Cardvoo Privacy Policy

About this policy

This Privacy Policy is for Cardvoo, the flashcard app and website at cardvoo.com, and for the Cardvoo developer account that operates it, including its optional Google Classroom integration for teachers. It explains what personal data Cardvoo collects, how it is used and shared, how long it is kept and how to have it deleted. The handling of data we receive from Google is described in Section 6a, under headings that follow Google's own checklist. Cardvoo is operated by Bleart Emini, a sole proprietor, in 200 Greenville St Ste C, Newnan, Georgia 30263, United States.

New features. We add features one at a time. If this policy describes a feature that has not been switched on for you yet, that feature does not run, and none of its data is collected or used, until it is switched on. We list new features in What's new. If Cardvoo is offered in an app store, the app is the same service and this policy applies to it.

1. What we collect

• Account info: email address, password (hashed, never stored in plain text), self-reported birthdate.
• Theme preference: whether you chose light, dark, or to follow your device, stored with your account so it is the same on every device.
• Parental consent data and parent contact: for under-13 accounts, a parent or guardian's full legal name, email address and consent timestamp; for any account that has a parent contact, that parent's email address, kept while the link to that parent is active, including after the account holder turns 13 and until they turn 18, remove the link or delete the account. See Sections 9, 9a and 10.
• Parent email change requests (accounts with a parent contact): the current and the new parent email address, who started the request, its status and dates, and a short log of each step. The emailed links are stored only as keyed hashes. See Section 9a.
• Legal acceptance record: which version of the Terms of Service and Privacy Policy (and, for teachers, the Teacher terms and DPA acknowledgement) your account accepted or was shown, the date, and whether you or your parent accepted. When a parent accepts, we also keep the legal name and email address they gave. You can see it in Settings, Legal, and it is included in your data export. See Section 10 for what is kept after an account is deleted.
• Account deletion records: if you start deleting your account, the state of the request and its dates, the emailed confirmation links (stored only as keyed hashes) and, after the purge, a short audit entry. See Section 10.
• Account security log: sign-ins and other security events on your account (the event, the time and a device label), kept for 400 days after each entry and deleted with your account.
• Study content: the decks, cards, and review history you create or study, the diagrams you make (Section 4j), the colors, icons and cover photos you choose for decks (Section 4r), and your Exam Countdown exams and the courses you make or join.
• Notes and imports: we keep the extracted text only of files you upload for a study guide and, since October 2026, of new imports (uploads, pasted text and web pages) so you can ask questions about them later. The original file itself is discarded. See Section 4 below for the full detail.
• Ask your material chats: the questions you ask and the answers you get, saved with the deck or guide they are about and deleted automatically 90 days after the last message. See Section 4b below.
• Class Ask: if you are a student asking about your teacher's shared material, your chat is private to you and kept 90 days; the class keeps only a count and a topic label per question, never the question or the answer. See Section 4c below.
• Friends and profile data (accounts aged 13 and over, where Friends is available to the account): your friends, the friend requests you send and receive, the people you block, your profile visibility choice, and your invite link (we store only a keyed hash of it, never the link itself, until you replace it or delete your account). See Section 4d below.
• Friend streaks (accounts aged 13 and over with Friends): the count of days you and a friend both studied in a row and whether each of you has studied today. See Section 4d.
• League cohort: the group of up to 30 people you are placed with for a week in Ranks, and whether you chose to leave leagues. See Section 4h.
• Cram runs: the cards in each Cram run, your results, any "My answer was correct" marks and, for a wrong typed answer only, what you typed (at most 200 characters), so the run summary can show it. Only you see this, it is included in your data export, and the last five runs are listed in the app. See Section 4f below.
• Public tutors: if you publish a custom tutor, its name, description, subject and your username are shown to other signed-in users aged 13 and over, and to anyone who opens its link; if you add someone else's tutor, we keep your own copy of it; if you report a tutor, we keep your report. See Section 4e below.
• Explore marks and remixes: for accounts aged 13 and over that are not students in a class, the decks you marked "worked for me" and the link from a remix you published to the deck it came from; and, for accounts aged 13 and over, the reports you file about public decks (the deck, the reason, optional details and your account ID). See Section 4o.
• Question reports: if you use "Report this question", the question's ID, the reason you chose and your account ID. See Section 4i.
• Feedback you send us: if you tap an answer or write a note when Cardvoo asks for feedback, or use Send feedback in Settings, we store your answer, your note, which screen or moment asked (for example after a test or when a daily limit was reached), your plan, the app version, the time, and your account ID. Please do not put names, email addresses or other personal details of other people in a note. You can send feedback without answering; the prompts never ask for study content. See Section 4l.
• Usage & gameplay data: study streaks, mini-game results, Recall Race match history, Study-to-Earn activity, and the Cardvoo Live rooms you host.
• Study habits you set: your daily goal, the time you pick for your daily plan (5, 10 or 20 minutes), planned rest days and breaks, streak freezes and make-up days, a catch-up plan you start for overdue cards (with a 24-hour undo list), your chosen reminder time and, if you pick one, a place from a short list, and markers that you have seen a prompt (for example a post-exam prompt). See Sections 5a and 10.
• Internal-operations analytics: daily activity records, active study time, AI usage logs, study-session logs, reminder delivery records, and the first-step record described in Section 5 (accounts aged 13 and over that are not in a class and not managed by a parent), used only to run and improve the service. See Sections 5 and 5a.
• Reminder records: the push notifications we send you (when, what kind, and the time you opened one if your device reports it), your Reminders setting, and a count of how many we sent each day and week so we stay inside our limits. See Section 5a.
• Getting-started messages (accounts aged 13 and over that are not in a class and are not managed by a parent): a record that we sent you one getting-started push notification or email, and when, so we never send it twice. See Section 4n.
• Weekly recap (accounts aged 13 and over that are not in a class and are not managed by a parent): the recap card is worked out from your own study records when you open the app and is not stored. For recap emails (accounts aged 13 and over), a log of which recaps we sent and when, kept for 12 months. See Section 4n.
• Study-activity estimate (every account with a birthdate; for accounts under 13 and students in a class it is used only for reminder timing; never for teachers): a number from 0 to 100 that we work out from your own recent study records, including when you last studied, any exam date you entered, your streak and the hour of day you usually study, to estimate whether you may be drifting away. We use it to decide how and when to remind you, which in-app message to show, how many ads you would see and where if ads are ever turned on (Free plan only), and when to show you a message about a paid plan. It is deleted automatically after 30 days and is part of your data export. You can switch it off. See Section 5b.
• Win-back log (accounts aged 13 and over): which "we miss you" messages and welcome-back offers we sent you and when, so we never send more than we say. See Section 5b.
• Upgrade cards shown (accounts aged 13 and over on the Free plan): which streak-milestone cards about paid plans we showed you. See Section 2.
• Billing data: handled by Stripe directly. We store your subscription status and plan, not your full card number. We also keep billing records of a pause, a failed payment and the emails about it, renewal reminders, and what the checkout showed you and the button you pressed when you subscribed (the record of your consent to a renewing plan).
• Student verification data (Pro/Standard student pricing): you verify with a school .edu email (we email you a 6-digit code) and tell us your graduation year, or, if your school has no .edu email, send a photo of a student ID or a class schedule. Uploads are kept privately, seen only by Cardvoo staff reviewing your request, and deleted as soon as the request is decided. We keep only the outcome, the method you used, the expiry date (the earlier of 12 months or Aug 31 of your graduation year) and, for a school email, a one-way hash of the address rather than the address itself. You must be 18 or over to send a student ID photo or a class schedule; we do not accept one from an account under 18.
• Teacher application data (teachers only): the school email you verify with a 6-digit code, your school name, role and grade level, and an optional staff-page link. We keep a one-way hash and the domain of the school address for review, and an encrypted copy of the address so we can send your daily class digest there if you choose. The copy is never shown back, and you can send the digest to your account email instead, or turn it off, in Settings. It is deleted with your account. If you add proof of your school (a link to a staff page, or up to three PDF, PNG or JPG files of up to 5 MB each), we keep it only to check your school, show it only to the people at Cardvoo who review teacher applications, never open a link automatically, never send it to an AI model, and delete the link and the files 30 days after we decide on your application, or when your account is permanently deleted if that comes first.
• Teacher tools data (teachers only): the units a teacher builds in the unit planner, group labels and the list of students in each group, drafts and approved AI feedback on students' written answers, substitute-plan pages and their link records, printable files, units a teacher shares, usage of the free AI allowance and, for a seat paid by a school, the seat record. See Section 4t and Section 6d.
• Google Classroom data (teachers who choose to connect Google Classroom only): the connected Google email, encrypted access tokens, course and assignment IDs, and grade-sync audit rows; roster names and emails are read on demand and not kept. See Section 6a below.
• Voice answers (Pop-Quiz podcasts and Walk & Recall, Pro tier): recorded only while you answer, sent to our speech-to-text provider to grade the answer, and not stored as audio. The transcript is kept with the review.
• Podcast episodes: generated audio and transcripts, stored for 90 days and then deleted automatically. When deck sharing or a share link is turned on, anyone with the link can play them. An episode made from exactly the same deck content and settings as one made earlier may be a copy of that earlier episode (Section 4j).
• Photos for Snap & Occlude: sent to our AI provider to find labels in the image, and stored as part of the cards you create from them.
• Charades video: if you record a round, it's kept only on your device and never uploaded to Cardvoo.
• Devices: a random per-browser ID, a browser/OS label, an optional name you give it, the AI model downloaded, and last-seen time, used to power "Your devices" in Settings.
• Unsent study answers, on your device only. If you are signed in and the app cannot send a rating of a card to our servers (the connection dropped, or your session ended), the app keeps a copy of that request in your browser's storage on that device, so it can send it later and your review is not lost. The copy holds the request exactly as the app would have sent it: which card, the rating, the time you rated it and an id that stops it being counted twice, together with your account id and the time it was saved. This applies to ratings of your own cards and to ratings of an assigned class review. It holds nothing else: no deck titles, no card text, no notes and no other kind of change. Nothing leaves the device except the same request being sent to us. The app sends the copies when the connection is back or you sign in again, oldest first, and a copy is deleted from the device as soon as it has been sent. A copy is also deleted if our servers refuse it for good. Choosing Sign out in the app deletes every copy kept on that browser, including any that belong to a different account. Locking your account for deletion (when you confirm the request to delete it, on any device where you are signed in or open the confirmation link) deletes them too, and cancelling the deletion later does not bring them back. If your session only ends or expires, the copies stay so they can be sent after you sign in again; if a different person signs in on that browser, the earlier person's copies are not sent for them, and they are deleted the next time anyone chooses Sign out. You can also delete them at any time by clearing this site's data in your browser. We do not keep a second copy of them on our servers.
• Usernames: public, either randomly generated for you or chosen by you. Chosen names are checked by our AI moderation provider before they go live. Previous usernames are kept for 30 days to prevent impersonation of a name you've released.
• Offers and fraud prevention: when you use a promo code, a trial, a free month, a welcome-back offer or a referral, we keep who redeemed what, plus three signals used only to stop the same person getting an offer twice or referring themselves: a card fingerprint from Stripe (a code that stands for your card; it is not your card number and we cannot read your card from it), a device marker that Cardvoo creates and stores in your browser, and your IP address when you redeem. We store the device marker and the IP address only as one-way hashes, and we keep each for 12 months after you last used an offer. We keep the card fingerprint for 24 months after you last used an offer. If you delete your account, we keep these hashes (and nothing else about you for this purpose) until those periods end, so that deleting an account does not reset a free offer. We do not use these signals for advertising, we do not sell or share them, and we do not use them to profile you. Accounts under 13 and parent-managed accounts cannot use these offers, so no signals are kept for them for this purpose; accounts aged 13 and over can share a referral code and redeem an offer on their own account. If you are 18 or over and a friend signs up with your referral code or link, we also keep a record of it for the referral thank-you (we keep no such record, and count no study days, for a referrer under 18): your account, the friend's account, the sign-up date, how many different days the friend has studied in their first 30 days (counted inside Cardvoo and never shown to you), and the date a thank-you was granted. If you are the friend who signed up with someone's code or link, we count on how many days you studied in your first 30 days to decide whether they earn a thank-you; they are never told what you studied, and we keep that count with their record. We compare the same device marker and one-way hash of the network address used for the other offers. We keep that record with your account and delete it when you delete the account; if your friend deletes their account, their ID in your record becomes a keyed hash. We do not use it for advertising, we do not sell it, and we do not use it to profile you. The data you can download from Settings does not include these signals, because they are used to prevent abuse.
• How you found Cardvoo: When you create an account, we record how you found Cardvoo: the campaign tags in the link you used (for example, a flyer or a social post), the website that sent you (its host name only), and the first Cardvoo page you opened. We use this only to learn which of our own outreach works, we do not use it for advertising, and we do not collect it for children under 13. We also keep anonymous daily counts of visits to links with campaign tags; these contain no cookie, device ID or IP address. Until you sign up, your browser keeps these tags on your own device (in its session and local storage, not in a cookie) for up to 7 days. We keep this information for 2 years.
• Guest sessions (people aged 13 and over who try Cardvoo without an account): we keep no account, no progress and no profile for a guest on our servers, and ordinary web records apply as for any visitor (see "Device/technical data" below). The birthdate you type on the first screen is read in your browser to decide whether you can try Cardvoo without an account; it is not sent to us. Your browser may keep a random device ID, which it creates no later than when you sign up or sign in, and send it with its requests; the pages a guest loads do not use it and we do not store it for a guest. Your progress is kept only on your own device and is deleted from it 14 days after you last used the guest session. See Section 4m.
• Exam Countdown and Cardvoo Live: exam dates and the decks you choose to track; Live game participation and scores.
• Schools inquiries (people who fill in the form on our Schools page, not necessarily Cardvoo users): your name, role, school or district, size, area of interest and message. See Section 6b.
• Ad interaction data (free tier, only if ads are ever turned on): confirmation from Google AdMob/Google Ad Manager that a rewarded ad was completed, used to grant in-app credit.
• Device/technical data: standard web request data (IP address, browser type) and error reports, for keeping the app running and fixing bugs. To protect accounts we also keep short-lived counters: rate-limit counters keyed by network address or account, which expire when their time window ends, and a count of failed sign-in attempts for an email address, which locks sign-in for 15 minutes after 5 failures and is deleted a day after the last attempt. We also keep counters, keyed by a one-way hash of a device marker and of a network address, that expire after 24 hours, to limit how many first decks one device or network can ask us to make in the cloud.
• Visitors to public pages (people who read our public pages without signing in): we keep no account information about you. No analytics company counts your visits (Section 4s), and ordinary web records and short-lived abuse counters apply, as in "Device/technical data" above.

