Privacy Policy

1. Controller

2. What we process, and why

2.1 Account and sign-in

You can sign in with Google, with a magic link sent to your email address, or with email and password. Sign-in runs on our own servers (the Better Auth library on Cloudflare Workers); no authentication provider other than Google is involved. We store:

• Email address, display name and, with Google sign-in, the profile picture URL
• With email and password: a salted hash of your password. We never see or store the password itself
• With Google: the Google account identifier and the fact that it is linked
• Sessions: a random session token, its creation and expiry time, the IP address and the browser identification (user agent) of the device that signed in. The session cookie studycards.session_token is valid for 30 days
• Sign-in tokens (magic link, email verification, password reset) as hashes with a short validity (15 to 60 minutes)

Sign-in and sign-up by email are protected by Cloudflare Turnstile (section 7) and by rate limits keyed on the IP address, which are kept only for the length of the limit window. Legal basis: Art. 6(1)(b) GDPR (performance of the contract), for the security measures Art. 6(1)(f) GDPR (legitimate interest in a secure service). You must be at least 16 years old to create an account (section 13).

2.2 Technical access data

When you access the service, the request carries your IP address, browser type and version, device information, time of access, the page requested and the referring URL. This data is needed to deliver the pages, to keep the service stable and secure and to defend it against abuse (Cloudflare, section 5). Legal basis: Art. 6(1)(f) GDPR.

2.3 Your content

To provide the app we store your flashcard decks (title, description), the cards (question and answer text), the images you attach to cards, your study progress and the history of your reviews. Every database query is scoped to your account; another user cannot read your content.

Sharing is off until you turn it on for a deck. Sharing creates a public link of the form /d/<token> that anyone holding the link can open without signing in, together with a preview image for social networks. Images are delivered only to you (signed in) or, for a shared deck, to anyone with the link. Revoking the link ends public access; copies that a browser cached before that remain in that browser's cache. Legal basis: Art. 6(1)(b) GDPR.

2.4 Card images

Images you attach to a card are stored in Cloudflare R2 with the storage jurisdiction set to the European Union and count towards the storage allowance of your plan. They are kept for the duration of your account and deleted when you remove them or delete your account.

PDF and PowerPoint files are not uploaded. When you use them to build cards, they are read in your browser to extract text for a prompt; the file never reaches our servers.

2.5 AI: your own Claude, not ours

StudyCards does not operate an AI system and never sends your content to a language model. Cards are generated with the Claude account you already have, through a prompt you copy into claude.ai yourself, through the Claude Desktop or Claude Code MCP connector, or through our REST API with an API key you create. In each case you decide what text leaves your device, and Anthropic processes it under its own terms and privacy policy for your account. When your Claude client writes cards to StudyCards through MCP or the API, we store those cards like any other content (2.3). API keys are stored as hashes; the plain key is shown to you once.

2.6 Payment

Paid plans are billed through Stripe. On Stripe's checkout page Stripe processes your name, email address, payment method, billing address, and, for businesses, the VAT ID, and calculates the applicable VAT (Stripe Tax). We never receive full card numbers. In our database we store only your Stripe customer ID, the subscription ID, the price you chose, the subscription status and the end of the current period. The time at which you accepted the terms and consented to the early start of the service in the order step is recorded in the metadata of the Stripe session and subscription. Legal basis: Art. 6(1)(b) GDPR and, for the retention of accounting records, Art. 6(1)(c) GDPR.

2.7 Sign-up source

While you browse the site, the page keeps in its memory where this visit came from: the campaign parameters of the link you arrived through (UTM parameters, if any), the host name of the referring website (for example www.reddit.com, never the full address) and the page you landed on, without its query string (for a shared deck link, without its token). Nothing is written to your device for this; a reload forgets it. If you sign in during that same visit, this origin is stored once with your account and never overwritten. We use it only to learn which channels bring people to StudyCards; it is not shared with third parties and not used for advertising. If your browser sends the "Global Privacy Control" or "Do Not Track" signal, nothing is stored. Legal basis: Art. 6(1)(f) GDPR; you may object at any time (section 10), and the entry is deleted with your account.

2.8 Cookies and local storage

We use only what the service needs to work (§ 25(2) TDDDG, Art. 5(3) ePrivacy Directive); there are no advertising or tracking cookies and therefore no consent banner:

• studycards.session_token: your sign-in session (30 days)
• sc_locale: your language choice
• Browser local storage (sc_*): a flag that you have seen the welcome screen, flags that stop the same milestone being counted twice, and the draft of the free tools so your cards survive the sign-up round trip

2.9 Study reminders (optional)

You can ask us to email you when cards are due. We send these reminders only after your explicit opt-in (at the end of a study session or in your settings). Legal basis: Art. 6(1)(a) GDPR. For this we process your email address, the time of your consent, the time of the last reminder and the number of due cards; at most one reminder per day, and only when cards are actually due. You can withdraw at any time with the unsubscribe link in every reminder (no sign-in required) or in your settings. When you open the study link in a reminder, we only increase a daily counter of clicks without recording who clicked.

2.10 Transactional email

We send sign-in links, email verification, password reset, a welcome email, the confirmation of a cancellation and, if you opted in, reminders from noreply@studycards.io through Cloudflare Email Service (section 5). Messages you send us through the feedback form or by email reach a mailbox hosted by Microsoft (outlook.de) and are kept as long as needed to handle your request.

2.11 Device handoff (QR code)

When you continue on another device by scanning a QR code, a one-time token (stored as a hash, valid for 60 seconds) signs that device in. Legal basis: Art. 6(1)(b) GDPR.

