases across devices, you can optionally provide your email

Registered Users (Email Sign-In)

If you choose to create an account by providing your email:

• Email address: Used for account identification and passwordless sign-in via one-time codes
• Flashcards and decks: Synced across your devices via InstantDB
• Learning progress: Review history, stability scores, and difficulty ratings (used solely for the FSRS scheduling algorithm)
• Purchase history: Records of card credit purchases for your reference

3. AI Card Generation and Chat

When you use the AI-powered card generation feature:

• Your prompts and chat messages are sent to our AI service for processing
• Chat history is processed once and not stored on our servers—conversations exist only during your active session
• Generated cards are returned to you and stored according to your account type (locally for guests, synced for registered users)
• We do not retain your prompts, chat history, or generated content on our servers
• AI processing is stateless—each request is independent with no server-side history

4. Image and OCR Processing

When you use image-based features (photo card extraction, handwriting transcription):

• Images are transmitted to our servers for AI processing
• Images are processed once and immediately discarded—they are never stored on our servers
• Extracted text and generated cards are returned to your device
• No copies, caches, or backups of your images are retained
• OCR usage is metered using the same credit system as AI card generation
• No payment information is collected during OCR—billing uses your existing credit balance

5. Memory Insights and Statistics

The memory insights feature (stability, difficulty, memory strength) is based entirely on your flashcard review activity:

• Statistics are calculated using the FSRS algorithm from your review responses
• No external data sources or behavioral tracking is used
• Insights reflect only your interactions with your own flashcards
• This data is used solely to optimize your review schedule and show you progress

6. Payment Information

When you purchase card credits:

• Payment processing is handled entirely by the Apple App Store or Google Play Store via In-App Purchases
• We never see, store, or process your payment information
• We receive only a transaction confirmation with purchase amount and package type
• Both guest and registered users can purchase credits
• Credits are stored locally on your device and with Apple or Google after purchase
• To sync purchases across devices, you can optionally provide your email to link them to a Hashcards account

7. Data Storage and Security

Where Your Data Lives

• Guest users: All data stored locally on your device
• Registered users: Data synced via InstantDB (a real-time database service)
• AI processing: Cloudflare Workers for API, AI service for generation

Security Measures

• All data transmission uses HTTPS/TLS encryption
• Authentication uses secure, password-less email verification
• We follow industry-standard security practices

8. Your Rights and Controls

You have full control over your data:

• Export: Download all your cards and progress as a JSON backup at any time from the Profile screen
• Delete: Permanently delete all your data using the "Delete All Data" option in the app
• Sign Out: Sign out from your account while keeping your data synced
• Account Deletion: Permanently delete your account and all associated data from the app settings

9. Third-Party Services

We use the following third-party services to provide Hashcards:

• InstantDB: Real-time database for cloud sync (for registered users)
• AI Service Provider: AI model for card generation (prompts processed, not stored)
• Cloudflare: API hosting and CDN
• Apple App Store / Google Play: App distribution and In-App Purchase payment processing

Each service has its own privacy policy. We only share the minimum data necessary for each service to function.

10. Data Retention

• Your flashcards and progress: Retained until you delete them or your account
• Purchase records: Retained for accounting and support purposes
• AI generation logs: Minimal logs for debugging, automatically purged after 30 days
• Uploaded images: Not retained after processing

11. Children's Privacy

Hashcards is a learning app suitable for users of all ages. Children can use the app as guests without providing any personal information. For registered accounts (which require an email address), we recommend parental guidance for users under 13. We minimize data collection for all users and do not collect any information beyond what is necessary to provide the service.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes through the App or via email for registered users. The "Last updated" date at the top reflects the most recent revision.

13. Contact Us

If you have questions about this Privacy Policy or your data, please contact us.