2. How we use it

To run the app (scheduling your reviews, syncing your decks, running mini-games and Recall Race matches), to process payments and apply promo codes, free months and welcome-back offers, to send account-related email (verification, password reset, receipts, notices about a price or plan change and a reminder before a price change takes effect, failed-payment and renewal reminders) and optional study reminders (if you turn on notifications), to decide how many reminders to send you and when (Sections 5a and 5b), to show people on the Free plan a message about paid plans when they reach a Free limit or a streak milestone (the limit message is chosen from what you just did; the streak message may be timed using your study-activity estimate, Section 5b; every one also shows how to keep going for free; and we show none to accounts under 13 or to students in a class), to stop one person claiming the same promo code or free month twice, to review questions that people report, to read the feedback you choose to send us, to write unit plans and draft feedback for teachers who ask for them, to enforce our Terms of Service, and to fix bugs. We do not use any of this for advertising, we do not sell it, and we do not use your study content to train any AI model.

3. Ads

Cardvoo shows no ads today: the ad display is switched off. If we ever turn ads on, we will change this policy first and ask you to accept the change, and the rules in this section would apply. Accounts under 13 would never see ads. Accounts aged 13 to 17 would see only non-personalized ads with restricted data processing: we set this on every ad request in our own code, so it does not depend on a setting you can change. Teachers and Educator subscribers would never see ads, and the Teacher Hub would never show ads. An account that is a member of a class would see no ads at all, on any page, whatever its age or plan, and would not be offered the optional rewarded video. This follows the account's membership: an account that has left every class would follow the other rules in this section again. Ads shown to adults would also be non-personalized: we would set restricted data processing on every ad request. How many ads you would see. For Free accounts aged 13 and over, your study-activity estimate (Section 5b) could lower how many ads you see in a day and where: people who may be drifting away would see fewer, in fewer places. The most we would show is 12 a day and 1 on a screen, and about 1 in 10 people would see none at all so we can measure whether ads change how people study. We would never use the estimate to choose which ad you see, and we do not give it to the ad companies.

Where ads can be shown, visitors in the European Economic Area, the United Kingdom and Switzerland may see a consent message from Google (Google Funding Choices, a Google-certified consent management platform). You can reopen it at any time with the "Privacy and ad choices" link in the page footer, which appears on pages where that message has loaded.

4. Notes and imports: what we keep and why

If you upload notes (a PDF, PPTX, or other document) to generate a study guide, or import a document, pasted text or web page into a new deck, we keep only the extracted text. The original file is discarded after extraction. This extracted text (a "SourceNote") is:

• stored privately, attached to the deck it was uploaded for;
• never shown publicly and never copied along if you make that deck public;
• used only to generate and cite study guides and practice exams and, if you use "Ask your material", to find the passages that answer your questions (including the "p.N" page citations);
• included if you request a full account data export;
• deleted when the note or your account is deleted; the deck leaves your library at once and is deleted for good 30 days later; and deleted data leaves our backups as described in Section 10.

Imports made before October 2026 did not keep their source text, so they cannot be asked about unless you upload them again. You can delete the kept text of any import at any time from the deck's sources, without deleting the deck.

If you choose "Save to note" on an Ask answer, the question, the answer, its source links and the date are copied into a note called "Saved answers" on that deck. From then on it is an ordinary private note: it is not subject to the 90-day expiry of Ask chats, it can be read by Ask and study guides like any other note, it is included in your data export, and it is deleted when you delete the note, the deck or your account.

Recently deleted decks. When you delete a deck, it moves to Recently deleted instead of being erased at once. The deck, its cards, the review history of those cards, the schedule of each card, the deck's folder links, its settings and its topics are kept there for 30 days, so you can restore the deck. While a deck is in Recently deleted it is hidden: it is not in your library, folders or search, and its public page and link stop working. You can restore it any time in the 30 days, and everything comes back as it was, except that a folder link comes back only if that folder still exists. You can also choose Delete forever to remove it sooner. Deleting a deck from the Archived view is different: the app says it is gone for good, and the deck is erased at once and does not go to Recently deleted. Study guides, test history, diagrams and reference pages made from the deck are not kept; they are deleted when you delete the deck. 30 days after you deleted it, a daily scheduled job deletes the deck, its cards, its review history and the images and audio on its cards. Deleted data then ages out of our backups within 35 days, so a deck is gone from our systems and backups within about 65 days of your deleting it. If you delete your account, decks in Recently deleted are deleted with it and do not wait for the 30 days (Section 10). They are part of your data export.

4b. Ask your material: chats

"Ask your material" answers questions from your own decks, notes, study guides and imports. Your chats are:

• private to your account and saved with the deck or guide they are about;
• deleted automatically 90 days after the last message, or sooner when you delete a chat;
• deleted with the deck or your account, and included in a full data export;
• able to carry a thumbs up or thumbs down that you give an answer, which is saved as part of that message and is kept, exported and deleted with the chat; a message you have started typing and not sent is kept only on your device, for up to 14 days, and is never sent to us;
• answered on your device if you are on the Free plan (nothing is sent to us), or by a cloud AI model on Standard and Pro, where only the question, the few passages needed to answer it and the recent turns of that chat are sent (see Section 6 for who processes AI requests);
• on Standard and Pro, helped by a second ranking step: your question and the passages being considered are turned into embeddings (lists of numbers) by Cloudflare Workers AI so the best passages are found by meaning as well as by keywords. Those number lists are kept for 90 days and deleted with your account, and nothing is sent this way on the Free plan or on-device (see Section 6);
• checked for safety (your question and the answer) before they are shown or saved.

AI chat is off for accounts under 13 (Section 9). Accounts aged 13 and over can use it. Accounts aged 13 to 17 get a stricter safety prompt, and every message stays moderated.

Answers made on your device. Some answers are made by a model that runs on your own device, so the question never leaves it. If an account aged 13 to 17 saves such an answer to its chat history, we check the saved answer on our servers first, with a list of words and a safety check by a model. If the check finds a problem, the answer is not saved and you see a short note. This applies to saved answers, not to what you type on the device.

Answer quality samples (adults only). For about 1 in 100 AI requests from adults (18 and over) who are not in a class, we keep the first 1,500 characters of the request and of the answer for 30 days, so that a person on our team can check how good the answers are. We do not keep them for accounts under 18, for students in a class, for teachers, or for accounts managed by a parent. A sample is tied to a one-way code and not to your name or email, only authorised staff can read it, and it is deleted automatically after 30 days or when you delete your account.

4c. Class Ask: asking about your teacher's material

In a class, a student 13 or older can ask Voo questions about a guide, deck or Unit that their teacher shared. Here is how that data is handled:

• Teachers never see your questions or the answers. There are no transcripts and no per-student view, and teachers are not shown flagged messages.
• Topics-only summary. For each answered question the class keeps the class, the material, your account, the time and a topic label (a guide section heading or deck title). It holds no question or answer text. Teachers see only counts of questions, how many students asked, and common topics for the last 30 days. These records are deleted after 90 days and when your account is deleted.
• Your chat is private to you. You can delete it at any time, it is deleted automatically 90 days after the last message, and it is included in your data export.
• Safety screen. Every class question is checked before anything else. A message about harming yourself is answered with a support message for your country and is built not to be sent to an AI model to write an answer; a safety check cannot catch every message. No teacher or school staff member is told when this happens in Class Ask, and nobody at a school can see the message; for a class tutor a teacher sees only a count of flagged messages. If that ever changes, we will change this policy first and ask you to accept the change. An unsafe request gets a reply that points back to study topics. When a cloud AI model is used, the question and the answer are also moderated.
• When a cloud model answers. On the cloud path, your question, the few passages of your teacher's material needed to answer it and the recent turns of that chat are sent to our AI provider (Section 6), never your name or email.
• No embeddings. Your teacher's material and your class questions are not sent to Cloudflare Workers AI. The only teacher text it can read is a unit that a teacher chooses to share with other teachers, read once by the safety pre-screen when it is shared (Sections 4t and 6); that read involves no question, name or work of any student.
• Class Ask follows the same age rule as other AI chat: off for accounts under 13, and for accounts aged 13 and over it follows the teacher's switches. The teacher can turn Student Ask off for the class or for a single guide.
• Per-student class results (when a teacher uses per-student assignments). If your teacher assigns work to selected students, the class keeps your class-work results by topic (percent correct per topic and the date you last worked on the class), so your teacher can see which topics are weak and who has been inactive. This comes only from work you do inside the class. It never includes your own personal study history, and it never includes what you typed or were told in Class Ask. You see only that "Your teacher assigned this"; you do not see scores or other students. The school or teacher decides how this data is used and is responsible for it; Cardvoo handles it as the school's service provider under the Cardvoo Data Privacy Agreement. These records follow the class retention rules in Section 10.
• Practice material and tutors your teacher sends you. A teacher can ask our AI provider to write a practice deck or study guide for topics a group of students found hard. The AI is given the topic names and the class's card or guide text only, never your name, email, answers or scores. A teacher can also recommend a class tutor to you for a topic, as an optional resource or as a Support plan with a due date, and may add a short Quick check quiz that is a class result like any other quiz. You see the topic and the date. Your teacher cannot see whether you opened the tutor; the teacher sees the tutor's usage totals and any message its safety filter flags, as Teacher Terms Section 8 says. A practice set and a tutor recommendation, with the list of students it was sent to, are kept for 12 months (a recommendation from when it was last saved) and are deleted earlier when the class is deleted; your name is removed from them when your account is deleted. A recommendation sent to you is in your data export; a practice set belongs to the teacher's class records and is in the teacher's export.
• What a Live game sends to your phone. Your phone receives your own results, your team's name and, when the Classmates list is on for the class, the class names of your teammates, and, if your teacher turns it on, the class board (Section 4q). It never receives another student's account username, account ID or email.
• Who in the class sees you. The teacher who owns a class and its co-teachers see the roster, assignments, grades and class results. A teaching assistant sees the roster and handles join requests only, unless the owner or a co-teacher turns on more for the class (the gradebook, Insights and per-student views, assignment results, announcements, Live results or the Ask summary). Your teacher's roster and exports show you by your class name. Your account email is shown to class staff only if your school's own roster supplied that address; while your request to join is waiting, the owner and co-teachers (not a teaching assistant) see the class name you typed and a masked version of your address (its first letter and its domain, for example j***@school.edu) so they can recognise you. After they approve you, the address is not shown unless your school's roster supplied it.
• Groups and feedback your teacher may use. A teacher may put students in groups to give different support, and may use AI to draft feedback on written answers. You never see a group or its name. If a teacher uses AI feedback, your written answer is sent to our AI provider to draft it, without your name or email, and your teacher reads, changes and approves the feedback before you see any of it. Please do not put personal or private information in an answer. Your teacher and school decide how this data is used and are responsible for it.
• AI grading. If a teacher uses AI to grade a written answer, your answer is sent to our AI provider in the same way (Section 6), without your name or email. The grade can appear before a teacher has read it, and your teacher can change it. It never runs for an account under 13. Before it is sent, we remove email addresses, phone numbers and your own class name from it where we can detect them. We cannot detect everything, so other personal details that you type into an answer yourself can stay in it: please do not put any in.