2.12 Cancellation form and withdrawal function

When you cancel through the form on /kuendigung or withdraw through "Withdraw from contract", we process the details of your declaration: name, account email address, for a withdrawal the plan and optionally the order date, for a cancellation the type of cancellation, the timing (optionally a date) and, for an extraordinary cancellation, the reason, plus the date and time of receipt. The purpose is to process the declaration and send you the confirmation the law requires. Legal basis: Art. 6(1)(c) GDPR in conjunction with §§ 312k, 356a German Civil Code, and Art. 6(1)(b) GDPR. The confirmation to you and a copy to us are sent through Cloudflare Email Service (section 5); the form is protected by Cloudflare Turnstile (section 7). We keep the confirmation and the copy as proof until the end of the limitation period, three years from the end of the year of receipt.

3. Purposes in short

• Creating and managing accounts, signing you in securely
• Storing and synchronising your decks, cards, images and study progress
• Processing payments and managing subscriptions
• Sending transactional emails and, with consent, study reminders
• Detecting and preventing abuse (bot protection, rate limits)
• Monitoring errors and keeping the service stable
• Measuring how many people use the site (first-party, section 6)
• Fulfilling legal obligations (tax and accounting)

We never sell personal data.

4. Legal bases

• Art. 6(1)(b) GDPR, contract: account, content storage, payment, transactional email, device handoff
• Art. 6(1)(f) GDPR, legitimate interest: access logs, error tracking, server logging, bot protection, rate limits, first-party audience measurement, sign-up source
• Art. 6(1)(a) GDPR, consent: study reminders; you can withdraw at any time
• Art. 6(1)(c) GDPR, legal obligation: retention of accounting records, confirmation of cancellations and withdrawals (§§ 312k, 356a German Civil Code)

5. Processors and other recipients

We use the following providers to operate the service. Where they process personal data on our behalf, data processing agreements under Art. 28 GDPR are in place.

6. Audience measurement (first-party, cookie-free)

We count page views and estimate the number of visitors per day ourselves, on our own infrastructure; nothing is passed to an analytics provider and nothing is stored on your device for this. To avoid counting the same visit twice within a day we derive a truncated checksum from your IP address, your browser identification and a secret value that changes every day. The IP address is processed in memory only and never stored or logged; the checksum cannot be turned back into it and is deleted after no more than 48 hours. There is no cross-site recognition, no profiling and no merging with your account data. Legal basis: Art. 6(1)(f) GDPR.

Your right to object (Art. 21 GDPR): if your browser sends the "Global Privacy Control" (Sec-GPC) or "Do Not Track" (DNT) signal, no checksum is derived and no sign-up source is stored; your visit then only contributes to the anonymous total. You may also object at any time by contacting us.

7. Bot protection (Cloudflare Turnstile)

Sign-up and sign-in by email, the feedback form, the cancellation form and the withdrawal function are protected by Cloudflare Turnstile. Turnstile may process the IP address, browser and device characteristics and interaction patterns on the page to tell people from bots. It sets no tracking cookies. Legal basis: Art. 6(1)(f) GDPR (prevention of abuse).

8. International transfers

Cloudflare, Stripe, Sentry and Better Stack are companies based in the United States. Where personal data leaves the European Economic Area, we rely on the EU-US Data Privacy Framework for certified providers and otherwise on the Standard Contractual Clauses of the European Commission, with additional technical measures. Where the provider offers it, we keep data in the EU: the database and the image storage are pinned to Cloudflare's EU jurisdiction, and errors go to Sentry's EU data centre.

9. Retention

• Account, content, images, study data: for the duration of your account. You can delete the account yourself in the settings; everything above is then erased at once. A running paid plan has to be cancelled first. If the paid term has not ended yet, you choose whether the account is deleted at the end of the term (you can withdraw that booking until then) or right away; in the latter case the remaining term forfeits without refund
• Sessions: 30 days, or until you sign out
• Sign-in and handoff tokens: minutes to one hour
• Payment records: invoices, transaction data and the customer record at Stripe (name, email address, billing address) for the statutory period of up to 10 years (§ 147 AO, § 257 HGB), also after the account is deleted; the link to your account is removed. Legal basis: Art. 6(1)(c) GDPR
• Server logs and error events: up to 90 days
• Cancellations and withdrawals: the confirmation and our copy for three years from the end of the year of receipt (end of the limitation period)
• Audience measurement checksum: no more than 48 hours
• Feedback and email correspondence: as long as needed to handle the request

10. Your rights

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR): delete your account yourself in the settings ("Delete account"), or ask us
• Restriction (Art. 18 GDPR)
• Data portability (Art. 20 GDPR): download your decks, cards, study data and account details as JSON in the settings ("Export data")
• Objection (Art. 21 GDPR) to processing based on legitimate interest
• Withdrawal of consent (Art. 7(3) GDPR) at any time, without affecting the lawfulness of earlier processing
• Complaint to a supervisory authority, in particular in the Member State of your habitual residence. The authority responsible for us: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz (www.datenschutz.rlp.de)

To exercise your rights, email studycardsio@outlook.de. We answer within one month.

11. Security

• TLS for all data in transit, encryption at rest for database and image storage
• Every database query is scoped to the signed-in account on the server
• Passwords, sign-in tokens and API keys are stored only as hashes
• Input validation on every endpoint, rate limits, bot protection
• Error monitoring and structured logging without account identifiers

12. Sign in with Google

• Google remains responsible for the authentication itself
• We store only the profile information needed to operate the service
• You can revoke the link in your Google account permissions
• Deleting your studycards.io account does not delete your Google account

13. Minimum age

The service is not intended for children under 16. You must be at least 16 years old to create an account; the sign-up page says so. We do not knowingly collect personal data from younger users; if we learn of such an account, we delete it.

14. Changes to this policy

We update this policy when the service or the law changes. The current version is always on this page with its date at the top; significant changes are announced in the app or by email to account holders.

15. Contact