Data Deletion Policy

How to delete your account

Open Settings, then Account, then Delete account. Type the word DELETE, and we email you a link (it works for 60 minutes and only once). Open the link to confirm. The email goes to the address on your account, so it works if you sign in with Google too. If you can't sign in, email us from the address on your account and we will help; a deletion we process for you this way is kept for 90 days before it is purged (see Accounts we deactivate below).

If you have a paid plan, cancel it in Billing first. If you teach a class, transfer it to another teacher of the class (they have to accept) or close it first. Cancelling stops future charges. Deleting locks your account at once, so any paid time left on a cancelled plan ends, and nothing more is charged. If you write to us within 30 days of asking for the deletion, we refund each full month of that paid time that was still to come on the day you asked (not a month that had already begun), to the card you paid with. The email we send to confirm the deletion tells you this, and so does the locked screen. Stripe keeps its own customer record and invoices; we never delete anything at Stripe.

What happens after you confirm

• Your account locks at once. For 30 days you can sign back in and choose Cancel deletion to reopen it. Signing in alone does not cancel it. Public decks and tutors that came down when the account locked are published again as they were.
• After 30 days everything below is deleted for good. We cannot get it back. We email you when it is done.
• Deleted: your account and how you sign in; your account security log, your failed-sign-in counter and your daily email counters; your devices, push notification subscriptions and notification settings, and your notification prompt record; your reminder, personalization and win-back records; your reminder time and place, your daily plan time choice, rest days and breaks, streak make-ups, catch-up plan, league opt-out and the prompts you have seen; your welcome-back offer history, your getting-started message records, your weekly recap email log, and which upgrade cards you were shown; your Recall Race statistics, mini-game counters, referral records and promo-code records; your username change requests; your decks, cards and folders, the decks in your Recently deleted and their cards, your diagrams and their pictures, and the notes, study guides and imports made from your files; your Exam Countdown exams; the courses you own (you are removed from courses you joined); the Cardvoo Live rooms you hosted outside a class (and your place in other players' rooms); your podcast episodes and their audio, so their share links stop working; your study history, your first-step record, streaks, active-time records and league ranks; your friends, friend streaks, friend requests, blocks and invite link, and your league cohort rows; your theme preference; the tutors you made, your copies of other people's tutors and your tutor sample markers; your Ask chats, Cram runs (including anything you typed) and in-app notifications; the question reports you made; the decks you marked "worked for me" and the marks themselves (counts are corrected overnight), the remixes you made; your saved files; and, for teachers, your teacher application records, your Google Classroom connection and tokens, the practice sets and tutor recommendations you made for your classes, your units, substitute-plan pages and link records, printable files, shared units, free-allowance usage records, school proof and colleague vouch records, free AI allowance records, weekly summaries and time-saved totals, your question tools content (question insights, revisions, comment banks, retake versions, prerequisites and vocabulary), unapproved AI drafts and Meeting prep sheet files. Copies of a shared unit that other teachers already added stay with them and the credit changes to "A former Cardvoo teacher".
• Decks in Recently deleted are deleted with your account and do not wait for their own 30 days.
• Email send record: deleted 90 days after each email, or when your account is deleted, whichever comes first.
• Do-not-email list: the one-way code of an address stays so an unsubscribe, bounce or complaint is honored. It holds no name and no account ID.
• Product news answer: your choice is stored with your account and deleted with it; the do-not-email list above is what remains if you unsubscribed.
• Error reports: removed by our error-monitoring service after 90 days. We do not keep a separate copy.
• Error-report account code: a one-way code; deleting your account removes our ability to link it to you.
• Bulk import records (a record of a batch of files you imported, with the names of the files and the decks made): deleted 30 days after the import finishes, or when your account is deleted, whichever comes first.
• Visual templates you submitted: deleted when your account is deleted, except an approved template other people's cards use, which stays without your name.
• A class's groups, group membership and AI feedback are class records and not part of a teacher's account. They stay with the class, which is transferred to another teacher or closed when a teacher's account is deleted, and they are deleted or anonymized as the class is (see "Schools and class data"). A class's Live game results and questions, homework, exit ticket and Quick check answers, Support plans and reteach events are class records: they stay with the class and are deleted or anonymized when the class is, and a student's own answers are removed from them when the student's account is deleted.
• Your username is replaced by "A former user" in the friend notifications other people received.
• Public decks and tutors you published on Explore come down the moment the account locks, and are deleted at the end of the 30 days. Copies other people already added to their own library stay with them. The credit on those copies and on remixes of your decks changes to "A former user" and the link to your deck is removed.
• Feedback you sent us (your answers, notes and the account ID stored with them) is deleted with your account. Feedback we have not yet deleted is otherwise removed 12 months after you sent it.
• Deleted data also ages out of our backups within 35 days. Counting the 30 days, everything is gone from our systems and backups within about 65 days of your confirming the deletion.
• What we keep: payment and tax records (Stripe's, and our own billing records, which carry your account id or, after the deletion, a keyed hash of it, and hold no study content), including pause, failed-payment and renewal-reminder records, the record of what you agreed to at checkout, the fact that a discount or scheduled price change was applied to a payment, and the notices we sent about it; the record that you accepted our terms (document versions and dates), with your account id replaced by a coded identifier (a keyed hash) and a parent's name and address replaced by keyed hashes, kept for 3 years after the deletion and then deleted; for a child account, the record of the parent's consent (the account, parent name and parent address each replaced by a keyed hash, kept for 3 years after the deletion and then deleted)); a note that the deletion happened and when (keyed by a hash of the account id, with no personal data, kept for 3 years and then deleted); strikes, appeals, and league and race records, as a safety record for 2 years after the deletion and then deleted; a do-not-email list (address hashes) that we keep until the person asks us to remove an address, because removing it would let us email them again; coded markers (a keyed hash of the device and IP marker for 12 months after last use, and of the payment-card fingerprint for 24 months after last use, with no name or email, plus the redemption row with the account id replaced by a keyed hash for the same 24 months) of promo codes, free months and welcome-back offers you redeemed, so an offer cannot be claimed again by re-creating an account; an admin audit log of feature switches (no user data); and the estimate model's own numbers, which contain nothing about you. Reports you made or that were made about you are kept for one year after they were filed and then deleted, and the reporter's account ID in a report becomes a keyed hash when the reporter's account is deleted. This includes reports about public decks. A class you owned stays as a read-only archived record and is anonymized after 12 months, and a student's class records are anonymized rather than deleted. Quotes and invoices for a school's seats are the school's business records and are kept for the tax and accounting period; closing a teacher's account does not delete them. This includes the minimal record of a consent request for an account we removed because no parent gave consent in 30 days.