4d. Friends and profiles

Friends lets people aged 13 and over add each other so they can see each other on a Friends board in Ranks. There is no messaging, no free-text request and no contacts import. This is how it handles your data:

• Who can use it. Accounts under 13 have no friends and no profile that other people can see: if anyone looks up the username of an account under 13, or tries to open its profile, they get the same "user not found" answer as for a name that does not exist, and an account under 13 cannot open other people's profiles either. Turning Friends off removes the friends, the waiting requests and the invite link (blocks are kept).
• How requests work. A request is sent by exact username, by an invite link or QR code that you share, or from a button on a league, race or class list. The other person must accept. A friend request, an invite link and a study-buddy invite work only between accounts in the same age group: both aged 13 to 17, or both aged 18 or over. An account aged 18 or over cannot send a request to, or accept one from, an account under 18, and an account under 18 cannot do so with an adult. Friendships made before this rule began keep working as ordinary friendships and friend streaks, but never become study-buddy pairs. A request expires after 30 days. There is a limit of 100 friends and 20 waiting requests per account. You can stop receiving requests in Settings.
• Invite links. We do not store your invite link itself: the database holds only a keyed one-way hash of its code, and the link you see is worked out again when you open the invite page. If you are 18 or over, your link and QR code stay valid, and can be used again and again by anyone who has them, until you replace the link in Settings. If you are under 18, your link expires after 7 days and the invite page gives you a new one when you next open it. Anyone who opens a valid link, even without an account, sees your username (and your equipped Voo if you are an adult with a public profile). Opening the link sends you a request that you still have to accept. If you are in the other age group, no request is sent.
• Notifications. A new request and an accepted request create an in-app notification and, if push is on for a device, a push notification that names the other person's username and nothing else. There is no separate switch for friend notifications: you can turn push off for the device or stop receiving requests. When an account is deleted, its username is replaced by "A former user" in the friend notifications other people received.
• What a friend sees. Your username, your equipped Voo (our mascot, shown as your profile picture), your league score for the week, your study streak, when you last studied (shown as Today, Yesterday or a number of days, never a time), your published decks and your game records, and, on a full profile, your league tier, all-time points, longest streak, cards mastered, badges, the days you studied in the last eight weeks and the date you joined, as far as your profile visibility allows. Other people see less: on a friends-only, private or blocked view they see a plain default Voo and your username. A friend never sees your email, birthdate, plan, country or anything from your classes.
• Friend streaks. If you and a friend both study on the same day, Cardvoo counts it toward one streak you share. We keep the number of days in a row, the date it last grew, and for each of you whether you have studied today. Your friend can see that count and whether you have studied today, and nothing else beyond what this section already lets a friend see. There is no chat. Friend streaks exist only between two friends, so they do not exist for accounts under 13, and for an account whose Friends feature is managed by a parent they exist only while the parent has Friends turned on. A streak ends when you remove the friend, block them, or either account is deleted. You and a friend can also agree to be study buddies. You invite a friend with your invite link or from the friend's profile; the invite is a friend request that the other person has to accept, like any other, and then each of you has to turn on "study buddies" yourself. Study buddies are only ever two accounts in the same age group: both aged 13 to 17, or both aged 18 or over. We keep one mark for each of you on the shared streak record, with the day of the last nudge each of you sent and of the last "your buddy studied" notice, and you can turn yours off at any time. While both of you have it on, you each get an in-app notice when the other has studied and you can each send the other at most one nudge push notification a day, and only until your buddy has studied that day. That is all that is added: there is still no chat and no message you can write. Study buddies are for accounts aged 13 and over; they do not exist for accounts under 13, for accounts managed by a parent unless the parent has turned Friends on, or for accounts in a class, which have no friend streaks. A nudge about a friend streak or from a buddy counts toward your daily push limit (Section 5a) and is turned off by setting Reminders to Essentials only. The marks are deleted when the streak ends.
• Profile visibility. You choose public, friends only or private. A public profile is visible only to people who are signed in to Cardvoo, of any age except accounts under 13, which cannot open other people's profiles; it is not shown to search engines. A public profile of an account aged 13 to 17 shows only the username, the plain default Voo and study stats (streak and weekly score); it never shows a real name, a photo or a school. Leagues and other lists show your username, weekly score and streak to the other people in your league unless your profile is private. An account under 13 is never shown to an account aged 13 or over: its username, points and place appear on no league list, game leaderboard, Recall Race ranking or Cardvoo Live game that an account aged 13 or over can see. It has a private weekly league made only of other accounts under 13, and a game leaderboard or ranking that includes it includes only accounts under 13. Inside that league the other members see it as "a Cardvoo student" with a plain default Voo, no username and no link to a profile, ranked by its points; the person sees their own name.
• Adults and accounts under 18. An account aged 18 or over cannot send a friend request, an invite link or a study buddy invite to an account under 18, and the reverse. Cardvoo shows no age on any profile.
• Block and remove. You can remove a friend or block a person. Neither person is told. After a block, the blocked person sees "user not found" if they look for you. You can unblock in Settings.
• Classes stay separate. Your class name, class activity and class membership are never used to suggest a friend or shown on a profile. The one exception is the classmates list on a class page. It is off for every class until the class's teacher turns it on. While it is on, a student aged 13 or over can see the other classmates aged 13 or over, each with an Add friend button. Accounts under 13 are never listed. Each row shows the classmate's class name (first name and last initial, as their teacher set it up), and the same plain default Voo as every other row (the list shows no outfit, no last-studied day and no age); a classmate whose profile is private, and, for an adult viewer, a classmate under 18 who is not their friend, shows as "Private player". An equipped Voo shows only when you open a profile. A classmate can open another classmate's profile, which shows the username, except where the profile shows as "Private player". The teacher can turn the list on or off for the class at any time and is not told about friend requests. A new class starts with the list off. A class that existed before the list became off by default keeps the setting it had until its teacher chooses, and each such teacher is shown one notice about it. The class leaderboard (Section 4q) and the Add friend button of the list work only while the list is on.
• Add friend on the classmates list. The Add friend button works only for a classmate in your own age group: both aged 13 to 17, or both aged 18 or over.
• Retention and deletion. We keep friendships until you remove them or your account is deleted, and blocks until you remove them or either account is deleted. A friend request that is no longer waiting (accepted, declined or expired) is deleted 30 days after it was settled; a request its sender cancels is deleted at once, and a block deletes every request between the two. A declined request is kept for those 30 days so the sender cannot immediately send it again, and the sender is not told. The emailed parent link for Friends, and a parental-consent link that was never confirmed, are deleted 7 days after they expire. When your account is deleted, your friendships, friend streaks, requests, blocks and invite link are removed along with it (other people's accounts are not touched), when the account is purged as described in Section 10. Your own friends list, friend streaks, requests, blocks and invite-link dates are included in your data export; other people's profile data is not.

4e. Public tutors

A custom tutor is a Voo tutor that someone builds from a name, a purpose and teaching settings. Some tutors can be made public:

• What is shown. If an account aged 13 or over publishes a tutor (accounts under 13 and parent-managed accounts cannot), other signed-in users aged 13 and over can see its name, description, subject, the owner's username and how many people added it. Anyone who has a tutor's link, signed in or not, can open a preview page with the same details. We never show the tutor's instructions or the owner's name, email, decks or notes.
• Review. Every public tutor is checked automatically before it appears and again after it is edited, and anyone who can see it can report it. A tutor with three reports is hidden until we review it. The owner can unpublish at any time. When you report a tutor we keep your account, the reason you chose and any details you typed (up to 500 characters) for our reviewers; the owner is never told who reported. We keep reports for one year after they were filed and then delete them. If the reporter's account is deleted, the reporter's account ID in the report is replaced by a keyed hash. The reports you filed are part of your data export; reports about you are not. Our reviewers can see a tutor's full instructions and the owner's username when they review it. A tutor that our automatic check cannot settle is reviewed by an administrator, who also sees how long the owner's account has existed (in bands, never the exact join date) and how many of that owner's tutors we have rejected before (counted from October 2026). An administrator can approve a tutor, reject it with a reason that the owner sees, take a live tutor down, or turn off an owner's ability to publish tutors until we lift it, with a reason that the owner sees. These actions are recorded in our admin audit log.
• Adding a copy. If you add a tutor you get your own copy in your account. It is stored with your account, included in your data export and deleted when you delete your account. Your copy does not follow later edits and does not include the owner's notes or decks. If we take a tutor down for breaking our rules, we normally also turn off the copies other people made (we can choose not to); a copy that is turned off cannot be turned back on, but the person who added it still sees it and can delete it. If the owner deletes their account, copies other people already added stay with them and keep the owner's username as a credit.
• Trying a tutor and using a copy. Trying a tutor is one message (up to 500 characters) that is not saved to your chat history; it is sent to our AI provider to answer, and we keep only a marker that you tried that tutor (it is part of your data export and is deleted with your account). A copy or a trial runs on your own device (Free) or your own AI allowance (paid plans), not on the owner's. Chats with a tutor are handled as described in Section 4b, and the safety checks that apply to every AI chat apply here.
• Who can see them. Public tutors are not shown to accounts under 13, to accounts whose Friends feature is managed by a parent, or in class-only accounts. Accounts aged 13 and over see them.
• Links. A tutor's link opens a short preview page and does not appear in the previews that messaging apps build.

4f. Cram runs

• A Cram run keeps the cards it used (their wording as it was when the run started), how you did on each, any "My answer was correct" marks and the run summary. For a wrong typed answer it also keeps what you typed, at most 200 characters, so the summary can show it. A multiple-choice miss keeps no typed text.
• A run can be resumed for 24 hours after your last answer, and the app lists your last five runs. Older runs are not shown but are kept with your account.
• Only you can see Cram runs: teachers and friends never see them. They are included in your data export.

4a. Prompt Decks: what we keep and why

When you describe a deck to Cardvoo ("Make me a deck about…"), we turn your request into a brief and an outline, write the cards, and, for Standard and Pro, and for the few web-checked tries on Free, check the cards we are least sure of against free public reference sources. On Free, if your device cannot make the deck, you can allow us to make it in the cloud (Section 6); this cloud backup is not available to accounts under 13 or parent-managed accounts, and it needs a verified email. For the first deck you describe on a Free account, if you are 13 or over, your account is not managed by a parent, is not in a class and is not a teacher account, and you have given our one-time cloud permission, we choose the cloud and the web check for you by default so that you get a checked deck quickly, using one of your source-checked tries. You give the permission by choosing it on a screen where nothing is pre-ticked, and you can withdraw it at any time in Settings. We pick a level (College), a goal (Keeping up) and a size (about 15 cards) and say so on the review screen, where you can change them and make the deck again, and you can switch the cloud and the web check off before the deck is made and use your device instead. What is sent is described in Section 6; the text you typed is kept for 30 days as described below. Accounts under 13 make Prompt Decks on their device only. Here is what that means for your data:

• Your prompt: the raw text you typed is kept for 30 days (so a draft can be resumed and so we can review abuse reports), then deleted automatically. It is visible only to you and, during those 30 days, to Cardvoo administrators reviewing abuse. If a request is declined by our safety screen, we log that it happened without the prompt text; the prompt itself follows the same 30-day rule. A deck made by the Free cloud fallback is different: the text is deleted right after the run and we keep only counts, ids and cost.
• Your brief, outline and sources stay with your deck for as long as the deck exists, because they are needed to regenerate sections and to show where a card came from. They are deleted with the deck or your account.
• Unsaved drafts are kept for 14 days and then deleted.
• Grounding sources: to check a card we send a short search query built from the card's wording (never your name, email or account details) to Wikipedia and, for some subjects, PubMed or Crossref. Cards we can confirm carry a source chip and the deck lists its sources with their licenses. Wikipedia text is licensed CC BY-SA; we paraphrase and credit it, and the credit travels with the deck when you export or publish it. Cards we cannot confirm are kept and marked "Unverified". That means we found no source, not that the card is wrong.
• AI-generated: cards from a prompt are written by AI and can contain mistakes. They are labeled "AI-generated from a prompt" when you publish them, and Free on-device decks and Free cloud-fallback decks carry a "check the facts" note. Please verify anything important.
• Prompt-deck runs are included in a full account data export and removed when your account is deleted. New decks are private until you choose to publish them, and the usual public deck safety screen runs before anything goes public.

4h. Leaderboard cohorts

The weekly league groups real Cardvoo accounts only: there are no bots and no made-up players. When you first earn points in a week you are placed in an open group of up to 30 people in the lowest league, and the Monday sweep is the only time anyone moves up or down. If a group is still small you see a waiting state and a prompt to invite a friend. We keep your group, your weekly score and your league tier. Other members see what Section 4d already says league lists show (username, weekly score and streak, unless you hid it). An account under 13 is placed only in a private group made of other accounts under 13, never in a group with an account aged 13 or over, and its group members see each other only as "a Cardvoo student", with no username, link or profile. There are few accounts under 13, so such a group can be smaller than 30 and can stay in the waiting state. Points earned in a class, and any account under 18 that is in a class, never enter a group.

You can leave leagues in Settings. We then remove you from your current group at once, do not place you in a new one, and send no league notifications; your points and streak still count for you. You can rejoin from the next week.

4i. Reporting a question

If a quiz or game question looks wrong or unsuitable you can choose "Report this question". You can report a question only from a card you are able to study. We store the question's ID, the reason you chose and your account ID, so we can review the question and fix or remove it if it is wrong. Our reviewers see the card's text only when the card is in a public deck; they never see the card text of a private deck, and they never see who reported it. We delete a report 90 days after it is made. A report does not copy your answers or your other study data, and it is included in your data export.

4j. Deck details, diagrams and podcasts

• Deck details. When you create a deck, Cardvoo suggests a title, category, course, subject, level, language and tags. On the Free plan the suggestion is made on your device. On Standard and Pro, if your deck's text was already being sent to our cloud AI to make the deck (for example a deck you described, or a cloud import), we may send a short sample of that same text, at most 1,500 characters, to our AI provider to make the suggestion; text that stayed on your device (for example a pasted table) is never sent for this. No account, class or student information is in the request. Class accounts never use the cloud for this, and accounts under 13 never use it. You can change or ignore every suggestion.
• Diagrams. You can make a diagram (a flowchart, cycle, hierarchy, pyramid, Venn diagram, 2x2 grid, chart or labeled image) for a deck. On the Free plan a first draft is made on your device or starts from a template. On Standard and Pro you can ask our AI provider for a draft: we send the diagram's topic and the text of the cards you picked for it. The cloud draft follows the same age rules as AI chat (Section 4b). A labeled image can carry a picture you upload (PNG, JPEG or WebP, up to 2 MB); it counts toward your upload storage, and like card images it is stored under a long, unguessable address, so anyone who has that address can view the picture. Your diagrams are your content: they are private to you, included in your data export, and deleted (with their pictures) when you delete the diagram, its deck or your account.
• Shared podcast episodes. A podcast episode depends only on the deck title, the cards it uses, and the format, length, language, voices and script settings, not on who asked. If someone has already made an episode from exactly the same content and settings, and it has not expired, we give you your own copy of that episode's script and audio instead of making it again; it still counts against your podcast minutes. Nothing about the person who made the first episode, or about you, is shared: the copy carries no account, answers or scores, only the script and audio made from the same deck content. Your copy is yours: it expires 90 days after it is made, is deleted with your account, and its details and script are in your data export (not the audio file, and not the internal note of which episode it was copied from).

4k. Party packs

The Party page offers official party packs: ready-made sets of terms for Taboo, Recall Race, Cardvoo Live and Charades. The definitions in a pack are written once by our administrators with our AI provider, from the pack's own terms; no player's data is used. Games from a pack earn no XP, streak days or league points and use the same records as the same game played from a deck. A pack you open is saved on your device so it can be played offline; only the pack's public game content is saved, and you can clear it with your browser's site data.

4l. Feedback you send us

We ask for feedback to learn what to fix and what to add. We ask a question with one tap and an optional note at most once every 30 days: after you finish a test, when you reach a daily limit on the Free plan, and after your fifth study session. Teachers are asked after a first graded assignment and after their fifth session in the Teacher Hub. We never show it to accounts under 13 or to accounts managed by a parent, and never to a student while they use a class.

We keep each answer with your account ID so that we can write back to you if you ask us to and so that we can see how a plan or a limit looks to the people who use it. Our owner reads it in the Admin area, and each answer is also emailed to our support inbox at [email protected]; the email carries your answer, your note, the moment it was asked and your plan, and does not carry your name or email address. We keep feedback for 12 months and then delete it, or sooner if you delete your account. We do not sell it, we do not share it with an advertiser, we do not use it to choose which ad you see or to decide whether to offer you a discount, and we do not use it to train any AI model.

On the daily-limit question, the answer you choose may also be counted. We count, across all accounts and without any account ID, how many people tapped a plan message and how many of them had a paid plan within 7 days. You can tap Don't ask again on any prompt to stop the prompts, and the Send feedback row in Settings will still work. If you are a teacher, please do not put student names or information in a note.

4m. Trying Cardvoo as a guest

You can try Cardvoo on one deck without making an account if you are 13 or over. The first screen asks for your birthdate. We read it in your browser only; it is not sent to us, not stored and not logged. If it shows you are under 13, we do not open a guest session and we send you to sign-up with a parent's consent (Section 9). For the rest of that browser session we remember only that the answer was "under 13", and not the date, so that the same browser does not simply try another date. The marker is kept only for that browser session, so a new window starts the age screen again.

A guest can review flashcards from one official starter deck, or from a public deck whose link someone shared. A guest has no AI, no games, no Friends, no ads, no notifications and no emails. We do not use a cookie, an account or an analytics ID for a guest. Your browser may keep a random device ID, which it creates no later than when you sign up or sign in, and send it with its requests; the pages a guest loads do not use it and we do not store it for a guest. Loading the deck works like opening any public page: our servers and Cloudflare see your IP address, and the request appears in our short-lived rate-limit counters and standard request logs (Section 1, device and technical data; Section 4s). If you opened the guest session from a shared link, the link holds only the deck's ID: it does not say who shared it and we do not record who opened it.

What you do as a guest (which cards you saw and how you rated them) is kept only in your browser's storage on your device. It is not sent to us. The app deletes it 14 days after you last used the guest session, and clearing your browser's site data deletes it sooner. If you sign up, the app sends that progress to us once, with your sign-up, and we add it to a copy of the starter deck in your new account, but only if the birthdate you give when you sign up shows you are 13 or over and the account is not set up with a parent. If you are under 13 or sign-up does not finish, the progress is not sent and stays only on your device until it expires. Nothing from a guest session is used for ads, offers or advertising profiles. We do not ask a guest for any personal information, and we use nothing a guest does for anything except showing the deck.

4n. Getting started and weekly messages

After you sign up. If you sign up and have not made a deck yet, we may send you one push notification about three hours later, if you have turned on notifications on that device, and, if you are 13 or over, one email the next morning. Each says what Cardvoo is for and how to make your first deck in about a minute. We send each of them once in the life of an account. We send the email only to accounts aged 13 and over whose country setting is the United States and whose email address is verified, only after we have a street or PO box postal address on file for Cardvoo's mail, and every email says who we are and why we are writing, shows that address and has an unsubscribe link that works at once and also stops win-back and weekly recap email. We never send either to an account under 13, to an account managed by a parent, to a student who is in a class, or to a teacher.

The push follows the limits and quiet hours in Section 5a and counts toward them. The timing is fixed. We do not use the study-activity estimate (Section 5b) to decide whether or when to send it, we put no offer or discount in it, and we do not use it for advertising. Setting Reminders to Essentials only stops it. We keep a record that we sent it for as long as the account exists, so that it is not sent twice.

Weekly recap. Once a week the app can show you a recap card: how many cards you reviewed, on how many days you studied, your streak and the deck you studied most. We work it out from your own study records at the moment you open the app and we do not store it. The sentence from Voo on the card is picked from a fixed list; no AI writes it and nothing is sent to anyone to make it. If you are 13 or over, your country setting is the United States, your email address is verified, you have studied within the last 14 days, and we have a street or PO box postal address on file for Cardvoo's mail, we may also email you the same recap, at most once a week. Every recap email says who we are and why we are writing, shows that address, and has an unsubscribe link that works at once and also stops win-back email. We never show or send a recap to an account under 13, to an account managed by a parent, to a student who is in a class or to a teacher. A recap carries no offer and no advertising, is not chosen or timed from the study-activity estimate (Section 5b), and the recap email (not the card) is turned off by setting Reminders to Essentials only. We keep a log of the recap emails we sent you for 12 months.

4o. Explore: saves, "worked for me" and remixes

• Save counts. A public deck shows how many people saved it. The count is made from a nightly tally; it holds no names and no account IDs.
• "Worked for me." If you are 13 or over, not a student in a class, not managed by a parent, and have studied at least 20 cards of a public deck, you can tap once to say it worked for you. We store the deck, your account ID and the time, so that you cannot mark a deck twice and so that you can remove your mark. The deck shows "N people said it worked" only when N is 5 or more. The deck's owner sees counts only, never who. We delete your marks when you remove them or delete your account, and the count is corrected overnight.
• For you and "For your course." To suggest decks, our servers use the courses and categories you entered, such as your course name, and the decks you study. This is done on our servers; none of your content is sent to an AI model. We do not use it for ads or offers, we do not keep a separate profile, and it is not shown to accounts under 13, accounts managed by a parent or accounts in a class.
• Remixes. If you are 13 or over and your account is not managed by a parent, you can use Explore to save a public deck and change your copy for your own study. Only accounts aged 13 or over that are not students in a class can publish the changed deck; students in a class cannot. A published remix shows "Remixed from" and the original owner's username; if the original's owner is under 18 it shows "a Cardvoo student" instead, never a username. A remix you publish is credited the same way: if you are under 18, its credit reads "a Cardvoo student". We store the link to the original with the remix. Before it goes public, a remix is checked like any public deck: our safety pre-screen and our AI moderation provider read its title and card text (Section 6). A remix is an independent deck. If the original is unpublished or removed, the remix stays. If the original's owner deletes their account, the credit on the remix becomes "A former user" and the link is removed.
• Reports. Anyone signed in can report a public deck. We keep the deck, the reason, any details you typed (up to 500 characters) and your account ID for one year after the report is filed, and then delete it; if your account is deleted, your account ID in the report is replaced by a keyed hash. The owner is never told who reported. Our reviewers see the deck's text and the owner's username to decide. Reports you filed are part of your data export; reports about you are not.
• What the owner sees. The owner of a public deck sees how many people saved it, said it worked and remixed it. They never see who.

4p. Your daily plan on Home

Home can show a daily plan from Voo: a few steps from your own study records, such as cards that are due, decks you find hard and exams you entered, fitted to the time you choose (5, 10 or 20 minutes). We work the plan out on our servers when you open Home, from your own records only, and we do not store it. We remember the time you chose with your account so the plan fits it next time. The line Voo says and the way Voo looks come from a fixed list of rules; no AI writes them and nothing is sent to anyone else to make them. The plan, Voo's lines and the cards on Home show no ads and are not used to advertise to you, to choose an offer or to decide anything about your account. Messages about a paid plan, win-back messages and reminders keep the rules in Sections 2, 5a and 5b. The progress tab shows your own league, goal, streak and hours saved, which are described in Sections 4h and 5.

4q. Class leaderboard

If your teacher turns it on, your class page can show a leaderboard of the students in your class. It ranks the points you earn from work done inside the class (assignments and class games) in the current week. It shows the top 5 students and your own rank, each by class name (first name and last initial, as your teacher set it up), with weekly points; it shows no profile, no outfit, no email and no way to send a friend request. Only your teacher and the other students in your class can see it, and only while your teacher has the Classmates list switched on for the class (it is off until the teacher turns it on). It is not public, it never counts toward a league (Section 4h), it is not in the Leaderboards hub, and no push notification, email or message is sent about it. You can switch yourself off the list with one switch on the class page; then you are not listed and others do not see your rank, and you still see your own points. We keep no tally: the board is worked out from the grades and class game results your teacher already sees whenever the class page is opened. We keep only your switch, and delete it when you leave the class and when the class is closed or deleted. No ads are shown to a member of a class, on any page. The school or teacher decides whether to use the leaderboard, and Cardvoo handles it as the school's service provider under the Cardvoo Data Privacy Agreement.

Class Live games. If your teacher turns it on for a class Live game, and the Classmates list is on for your class, your phone can show, after each question, the top five students of that game (with ties, at most eight rows) and your own place. Each row shows the class name (first name and last initial, as your teacher set it up) and, unless your teacher chose ranks only, the points of that game. Every student in the class who is 13 or older can be shown, including students aged 13 to 17, and every classmate sees the same class names. A student who has switched themselves off the list is not shown to other students and still sees their own place. The board is worked out while the game runs and is not saved. It is shown only to the students in that game, and never outside the class, in a league, in an ad or in a message. The answers and scores of the game are kept with the class, as Section 4t says.

4r. Deck colors, icons and cover photos

Every deck has a color and an icon, chosen automatically from its subject and changeable by you from a fixed set. We store your choice with the deck. On Standard and Pro, if you are 13 or over, not in a class and not a teacher, you can add a cover photo from Unsplash. We store which photo you chose, its address and the photographer's name and Unsplash profile address with the deck; we do not copy the picture, and it loads from Unsplash's servers (Section 6). The photographer is credited wherever the cover appears on the deck's page. A cover is shown only to signed-in accounts aged 13 and over that are not in a class and are not teacher accounts; everyone else sees the deck's color and icon. The public page of a deck shows its color and icon and never its cover, so a cover appears on the deck's page in its owner's library. Someone who saves or remixes a public deck gets its color and icon and not its cover. If your paid plan ends, we hide the cover and keep your choice. Your deck art is deleted with the deck or your account.

4s. Public pages, articles and visitors

Anyone can read our public pages without an account: the home page, features, pricing, study guides, our changelog, Explore and public deck pages and, once they are published, our articles, subject pages, glossaries, and the About and Contact pages. This section says what happens when you read them, signed in or not.

What we count. We keep only our own counts of how the service is used (Section 5). No third-party analytics script runs on cardvoo.com today, on our public pages or in the app. If we ever add one, we will change this policy first and ask you to accept the change.

What we do not do. We do not set a cookie when you only read public pages. We use no analytics company's tracking code on them. Today these pages load no advertising script and set no advertising cookie. Nothing on them asks for your name or email, and the only place that asks for a birthdate is the guest age screen, which is read in your browser and not sent to us (Section 4m), so we do not ask anyone under 13 for personal information through them. If you sign in, a session cookie is set so that you stay signed in.

Ordinary web records. Like any website, our servers and Cloudflare see your IP address and browser details when you load a page, and our servers keep short-lived counters to limit abuse (Section 1, "Device/technical data").

Search engines and AI crawlers. Public pages can be found by search engines and read by automated programs, including those of AI companies. Our robots.txt file allows these crawlers on public deck pages, including the pages of public decks that people make. A creator can make a deck private at any time (Section 7), which stops us serving it, though a copy that another service already made may last longer.
Today a search engine may list the page of a public deck that has 8 or more cards, and we ask search engines not to list a public deck page with fewer cards (a "noindex" request); that request does not stop an automated program from reading a page, and we cannot control copies that others have already made. The page of a public deck shows its first 5 cards and, for an adult creator, the creator's username; for a creator under 18 it shows "a Cardvoo student".

Articles. Our articles, subject pages and glossaries are drafted with an AI model from facts, opinions and examples that Bleart Emini supplies, and he edits and checks them, as the About page explains. We do not use anything that people put into Cardvoo to write them.