Accounts of children and teachers

• An account of a child under 13 needs a parent to confirm. Asking to delete emails the parent, who has 7 days to confirm from their link; until they do, the account works as normal. A parent can also start the deletion from the "Delete my child's account" link in any email to a parent: they give the child's username and their own email address, we never say whether they matched an account, and the confirm link we email works for 60 minutes. During the 30 days either the child or the parent can cancel. If you are 13 or over, you delete your own account and no parent confirms it.
• If a parent never confirms. An account made by someone under 13 does not start until a parent gives consent. If no parent has given consent 30 days after the account was created, we delete the account and everything stored with it, and we email the parent address that was entered at sign-up once to say so. The email does not name the child or the username. A parent who gives consent before then keeps the account.
• A teacher must transfer each class to another teacher of the class (who has to accept; until then it is not transferred) or close it. Closing a class tells its students. If you cannot do either, write to us and we will close a class for you; we aim to do so within 10 business days.

Children's information: how long we keep it. We keep a child's (under 13) personal information only as long as we need it for the reason we collected it, and then we delete it. In practice:

• Account and study data (decks, cards, review history): until the account is deleted by the child or parent, then as described above. After a deletion, only the records listed as "What we keep" in the list above remain, each for the period stated there.
• Daily activity, study-session and active-time totals (internal operations): 90 days, then deleted.
• Push notification records (what was sent, to count the daily and weekly limit): 7 days.
• An account still waiting for a parent's consent: 30 days from sign-up, then deleted, with the parent's email address entered at sign-up.
• Parent consent record: as described above.
• For a child we use a study-activity estimate only to lower the number of reminders, and we create no win-back contact list or marketing profile.