Mistakes and removal. To report a mistake, a page that should not be public or a copyright problem, write to [email protected] or use the Report button on a deck (see also our Copyright / DMCA Policy).

4t. Teacher tools

These tools are for teachers. A student never uses them and never sees what a teacher types into them. Students are 13 or older in every class (Section 4c). Teachers and Educator subscribers never see ads.

Unit planner. If a teacher uses the unit planner, we keep the unit the teacher builds (the topic, grade level, days, the teacher's goals, the standards codes the teacher picked and the outline Voo wrote) with the teacher's account, until the teacher deletes it or the account is deleted. To write it, we send the teacher's description, goals, codes and any of the teacher's own materials that the teacher includes to our AI provider (Section 6), never a student's name or email and never a roster. The reference list of standards codes that the planner uses holds only the state or framework, the short code, the grade, an identifier and a web address. It holds no personal data and no text of any standard, and it can be empty or incomplete (Terms Section 9a). If a teacher types a student's name into the planner, it is sent along, so the planner warns the teacher before sending when its text contains the name of a student in the teacher's class. A warning cannot catch every name: please do not type a student's name.

Groups. If a teacher puts students in groups, the class keeps the group's label and the list of students in it. Only the teacher and the staff the teacher allows can see them. No student sees a group or a label, a group is not in a student's own data export, and it is never sent to our AI provider or used to train any model, to profile a student or to choose an ad or an offer. Cardvoo does not use a group's label for anything except which material the teacher assigned, and does not record or infer any characteristic of a student from it. The app refuses a group name that contains a word from a list of words that describe a disability or a language status, and a list cannot catch every name. A group is deleted when the teacher deletes it and when the class is deleted or, 12 months after the class is closed, anonymized. A student is taken out of every group when they leave the class, are removed or delete their account. A group stays with the class if the teacher's account is deleted: each open class is transferred to another teacher or closed with the account (Section 10). The school decides how it is used and is responsible for it; Cardvoo handles it as the school's service provider under the Cardvoo Data Privacy Agreement.

AI feedback on written answers. If a teacher turns on AI feedback for an assignment, we send the question, the teacher's answer key and rubric, a source passage and the student's written answer to our AI provider (Section 6) to draft a verdict and a comment. We never send the student's name or email, and the request asks the provider to use only hosts that state they do not keep or train on it. Before we send it, we remove email addresses, phone numbers and the student's own class name from the answer where we can detect them. We cannot detect everything, so other personal details that a student types can stay in it. A teacher confirms, when turning on AI feedback, that "This assignment does not ask students for personal information.", and should not use AI feedback on a question that does. The draft is shown to the teacher only. The student sees feedback only after the teacher approves it, labeled as drafted by AI and approved by the teacher (or, if the teacher changed it, as edited by the teacher). A draft the teacher does not approve is deleted after 30 days, and a rejected draft is deleted at once. Approved feedback is kept with the student's work in the class and is deleted when the class is deleted or, 12 months after a class is closed, when it is anonymized. If a teacher turns AI feedback off for an assignment, students stop seeing it for that assignment, and drafts that were not approved stay hidden until they are deleted. It never runs for an account under 13. The school decides how it is used and is responsible for it; Cardvoo handles it as the school's service provider under the Cardvoo Data Privacy Agreement.

Reteach from an insight. A teacher can start a practice deck or study guide for weak topics with one tap from the class insights. We work out the weak topics and the students under our weak-topic rule from the class's own results when the teacher opens the page; we do not save that suggestion as a label on any student. The AI provider receives the topic names and the class's card or guide text only, never a student's name, email, answers or scores. The teacher reviews the draft and sends it; nothing is created for a student before that. A practice set sent this way is kept for 12 months and is handled as described in Section 4c.

Class Live games. In a class Live game we keep, with the class, each question's text, the options shown, the correct answer, the answers each student chose and how long each took, so that your teacher can see which questions were missed and which students may need a look. Your teacher sees students by class name in the app only, never in an email or an export. These records are deleted or anonymized when the class is deleted or anonymized (Section 10), and your own answers are in your own data export. While a class Live game runs we keep a short event log of when students connected, were removed or reconnected and when the game was paused or ended, for 30 days, to run the game and fix problems; it contains no answers and is deleted or anonymized with the class.

Colleague vouches. If an approved teacher vouches for a colleague, we use the colleague's email address once to send one email with a link, and keep a one-way hash of it, both account IDs, the school domain, the dates and the result for 12 months after the vouch is decided; they are deleted earlier with either account. We do not use the address for anything else.

AI drafts for teachers. When a teacher uses an AI drafting tool (Explain cards, Why students missed it, Improve this question, Retake versions, the Comment bank, Mixed-up pairs, Prerequisites, the Monday warm-up, the Exit ticket, Vocabulary, the AI wording of a Meeting prep sheet and a tutor drafted for a Support plan), we send the question or card text, the answer key or rubric, counts, topic names and the teacher's own source text to our AI provider (Section 6), never a student's name, email, answers or scores, and we tell the provider to use only the United States hosts named on our subprocessors page and not to keep or train on the data beyond what each host's own terms say. Drafts the teacher does not approve are deleted after 30 days.

Scheduled posts and time zone. For a teacher we keep a time zone for the account and for each class, and the date and time chosen for each scheduled post, so that posts, reminders and the Friday draft arrive at the hours the teacher chose. They are kept with the account or class and are deleted with it. The time zone is a setting, not a record of where anyone is.

Free AI allowance for teachers. To give an approved teacher the free allowance we keep the teacher's usage of it (the account ID, which tool, an internal amount and the time) with the teacher's other usage records, and we use the one-way hash of the teacher's verified school email, which we already keep for the application (Section 1), to give one allowance per school email. We use this only to run the allowance and keep it fair. We do not use it for ads or to choose an offer. The records are deleted with the teacher's account; the per-call AI logs follow Section 5 (90 days).

Substitute plans. If a teacher makes a substitute plan, we keep the plan page the teacher built, a keyed hash of its private link, the dates it works and how many times it was opened and when it was last opened. The page shows no student name, roster, grade or class code; it can show the plan's title and the name of the class. We do not store the visitor's address or any name for the person who opens it, and we do not email the link. To limit abuse, the request that opens the page is counted against a rate limit that keeps a one-way hash of the visitor's network address for a short time, and nothing else about the visitor. The link stops working at the end of the last date the teacher chose (never more than 7 days after it was made) or when the teacher revokes it, and the record is deleted 30 days later, or sooner with the class or the teacher's account. Anyone who has the link can open it while it works.

Printables. If a teacher prints a class-code poster, exit-ticket sheets or answer keys, we build the file from the teacher's own unit content and the class name and class code, keep it in private storage for 7 days, and then delete it. The file holds no student name or grade (a Meeting prep sheet is different: see below).

Meeting prep sheet. A teacher can make a one-page sheet about one student, or one for each student of a class, for a conference. We build it from the class's own results, keep the file in private storage for 7 days and then delete it, and send it to no one. If the teacher chooses AI wording, the AI provider receives counts and topic names only, never a student's name.

Weekly summary. Once a week we may email a teacher a summary of their classes: totals only, such as how many students need a look, the main weak topics, the status of the warm-up, exit ticket and Quick check, reteach receipts and an estimate of time saved, with no student's name and links back to the app. We send it only to an approved teacher whose email address is verified, to the address the teacher chose for the daily class digest (the account email if none), with an unsubscribe link, and a setting in Settings turns it off. We keep the summary's totals for 12 months and delete them with the account.

Time saved. Time saved is an estimate shown only to you; it is made from counts of what you did in Cardvoo and is never shown to anyone else.

Shared units. If a teacher shares a unit to the Educator tab of Explore, we show its title, course label, summary, standards codes, lessons, the titles of its materials, its exit tickets and the teacher's username to other approved teachers who are signed in, and not to students, to the public or to search engines. A shared unit never includes the class, a roster, student names or results. Before it appears, our safety pre-screen reads the unit's own text (Section 6). If another teacher adds a copy, the copy (which carries the unit's title and lessons) is stored with that teacher's account and credits the sharer's username. A teacher can report a shared unit: the report is kept like a report about a deck (Section 7), and a unit with three waiting reports is hidden until a reviewer decides. If the sharer deletes their account, the unit comes down, copies others made stay with them, and the credit changes to "A former Cardvoo teacher".

Visual templates. The template you submit, its title, caption and data, your account, and our review decision are kept while the account exists. A template we approved stays available after the account is deleted, without your name.

5. Internal-operations analytics

Cardvoo keeps a few kinds of first-party operational records, in our own database, used only to run and improve the service, and never sold or shared with a third-party analytics vendor:

• Daily activity records: whether your account visited or studied on a given day.
• Per-call AI usage logs: which task ran, which model handled it, token counts, the cost the AI provider reported, latency, and whether it succeeded, kept for 90 days.
• Study-session logs: which study mode you used, when a session started and ended, and how many items you studied.
• Active study time: while you study, the app counts the seconds you are actually active (a heartbeat that stops counting after 60 seconds without activity or when the tab is in the background). Time you spend on passive study, such as listening to a podcast, Live or reading, is counted separately. We use the totals to understand how long people study, fix features that do not hold attention, and pace reminders. The totals are shown only to you, in your own profile; they are never shown on a public profile or to a friend. We keep the raw activity events for 90 days and daily totals for 90 days, then delete them.
• Reminder delivery and opens: which reminders we sent, and the time your device reported that you tapped one (Section 5a).
• First-review time (accounts aged 13 and over that are not class accounts): when you signed up and when you did your first review, kept for 90 days and used only in totals.
• Stickiness reports: counts, built from our own database, of how many accounts come back (day-1, day-7 and day-30 return, daily and monthly actives, retention groups, how many people study after opening a reminder, the hours of day people study, and the spread of streak lengths). These reports are produced inside our own systems, are never sent to a third-party analytics provider, and no individual's data leaves our systems.
• Sign-up and first-use counts: when you look at our home page or sign-up page, our code may add one to an anonymous daily count of how many people viewed the page, started signing up, stopped before finishing, or saw a sign-up error and which kind (a fixed list such as "email already in use"). These counts are stored with no cookie, no ID, no IP address, no browser details and nothing you typed, and they cannot be tied to you or your device; as for any request, our servers see your IP address while the request is handled (Section 1). Once a birthdate under 13 is typed on the sign-up form, none of these counts is made for that visit (Cloudflare's page-visit count in Section 4s still applies to every page). After you sign up, if you are 13 or over and are not in a class and not managed by a parent, we keep one record of how you first started (a starter deck, describing a deck, importing, or a blank deck), whether a starter card was shown and which subject you picked, and when, for 90 days, and use it only in totals to see which first steps work. We never record it for accounts under 13, accounts managed by a parent or students in a class. We also keep anonymous daily counts, with no ID, of whether the welcome tour was finished or skipped and whether an on-device AI model download started, was stopped, finished and about how long it took. We do not use any of this for advertising and we do not give it to any other company.
• Reports for running Cardvoo: summary reports built from our own database, such as how many accounts are active each day and month, how many come back, how many reach their first review or upgrade, the spread of study-activity estimates, whether reminders and messages help, how often people turn reminders down or unsubscribe, and revenue. They are counts and averages, never lists of people. A group of fewer than 20 people is never shown on its own to anyone except Cardvoo's owner, who can ask to see the exact count of a small group; even then the report shows only the number, never who is in the group or any one person's data. Only Cardvoo's administrators see these reports, and they are not sent to any analytics company. Accounts under 13 and class accounts are left out, except from one overall count of active accounts. We keep the summary tables for 24 months.

For accounts belonging to a user under 13, this relies on COPPA's internal operations exception, which lets us collect a persistent identifier without full parental consent when it is used only to maintain or analyze the functioning of the service. For a child's account we keep only a per-account total of active study time over the last 90 days (older time drops off after 90 days), used for these internal operations (for example, to check that a feature works for the age group that uses it). We do not build a day-by-day history, a profile or a reminder personalization from this total, the separate estimate in Section 5b does not use it, and we never use it to contact the child or to send a win-back message. Accounts that belong to a class get no active-time record at all. We name these operations explicitly because that exception requires it.

Separately, free-tier browsers send us anonymous, aggregated on-device AI health counters once a day: counts of which device tier was detected, whether the WebGPU or CPU engine was used, and how often model downloads/generation succeeded or failed. These counts carry no user ID or other identifier, and we don't store anything that could tie them back to your account.

Error reports. When the app or our servers hit an error, a report is sent to our error-monitoring service (Sentry). A report holds the error, the page or screen it happened on, the app version, your device and browser type, and your approximate location (city level) taken from your IP address. Before a report leaves, we remove addresses that carry a secret (a sign-in, reset, consent, unsubscribe or invitation link) and the secret parts of the address. We do not put your name, email address, birthdate or class in a report.

Account details in reports (accounts aged 13 and over). For accounts aged 13 and over that are not in a class, a report also carries a few labels (your plan, whether you are a student or a teacher, your age group (teen or adult), and which part of the app you were in) and a one-way code made from your account ID. The code lets us see that several errors happened to the same account without knowing who it is. For accounts under 13 and for members of a class, a report carries the labels only, never the code.

Short recordings around an error (adults only). For adults (18 and over) who are not in a class, we may keep a short recording of the screen from up to about two minutes before an error. Everything you type and everything shown on a card, note, deck or answer is hidden in the recording, and we keep a small number a month. Accounts under 18 and class members are never recorded.

We use no third-party analytics SDK or analytics script, in the app or on our public pages: the only counts we keep are our own, described in this Section. If we ever add one, we will change this policy first and ask you to accept the change. Our analytics alerts to Sentry carry only aggregate numbers, never user IDs.

5a. Reminders and push notifications

If you turn on push notifications we may remind you to study. We limit how many we send, and we count what we send so we stay inside the limits:

• Under 13: at most 1 a day and 4 a week; quiet hours 9 pm to 7 am (your local time); study reminders only.
• 13 and over: at most 2 a day and 10 a week; quiet hours 10 pm to 8 am.
• 13 and over who study most days and open our reminders: at most 3 a day and 14 a week; quiet hours 10 pm to 8 am.
• Anyone who has ignored 5 reminders in a row: at most 1 a day and 3 a week, with the quiet hours for their age.

Getting-started messages and quick-resume notifications (Sections 4n and 5a) count toward these limits and follow the same quiet hours. A weekly recap email (Section 4n) follows the quiet hours for an adult, but it is an email and not a push notification, so it does not count toward these limits.

There is at least 2 hours between notifications, and if two reminders would arrive together we send one. Messages that are about something you asked for or started are not counted against the study-reminder limits but still follow quiet hours: game invitations, class due dates and account notices. You choose a Reminders setting in Settings, Notifications: Normal, Fewer or Essentials only. Your choice overrides everything above, and Essentials only turns off study nudges, friend-streak nudges and win-back messages.

Picking up where you left off. If you studied earlier today and still have cards due, we may send you one push notification the same day to pick it up, between 45 minutes and 8 hours after you studied. It counts toward the limits above, follows the quiet hours for your age, is at most one a day, is not sent to accounts under 13, accounts managed by a parent, students in a class or teachers, and is turned off by setting Reminders to Essentials only. It uses only today's study records and whether you still have cards due. It does not use the study-activity estimate, and it carries no offer or advertising.

To avoid sending you reminders you ignore, we record the time your device reports that you tapped a notification. We use this only to set how many reminders to send you and to measure whether reminders help. We do not record whether an account under 13 opened a notification. Delivery and open records are kept for 30 days (delivery records for accounts under 13: 7 days).

Rest days and breaks. If you plan a rest day or a break, we send no study reminders, streak reminders or win-back messages on those days and do not count them as time away. Account, billing and class notices still arrive.

Your reminder time. You can choose when you want study reminders and, if you like, a place from a short list (home, school, library, commute, work or somewhere else). We store your choice with your account and use it only to time and word your reminders. If you do not choose a time, for accounts aged 13 and over we may time reminders near the hour you usually study (Section 5b); accounts under 13 get reminders at fixed times. Whatever time you choose, reminders never arrive during quiet hours. Accounts under 13 can choose a time but not a place.

Asking about notifications. If you are in a class or teach one, Cardvoo may ask you up to three times to turn on notifications, and may remind you in the app at moments where they would help. Tapping the button also turns on class alerts on that device. We keep a small record of whether you were asked, when, and whether you turned them on or said no, so that we do not ask too often. It does not change how many notifications we send, never uses whether you opened one, and is deleted with your account. Accounts under 13 are not asked.

Notifications for teachers. If you teach a class and turn on notifications, we may send you an in-app notice, and a push notification if you chose it for that type, when a draft is ready, an exit ticket's results are in, a Quick check is about to post or your weekly summary is ready, when a Live game is paused or ends, and when your school check is decided. They name no student. You choose by channel and by type in Settings, under Notifications and app, For teachers. A teacher's notifications are not held back by the learner quiet hours, and are not sent between 10 PM and 6 AM on your device's clock. They reach only devices where you turned on notifications on educator.cardvoo.com.

Notifications about class work. If you are in a class, we may send you an in-app notice, and a push notification if you turned on class alerts for that device, when your teacher recommends a tutor for a topic (with its due date, and again the day before it is due) and when something your teacher scheduled has posted. They follow the quiet hours and limits in this Section, name no other student and show no grade. The in-app notice is always kept, even if a push notification is not sent.

The display choices you make for Live (read aloud, text size, reduced motion and high contrast) are stored on your account, are shown only to you, and are never sent to your teacher, to other players or to class reports.

5b. Email from us: product news, reminders and win-back

What the estimate is. For every account with a birthdate, we calculate a "drift" estimate from 0 to 100 that estimates how likely you are to go 14 days without studying. It uses only your own Cardvoo records: how many days since you last studied, how your last 7 days of study compare with your last 28, how many reminders in a row you have ignored, how many cards are due, whether you finished setting up, whether you have just come back after a break of 14 days or more, any exam date you entered, whether you have just lost a streak of 7 days or more, and the hour of day you usually study over the last 28 days (used only to time reminders). At first the estimate is a fixed formula. Over time, a simple statistical model that runs only inside our own systems learns which of these facts best predicted whether people studied again within 14 days, and it takes over from the formula only after it has proved more accurate. It learns from adults' records only. We also note whether we sent you a reminder or message after an estimate, so the model does not mistake the effect of our own reminder for your habit. Each estimate keeps the three facts that counted most; you can see them in your data export. We use the estimate for four things only: when and how we remind you, which in-app message to show you, how many ads you would see and where if ads are ever turned on (Free plan only), and when we show you one soft message about a paid plan (a streak card on Home). Which ad you see is never chosen from it. For about 1 in 10 people in each estimate range we deliberately send no extra reminder, so we can measure whether reminders help. The estimate does not change what you can do, your price, your plan, which content you see or your account standing; it is not sold or shared. If ads are ever turned on, it can change how many ads you see. It can change when we show you a message about a paid plan: we show it once, you can dismiss it with one tap, and it carries no countdown. Setting Reminders to Fewer or Essentials only stops these messages. No person reviews your estimate and we make no decision with a legal or similarly significant effect from it. For accounts aged 13 to 17 the estimate is used as it is for adults: it lowers the number of reminders, changes the wording of an in-app message, if ads are ever turned on sets how many non-personalized ads you see, and can pick the moment for the streak card about a paid plan. It never adds a reminder, and win-back messages follow fixed timing and are never chosen from it. For accounts under 13 and for students in a class it is used only to lower the number of reminders: it is never used for ads, a message about a paid plan, win-back messages or marketing email, it never trains the model, and we never calculate it for teachers.

How long we keep it. An estimate is recalculated regularly and deleted automatically after 30 days. It is included in your data export. The model itself keeps only its own numbers and summary accuracy figures, which contain nothing about any one person; we keep them while the feature runs and for 24 months after a version is replaced, so we can check and undo changes. Deleting your account or choosing Essentials only deletes your estimates; it does not change numbers the model has already learned, because they hold nothing about you.

Your choice. In Settings, Notifications, set Reminders to Essentials only. We then stop calculating the estimate, delete the one we have, and send only what you asked for.

Win-back messages (accounts aged 13 and over). If you stop studying we may send one push notification after 3 days without a visit and one email after 14 days, and no more than 2 messages in total for each absence. We stop completely after 2 messages you did not answer. A new absence only starts after you have studied again. We send win-back email only to accounts whose country setting in Settings is the United States; if no country is set we do not send it. Every email says who we are and why we are writing and has an unsubscribe link that works at once and covers all win-back email. We keep a log of what we sent you for 12 months. Our 14-day email may include a welcome-back offer (Terms Section 4c); it is the same for everyone who receives it, is never chosen from your estimate, and is sent at most once in any 12 months. We do not send win-back messages or offers to accounts under 13, to a student who is in a class, or to a teacher. The timing is fixed at 3 and 14 days and is never chosen from your estimate.

Product news and tips. If you are 13 or over and in the United States, we may email you about new features, tips and short surveys ("product news"). On sign-up the box "Send me product news and tips" is ticked for accounts 13 and over in the United States, and you can untick it before you sign up. Accounts that already exist are asked once in the app; closing the question without saving does not sign you up, and we ask again after 14 days, at most 3 times. We never send product news to an account under 13, to an account that belongs to a class, or to an address outside the United States. Every email says it is an advertisement, shows our postal address and has a one-click unsubscribe. We act on an unsubscribe right away and never later than 10 business days.

Two switches. Settings has two email switches. Product news controls campaigns and surveys. Win-back and tips controls the getting-started email, win-back email and the weekly recap. Turning one off does not change the other. Neither one stops account, security, billing, consent or class email, which we must send.

How many. We send at most 3 of these emails to a person in any rolling 7 days (the getting-started email, win-back, product news and surveys together). Your weekly teacher summary, your weekly recap and your daily teacher digest are not counted, and neither is account, security or billing email.

No tracking inside the email. Our links carry a campaign name so we can see which email brought a visit. We do not use a tracking pixel and we do not put a code that identifies you in a link.

Bounces and complaints. If an email bounces, or you mark it as spam, we add the address to a do-not-email list kept as a one-way code so we never send marketing email to it again. This list is kept after an account is deleted so that the opt-out is honored.

6. Who we share data with

We don't sell your personal data. We share what's necessary to run the service with:

• Stripe (payment processing, promo codes, free months, welcome-back offers, scheduled price changes, pauses, and retrying failed payments, including updated card details from your card network when a card is replaced). Stripe also receives the promo code you enter and returns a payment-card fingerprint that we use to stop duplicate claims.
• Google AdSense, Google Ad Manager and Google AdMob (ad delivery and rewarded-ad verification, only if ads are ever turned on; no ads are shown today)
• Our AI provider, OpenRouter, which passes each request to a model provider for us: today DeepSeek and OpenAI for writing cards and study content (cards are written first by an OpenAI model, with DeepSeek as the fallback, from the same text), an OpenAI model for checking Prompt Deck cards against reference sources, and a Qwen model for reading Snap & Occlude photos, with a Google Gemini model as the fallback for photos. For requests that carry the writing of a student in a class, and for requests that a person makes on a personal account through Ask, grounded questions, guided practice, written-answer grading and practice-exam generation, we tell OpenRouter to use only the United States hosts named on our subprocessors page, and not to keep or train on the data beyond what each host's own terms say. If those hosts cannot serve a request, the request fails with a message and is not sent to any other host. For all other requests, each request asks OpenRouter to use only hosts that state they do not keep or train on the data; that is a request, and we cannot check what each host does with the text. Two settings in our own code can switch requests back to OpenRouter's default routing, one for all requests and one for the model that reads photos; we keep both switched off and will say so here before we use either. It never receives your name, email or account details. We use it to generate flashcard distractors and AI-assisted study content from the text you choose to run through it and, on a Free account aged 13 or over that has allowed it, text for a deck your device could not make, up to 3 decks a month; and, for your first deck on a Free account that is aged 13 or over and has given the cloud permission, the text you typed, your level, goal and size choices and the outline, so we can write a deck with web-checked cards; to suggest a deck's title, category, course, subject, level, language and tags from a short sample of a deck's text on paid plans (Section 4j); to draw a diagram from its topic and the picked cards' text on paid plans (Section 4j); to write podcast scripts; to write the definitions of official party packs (no user data); for teachers, to build a practice deck or study guide from the topics a class found hardest (topic names and card content only, never student names, and never Class Ask questions), to write unit plans and alternate versions of a lesson from the teacher's own text, and, when a teacher turns on AI grading or AI feedback for an assignment, to grade or draft feedback on a student's written answer (the question, the teacher's key and rubric, a source passage and the answer, never the student's name or email); to answer Ask and tutor questions on the cloud path (the question, the few passages needed and the recent turns of the chat, never your name or email; Sections 4b, 4c and 4e); to check a chosen username, a public deck or AI output before it is shown; and to analyze Snap & Occlude photos for label placement. No text from an account under 13 is sent to it for an AI feature, except for our automatic safety checks (Section 9).
• Which company runs the model. The models are made by DeepSeek and Alibaba (its Qwen models), which are companies based in China, and by OpenAI and Google, which are based in the United States. OpenRouter, not Cardvoo, picks which company's servers run each request, from the hosts that fit our price and privacy settings. We do not choose the host, we do not know in advance which host or country it will be, and we have not seen each host's own agreement, so we do not promise that a request stays in the United States. The current models are named on our subprocessors page.
• School controls. A school can ask us in writing to switch cloud AI off for all of its teachers and students, so that only on-device AI is used for them, and, when we offer it, to move its teachers and students to a US-developed model (for example an Anthropic Claude Haiku model, reached through the same provider). Until we offer the school administrator view, a Cardvoo administrator sets this for the school at its written request, and a setting applies only once we have confirmed it in writing. After we offer that view, the school's administrator can set it. Automatic safety checks, such as the check of a deck before it is made public, are not switched off by this setting. An individual teacher or student cannot change it.
• One of the on-device models Cardvoo can download is LFM3 from Liquid AI, used under the LFM Open License v1.0. It runs on your device, so your text is not sent to Liquid AI. We use it only while that licence allows our use, and we review that every year.
• Cloudflare Workers AI (two narrow jobs). First, a safety pre-screen (Cloudflare's Clef-flash model) reads the title and card text of a deck when you make it public. Second, embeddings (the bge-m3 model) are made from your question and the passages of your own study material when you use Ask anything on a Standard or Pro account. We never send Free-plan questions, on-device questions, class Ask questions or a class's material (its decks, guides, assignments, answers, results or roster) to it, and it never receives your name, email or other account details. One thing a teacher writes can reach it: the text of a unit that the teacher chooses to share with other teachers (Section 4t), read once for the safety pre-screen when it is shared. A unit is the teacher's own planning text, not class material, and holds no student data. Cloudflare processes this on our behalf under its agreement with us and does not use it to train models. If it is unavailable we fall back to keyword matching or our other moderation check. The full entry is on our subprocessors page.
• Cloudflare Workers AI, also for grading. To check some written answers faster, we may send the question, the expected answer and your answer (no name or email) to Cloudflare Workers AI. This does not happen for accounts under 18 or for students in a class. We ask that it not keep or train on the text.
• fal.ai (voice generation for Podcast and Walk & Recall, and speech-to-text for grading voice answers). fal.ai in turn routes these calls, on our behalf, to Google (Gemini text-to-speech), ElevenLabs (speech-to-text), and xAI (Walk & Recall's primary voice). Under our agreement with fal.ai, these providers may process the data only to provide the service to us.
• Free public reference sources (Wikipedia, and for some subjects PubMed and Crossref), which receive short search queries derived from card wording when a Prompt Deck's uncertain cards are checked (see Section 4a)
• Unsplash (when a paid account searches for a photo for a card, a guide or a deck cover: the search term and the photo chosen go to Unsplash, we tell Unsplash which photo was chosen, as its rules require, and the picture is loaded from Unsplash's servers by the browser of the person who sees it. Cover photos are shown only to signed-in accounts aged 13 and over that are not in a class and are not teacher accounts, so a visitor who is not signed in, an account under 13, a student in a class and a teacher never load one)
• Public download hosts for on-device AI. When you turn on on-device AI, your browser downloads the model files directly from Hugging Face (huggingface.co and its content network) and, for the larger on-device models, a runtime library from GitHub (raw.githubusercontent.com). Those sites see your IP address and browser details, as with any download, and receive none of your study content or account details. The on-device model files come from Hugging Face (including the model files published by the MLC project) and the MLC runtime library from GitHub, and once they are downloaded the models run locally on your device; the models are listed on our model credits page. On a phone using mobile data or data saver, the app asks before it downloads a model. The small browser runtime for Safari and iPhone is served from cardvoo.com; only if that copy cannot be loaded does your browser fall back to jsDelivr (cdn.jsdelivr.net), a public code host that then also sees your IP address.
• Resend (email delivery: account and billing email, including price and plan notices, the reminder before a price change, free month or pause ends, failed-payment and renewal reminders; reminder emails you have turned on; and win-back email, when enabled, and getting-started and weekly recap email, when enabled)
• We send account, security, billing, consent and class email from our main address. We send product news, tips, surveys, getting-started, win-back and weekly recap email from a separate address on a Cardvoo subdomain, so that a problem with marketing email never delays a sign-in code. Both go through the same email service.
• Google Classroom (only when a teacher connects it: Cardvoo reads courses, rosters and student emails from Google, and sends assignments and grades to Google; see Section 6a)
• Our cloud infrastructure providers (hosting, database, and error-monitoring vendors), processing data on our behalf, not using it for their own purposes