A parent can ask us to delete a child's information at any time, from the "Delete my child's account" link or by writing to [email protected].

Accounts we deactivate

When we remove an account ourselves (for example a permanent ban) or process a deletion request for you (for example because you cannot sign in), the account is deactivated immediately and its data is kept for 90 days for backups and legal or compliance purposes, then permanently purged. If a banned account has an open or still-eligible appeal, that 90-day clock doesn't start until the appeal is resolved or the appeal window passes unused. For these accounts the legal acceptance record and the parent consent record are kept for the periods stated under "What we keep".

How long each kind of deletion takes

• A deletion you start yourself, or that a parent starts for a child: the account locks at once, is deleted from our systems 30 days after you confirm, and is gone from our backups within 35 days after that, so within about 65 days of your confirming.
• A deletion we process for you (for example because you cannot sign in), or an account we deactivate: the account is deactivated at once, its data is kept for 90 days and then deleted, and it is gone from our backups within 35 days after that, so within about 125 days. For a permanent ban the 90 days start when any appeal is over.
• A school's written request to delete or return its class data: we delete or anonymize the data in our systems within 30 days of the request, and it is gone from our backups within 35 days after that, so within about 65 days of the request.
• A single deck you delete: it is hidden at once, kept in Recently deleted for 30 days, then deleted from our systems, and gone from our backups within 35 days after that, so within about 65 days of your deleting it. A deck you delete from the Archived view is deleted at once and does not go to Recently deleted.
• An account still waiting for a parent's consent: deleted 30 days after it was created, and gone from our backups within 35 days after that, so within about 65 days of sign-up. The minimal consent record is kept as stated under "What we keep".
• The records we keep after a deletion are the ones listed under "What we keep", each for the period stated there.

Guest sessions

A guest session has no account, so there is no account or progress to delete on our servers: we keep no guest account and no guest progress. Ordinary web records, described in the Privacy Policy, Sections 1 and 4s, are not tied to a guest. Your guest progress is kept only in your browser on your device, and the app deletes it 14 days after you last used it. You can delete it at any time by clearing your browser's site data for cardvoo.com.

Deleting specific content instead

If you just want to remove a single deck or set a deck back to private, you can do that yourself from its own page. A deck you delete goes to Recently deleted and stays there for 30 days, so you can restore it. You can choose Delete forever to remove it sooner. After 30 days it is deleted for good, with its cards, review history and the images and audio on its cards. You can delete a single diagram, with its picture, the same way. You can also set Reminders to Essentials only in Settings, Notifications, which stops the study-activity estimate and deletes the one we hold. You can leave leagues, or clear your reminder time and place, in Settings without deleting your account. No need to delete the account for any of that.

Schools inquiries

If you filled in the form on our Schools page, you are not necessarily a Cardvoo user. To have your inquiry (name, role, school or district, size, interest and message) deleted, write to [email protected] from the address you used; we delete it within 30 days of your request. We delete inquiries after 2 years anyway.

Schools and class data

A school or district can ask us in writing at [email protected] to delete or return the class data of its teachers' classes. We delete or anonymize it within 30 days of the request, including the classes' groups, AI feedback and substitute plans, and we send a CSV of the roster and grades on request, before deleting. There is no single delete button for a school today, so we do it by hand: we close the classes and run the same routine that anonymizes a closed class after 12 months, then delete what is left. The students' and teachers' own Cardvoo accounts are not deleted by a school's request, because they belong to those people. Deleted data leaves our backups within 35 days. A student's choice to be left off a class leaderboard is deleted when they leave the class and when the class is closed or deleted; the leaderboard itself is worked out when the class page is opened and is not stored. Anonymized means that we remove the link to the student's account, the student's class name and any text the student wrote, so that the record cannot reasonably be linked to a person. A class with no teacher or student activity for 12 months is closed automatically and then handled as a closed class.

Questions

[email protected]. Cardvoo is operated by Bleart Emini, a sole proprietor, 200 Greenville St Ste C, Newnan, Georgia 30263, United States. If Cardvoo moves to a company owned by its founder, or to a new owner, that company becomes the operator on the date we announce on this page and in the app, and this policy keeps applying to it.