6a. Google user data (Google Classroom)

Cardvoo (cardvoo.com) has an optional Google Classroom integration for teachers only. A teacher chooses to connect their Google account from their class settings; nothing is connected automatically. Students never sign in to Cardvoo with Google, and Cardvoo never asks a student for Google access. The sub-sections below explain exactly what Cardvoo asks Google for, why, what we do with it, who receives it, how it is protected, how long it is kept and how to remove it. CSV roster import and export always work without Google.

Limited Use. Cardvoo's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Read the Google API Services User Data Policy. The full statement is in the last sub-section of this Section 6a.

6a.1 Google user data we access

What access we request (the four Google Classroom scopes). Cardvoo requests only these, and all four are needed for the integration to work. If you untick any of them on Google's consent screen, Cardvoo refuses the connection and revokes what Google granted. We do not request access to profile photos, Drive, Gmail, Calendar or anything outside Google Classroom.

• classroom.courses.readonly (view your Classroom classes): to list the active courses you teach so you can pick which one to link to a Cardvoo class. We read each course's name, section and state.
• classroom.rosters.readonly (view the people in your Classroom classes): to read the list of students in the course you choose, so you can preview and import the roster as invitations to the matching Cardvoo class.
• classroom.profile.emails (view email addresses of people in your Classroom classes): to read the email address of each student in the roster, because Cardvoo invites students by email, and to show you which Google account (your own address) is connected.
• classroom.coursework.students (manage coursework and grades of students in your classes): to create, in your course, an assignment that Cardvoo itself created (title, your instructions, points, due date and a link back to Cardvoo); to read the submissions for that assignment so each Classroom student can be matched to the right Cardvoo student; and to write the numeric grade back to Classroom as a draft or assigned grade, and optionally return it to the student. Classroom only lets the app that created an assignment grade it, which is why Cardvoo creates the assignment itself.

Google data we read. Your connected Google email address; the names, sections and states of your active courses; for the course you pick, each student's full name and email address; and the submissions (and any grade already entered) on assignments Cardvoo created, only to match students and to avoid overwriting a grade you typed in Classroom. Roster names and emails are read when you ask (to preview or confirm an import) and shown to you. Cardvoo does not keep a copy of the names or the email addresses: invitations keep only a one-way hash of each address.

Data we write to Google. Only what you tell Cardvoo to send: the assignment's title, your instructions, points, due date and a link back to the Cardvoo assignment, and each matched student's final numeric grade (draft by default; assigned or returned only if you choose). We never send a student's answers, an answer key or the assignment's content to Google. Nothing is written to Google until you link an assignment to Google Classroom or choose to send or sync grades. For an assignment that you have linked, Cardvoo sends each matched student's numeric grade to Classroom automatically after the grade is saved in Cardvoo, as a draft by default (assigned or returned only if you choose), and never overwrites a grade you typed in Classroom. If you tick "Also post to Google Classroom" when you schedule an item with Post at, Cardvoo creates the Classroom assignment at the time you chose, using your Google connection. An assignment that you have not linked sends nothing. Cardvoo asks for no new Google permission for this.

6a.2 How we use Google user data

Only to provide the features you asked for in the teacher's own class: showing you your courses, importing your roster as Cardvoo invitations (which the student still accepts with their own Cardvoo account, and which you approve), creating Classroom assignments, and returning grades. When you confirm an import we email an invitation to each address you chose, through our email provider Resend, with your name and the class name. We do not use Google user data for anything else.

6a.3 Who receives Google user data

Google user data is received by Cardvoo, and by nobody else except: our service providers that run Cardvoo for us and are listed on our subprocessors page (hosting, database, and Resend for the invitation emails), which may process it only on our behalf; and where the law requires it. We do not send it to our AI providers. People at Cardvoo do not read your Google user data, except where you ask us for support, where it is needed to investigate abuse or a security problem, or where the law requires it.

6a.4 How we protect Google user data

Data is stored in our database (MongoDB Atlas), hosted on Fly.io. Your Google refresh and access tokens are encrypted at rest (AES-256-GCM) and are never shown, logged, exported or sent to the browser. Traffic is encrypted in transit. The sign-in uses Google's OAuth authorization-code flow with PKCE and a short-lived, tamper-proof state value, and access is requested only for the signed-in teacher's own Google account.

6a.5 Retention and deletion of Google user data

What we store, and for how long.

• Your connection: your Google email address, the scopes granted, the connection status and dates, and your Google refresh and access tokens (encrypted, as above). This record is kept until you disconnect, or until your Cardvoo account is deleted. If Google stops trusting the saved connection, the access token is dropped and the connection is marked as needing a reconnect.
• Link identifiers: the Google course ID saved on a Cardvoo class and the Google course and assignment IDs saved on an assignment you sent to Classroom. They are kept with that class or assignment until it is deleted.
• Grade-sync audit rows: one row each time you sync grades, holding only IDs, the mode, counts and error codes. They hold no student name, no email address and no grade value. They are kept until the class is deleted or your account is deleted.
• Roster names and emails, and Classroom grades: read on demand and shown to you; not stored by Cardvoo (see above). A student who accepts an invitation creates a normal Cardvoo account of their own, which is covered by the rest of this policy.

How to disconnect and delete your Google data. In Cardvoo, open the class's Settings, find the Google Classroom card and choose Disconnect. Cardvoo then revokes its access at Google and deletes your saved connection and tokens. Assignments already sent to Classroom stay in Classroom, and your Cardvoo grades are not changed. You can also remove Cardvoo's access at any time from your Google Account's third-party access page at myaccount.google.com/permissions. If you delete your Cardvoo account, we revoke the Google connection, delete the saved tokens and delete your grade-sync audit rows. To ask us to delete anything else we hold that came from Google, such as the saved course and assignment IDs, email [email protected]. See also our Data Deletion Policy.

Children and students. Google does not tell Cardvoo a student's age. Students are invited, not signed in: each student must join the class with their own Cardvoo account, and accounts under 13 cannot join a class (see Section 9).

6a.6 What we never do with Google user data

Cardvoo does not do any of the following with Google user data:

• We do not use it for advertising, including personalized or interest-based ads, and we do not use it to build marketing profiles.
• We do not sell it, and we do not transfer it to data brokers or other third parties for their own purposes.
• We do not use it to determine credit-worthiness or for lending purposes.
• We do not use it to develop, train or improve AI or machine-learning models, and we do not send it to our AI providers.
• We do not allow people to read it, except where you ask us for support, where it is needed to investigate abuse or a security problem, or where the law requires it.

6a.7 Limited Use statement

Cardvoo's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Read the Google API Services User Data Policy.

6b. Schools: inquiries and quote requests

If you fill in the form on our Schools page, ask for a quote or ask about a pilot, we collect what you type (your name, role, school or district, size, area of interest and message and the email address you give). We use it only to answer you, send a quote, run a pilot you ask for, and keep a record of our conversation. We aim to reply within two school days. We do not add you to a general mailing list or sell your details. Your inquiry is recorded in our own database and also arrives in the inbox for [email protected]. The email copy is deleted from our inbox when we delete the inquiry. We keep an inquiry for up to 2 years, or delete it sooner if you ask at [email protected]. We do not store your IP address with an inquiry. Student data is never part of an inquiry; if a school later signs up, student data is handled under the Cardvoo Data Privacy Agreement. Cardvoo does not hold SOC 2 or ISO 27001 certification, has not had an independent penetration test and has not signed the Student Privacy Pledge; our DPA, security overview, incident response plan and accessibility statement are available on request.

6c. Outreach email and the do-not-contact page

Sometimes we write once to a teacher, school staff member or other adult at an address we found on a public staff page, to tell them about Cardvoo. Every such email says who we are and why we are writing, shows our mailing address, and has an unsubscribe link and the words 'Reply STOP'. We do not email an address from a staff page that says it must not be used for marketing or solicitation. The link opens a page where you can ask us never to contact you again. We collect only your email address, the date and time of your request and, if you choose to give one, a reason. We use them for one purpose: to make sure we do not email that address about Cardvoo outreach again. We keep the address on our do-not-contact list until you ask us to remove it, because deleting it would allow us to email you again; we never sell it, share it or use it for anything else. We stop emailing you within 10 business days of your request, and in practice the same day. This does not stop account, security, billing or class emails you have asked for.

6d. School seats and school administrators

If a school pays for a teacher's seat, we keep the seat record: the school, the teacher's account, the status and the dates, and the quote and invoice records. A school administrator, an adult whom the school names, can see for each seat teacher the name on the teacher's account, the seat status, the number of classes, the date of last activity and how much of the free AI allowance has been used. A school administrator cannot see students, rosters, grades, assignments, answers, groups, feedback, class content or a teacher's personal decks and study history. A teacher accepts the seat in the app and is shown this before it starts. Quotes and invoices are kept for the tax and accounting period and belong to the school's business records, not to the teacher's account. If the seat ends, the teacher's account and classes are not deleted. The school decides how student data is used; see Section 4c and the Cardvoo Data Privacy Agreement. We issue each invoice by hand through Stripe, which handles the payment; Cardvoo's own software does not charge anyone for a seat.

7. Public decks

If you mark a deck "Public," its title, category, course/topic label and a sample of its first cards become visible to anyone browsing Cardvoo's Explore page, including people without an account; the rest of its cards need an account.
The creator's username is shown on the deck only for an account aged 18 or over; for an account under 18 the deck shows "a Cardvoo student".

Other people aged 13 and over whose accounts are not managed by a parent can save a copy of a public deck and change it for their own study, and people aged 13 and over can publish the change with a credit to you (Terms Section 6 and our Section 4o).

Private decks are never shown to anyone but you. A deck made from a prompt also shows an "AI-generated from a prompt" label and its list of reference sources (Section 4a). When someone shares the link to a public deck or one of our study guides in a messaging app or on social media, the preview that app shows can include the deck title, a short description, the number of cards, the owner's public username (an account under 18 is shown as "a Cardvoo student" instead) and our logo, but no card text. We build this preview at the edge of our network (Cloudflare) from the same public information that is on the deck's page, and keep it for up to five minutes. A deck you make private, hide or delete stops showing in new previews within minutes. Archiving a public deck also takes it off Explore, out of search and off its public link and preview until you unarchive it, and unarchiving makes it public again exactly as before, though a service that already saved a preview may keep it longer. Links to a public tutor are never turned into a preview by messaging apps.

Score cards. If you are 13 or over and your account is not managed by a parent, you can make a score card, a picture of a game or test result that you can share. It is made on your device from what is on your screen and we do not keep it or give it a web address. It never shows your real name or email. It shows your username only if you are 18 or over and turn that on, and never when the result came from work in a class; a card from class work shows only the score and our logo, with no class, teacher, school or other student. The deck's title appears only if the deck is public or official, and never on a card from class work. The picture has no hidden location or other metadata. Once you share it, it is out of our hands: the app you share it with keeps its own copy. Accounts under 13 and accounts managed by a parent do not have score cards.

8. Microphone and camera

Cardvoo only asks for microphone or camera access when you start a feature that actually needs it: a Pop-Quiz podcast episode or a Walk & Recall voice answer (microphone), or Snap & Occlude and Charades (camera). You can always say no and use a tap-based alternative instead: typed or tap answers for Pop-Quiz and Walk & Recall, and photo upload instead of live camera capture for Snap & Occlude. Charades' motion controls use your device's motion sensor, not the camera, unless you opt in to recording a video replay.

9. Children's privacy

Cardvoo requires verifiable parental consent (an emailed link with a legal-name attestation) before any account created by someone under 13 activates, consistent with COPPA's "email plus" method, which is available because we do not share a child's personal information with any other company for that company's own use: the companies that receive it are service providers that run part of Cardvoo for us (Section 9b), and no text from an account under 13 goes to a cloud AI provider for an AI feature (below). In this policy and the Terms, an account is managed by a parent when it is under 13 and was opened with a parent's consent or is waiting for one. Cardvoo is for people aged 13 and over, and a child under 13 can have an account only with a parent's consent. Verified-minor accounts can't use public (stranger) matchmaking in Recall Race, and their username and equipped Voo (our mascot) are the only identifying information shown on leaderboards (an account under 13 is never named on a league list, game leaderboard or race, and cannot be found or have its profile opened by other people; the equipped Voo is shown only to friends; everyone else sees a plain default Voo, and league lists also show a weekly score and streak, see Section 4d). A public deck never names an account under 13 (Section 7). Cardvoo shows no ads today. If ads are ever turned on, accounts under 13 never see ads, and accounts aged 13 to 17 see only non-personalized ads (Section 3). A person who tries Cardvoo as a guest must be 13 or over; the age screen is neutral, its answer stays in the browser, and a person under 13 is sent to the parent consent sign-up (Section 4m). See Section 5 above for the internal operations exception this relies on.

After the parent agrees. Within 24 hours after a parent gives consent, we send a second email to the same parent address. It says what the parent agreed to, what information the child's account collects, and how to withdraw the consent: the parent can use the "Delete my child's account" link in that email or in any of our emails to parents, or write to the privacy contact in Section 15. Withdrawing consent means we stop collecting the child's information and delete the account and its data as described in Section 10. The second email does not ask the parent to do anything. We keep the time it was sent with the parent consent record (Section 10).

If a parent never gives consent. An account made by someone under 13 does not activate until a parent gives consent (above). If no parent has given consent 30 days after the account was created, we delete the account and everything stored with it: the child's email address, birthdate and the parent's email address that were entered at sign-up, and everything else listed in Section 10 under "What is deleted at the end of the 30 days". We do this with the same deletion that runs when an account is deleted (Section 10). What we keep is listed in Section 10 under "What we keep after a deletion": for this account, only a minimal record of the consent request, with the account, the parent's email address and the link each replaced by a keyed hash. It shows that a request was made and no parent confirmed it (the parent name field is empty, because no parent gave one), when its link expired and when the account was removed. We keep it for 3 years after the account is deleted and then delete it, as Section 10 already says for the parent consent record. We do not keep the legal acceptance record of this account. A daily scheduled job does the removal. Before it deletes the account, it sends one email to the parent address that was entered. The email says that an account made for a child under 13 was removed because consent did not arrive within 30 days. It does not name the child or the username. The child typed that address, so we cannot tell whether it belongs to a parent. If one parent address was entered for more than one waiting account, that address gets one email for that day's run. If a parent gives consent before the account is deleted, the account is kept. If the child still wants to use Cardvoo, they can sign up again and a parent can give consent then.

A few additional rules apply specifically to the newer features above: if someone under 13 wants to set a custom username (rather than keep their randomly assigned one), we email their linked parent for approval before the change takes effect. A person aged 13 or over can set a custom username without approval; we check every custom username against our name rules. Minors' voice answers are handled exactly the same way as anyone else's: graded from a transcript and never stored as audio. Friends is limited by age: accounts under 13 have none, and a friend request, invite link or study buddy invite works only between accounts of the same age group (13 to 17, or 18 and over). Accounts under 13 do not see other people's public tutors (Section 4e). And Charades video never leaves the device for any account, including minors'. There's no separate, weaker rule here, since the on-device-only policy already covers everyone.

Cloud AI for children. Accounts under 13 use only the AI that runs on their own device. We send no text or photo from an account under 13 to a cloud AI provider (Section 6) for any AI feature (Prompt Decks, deck suggestions, practice exams, podcasts, diagrams, grading, imports, Ask, tutors or any other). A parent cannot switch cloud AI on for a child, and the parent's consent page has no choice about it. The one exception is our automatic safety checks: our AI provider, OpenRouter, and Cloudflare Workers AI read a chosen username, and the title and cards of a deck before it is made public, only to keep the service safe and for nothing else (Section 9b). Every other rule for children in this policy stays the same. Accounts aged 13 and over can use cloud AI features, including AI grading of written answers in a class, in the same way as adults, after the one-time choice to allow cloud AI that every account aged 13 and over is asked for.

New in this version: for accounts under 13 we send at most 1 push notification a day and 4 a week, only study reminders and parent-relevant notices; we use a study-activity estimate only to lower the number of reminders; we show no ads and send no win-back message or offer; we keep only per-account totals of active study time for the service's internal operations (Section 5); a child cannot use a promo code, a free trial, a free month or a referral (they cannot pay, Terms Sections 4a and 4b); and friend streaks do not exist for them. Accounts aged 13 and over have the same reminder limits as adults (Section 5a), and can receive the welcome-back offer, share a referral link or code, and use a promo code, trial, free month or welcome-back offer on their own account. Points from class work and any account under 18 in a class never enter a league group. An account under 13 is placed only in a private league group made of other accounts under 13, where it is shown to the other members only as "a Cardvoo student", and no account aged 13 or over sees its username, points or place anywhere (Sections 4d and 4h).

For an account that has a parent or guardian contact, the parent can ask to change that contact (Section 9a). While the account is under 13, the parent can also ask to delete it (Section 10), and when a change to our Terms or Privacy Policy needs acceptance the account is not blocked for 30 days and its parent is emailed to read and accept (Section 14). From the day the account reaches 13, the person accepts changes and deletes the account for themselves; a parent contact that stays on the account is used only as Section 10 describes under "When an account turns 13".

9a. Parent contact changes

An account that has a parent or guardian contact can have that contact changed. This is how it works:

• Who can start a change. The child (Settings, Parent) or the parent (the "Wrong address or not you? Change it" link at the bottom of most of our emails to a parent). The first consent email does not carry this link.
• Both addresses must agree. The current parent address gets an Approve or Decline link and the new address gets a Confirm link (the person confirming says they are the child's parent or legal guardian). Both must say yes within 7 days. Nothing changes while the request is waiting and the account works as normal. Each link works once. The child can cancel the request and can ask us to send the emails again a limited number of times.
• If the current address no longer works. The child can ask our support team to review it. Then only the new address is emailed, it must confirm first, and then a Cardvoo administrator approves or rejects the request and must write a note. The administrator sees both addresses in full while deciding, and opening a request is recorded in our admin audit log.
• If the person emailed does not know the child. "I do not know this child" on any of these pages cancels the request, flags it for our administrators and blocks the emailed link for that child and that address.
• A completed change is final. It cannot be undone; a further change is a new request. Both addresses get a notice, the child gets an in-app notification (no email and no push notification), and links already emailed to the old address stop working.
• How long we keep a request. A request that expires is deleted 7 days after its window ends. A declined or cancelled request is deleted 30 days after. A request that support rejects, or that was reported, is deleted one year after. A completed change is kept until the account is deleted, and is then deleted with it. The links we email are stored only as keyed hashes. Parent contact change requests are not part of the data export.

9b. Who receives a child's information

For an account under 13, only these companies receive the child's information. Each one is a service provider that runs part of Cardvoo for us, under a written agreement or online terms that Cardvoo has accepted. We give a child's information to none of them for its own use (Section 6):

• Fly.io, which runs our servers, in the United States.
• MongoDB Atlas, which holds our database, in the United States.
• Cloudflare, which hosts the app, delivers pages and stores files.
• Resend, which delivers email, including the emails to the child's parent.
• Sentry, which receives technical crash reports that carry no account or user ID.
• OpenRouter, our AI provider, and Cloudflare Workers AI, which read text from an account under 13 only for automatic safety checks (for example a chosen username, or the title and cards of a deck before it is made public) and for nothing else. OpenRouter passes the text to a model host that it chooses; Cardvoo has no agreement with that host and relies on OpenRouter's terms and settings.

Google Workspace, which hosts our support inbox, receives only what a parent or a child writes to us. No advertising company, payment company, photo service or other AI provider receives information from an account under 13: a child sees no ads, cannot pay and loads no cover photo. The same list, with the purpose of each company, is on our subprocessors page under "Companies that receive a child's information". We update it before a new company receives a child's information, and a new use waits for a parent to accept (Section 14).

10. Data retention & deletion

You can delete your account yourself. Open Settings, then Account, then Delete account (the same step is offered on the screen that asks you to accept updated documents). Type the word DELETE, and we email a link to the address on your account. The link works for 60 minutes and only once, and it works if you sign in with Google. Opening the link locks your account at once. If you cannot sign in, email [email protected] from the address on your account and we will help; a deletion we process for you this way is kept for 90 days before it is purged (see Accounts we deactivate below). The steps are also in our Data Deletion Policy.

While the account is locked (30 days).

• For 30 days, signing in shows only a locked screen and nothing else works. Nothing is deleted yet. Only the Cancel deletion button cancels it: the account holder can press it, and for a child account the parent can cancel from the link in the email we send them. Signing in on its own does not cancel anything.
• Locking stops push notifications to your devices, stops the account from joining games, hides the account from friends lists, classmates lists, profiles, search and Explore, removes its name from league lists and leaderboards, and takes your public decks and tutors off Explore and off their links. If you cancel, the account reopens and your public decks and tutors are published again as they were.
• After 30 days, a scheduled job that runs every hour deletes the account's data as described below and we send a final email. If a deletion run fails, the account stays locked and the job tries again the next hour, and we are alerted if it keeps failing.

Paid plans, teachers and children.

• Paid plans. A paid plan that is still renewing, including a free trial that will turn into a paid plan, has to be cancelled in Billing first. We never cancel or change a Stripe subscription for you. A plan that is already cancelled but has paid time left does not block the deletion; because the account locks, the remaining paid time ends. If you write to [email protected] within 30 days of asking for the deletion, we refund each full month of that paid time that was still to come on the day you asked, to the card you paid with. A month that had already begun is not refunded. The email we send to confirm the deletion tells you this, and so does the locked screen.
• Teachers. Every open class you own must be transferred to another approved teacher of that class, who has to accept (until then the class is not transferred and the deletion stays blocked), or closed. Closing a class archives it, expires its join code and tells its approved students. A closed class stays as a read-only record and is anonymized after 12 months. Anonymized means that we remove the link to the student's account, the student's class name and any text the student wrote, so that the record cannot reasonably be linked to a person. A class with no teacher or student activity for 12 months is closed automatically and then handled as a closed class. If you cannot transfer or close a class, for example because you have left your school, write to [email protected] and we will close it for you; we aim to do so within 10 business days.
• Children. For an account under 13, a parent has to confirm. The child's request is emailed to the parent, who has 7 days to confirm; the account works as normal until they do, and if they do not, the request ends. A parent can also start the deletion from the "Delete my child's account" link in our emails to parents: they enter the child's username and their own email address, our answer never says whether they matched an account, and the confirm link we email works for 60 minutes. During the 30 days either the child or the parent can cancel.
• When an account turns 13. If an account was opened with a parent's consent while the person was under 13, then on the day it reaches 13 (by the birthdate on the account) the person accepts our Terms and Privacy Policy themselves and can delete their own account without a parent. The parent's email address stays on the account, and the Parent tab stays in Settings, while the link to that parent is active. From that day we use it only for the emails of a parent contact change (Section 9a), and the parent has no other right over the account. The account holder can remove the link at any time in Settings, Parent, with Remove parent contact. Removing the link deletes the parent's email address from the account, deletes any open request to change it and the emailed links and reminders for that parent, and we stop writing to the parent. A request that a parent flagged with "I do not know this child" stays for our administrators until its own end date (one year, Section 9a). On the day the account reaches 18, or if the account is deleted, the parent's email address is deleted. We keep the parent consent record (the date, with the account, the parent's name and the parent's email address each replaced by a keyed hash) for 3 years after the account is deleted, as this Section already says.

What is deleted at the end of the 30 days.

• Deleted: your account and how you sign in; your account security log, your failed-sign-in counter and your daily email counters; your devices, push notification subscriptions and notification settings; your reminder delivery and open records and win-back log; your study-activity estimate; your reminder time and place, your daily plan time choice, rest days and breaks, streak make-ups, catch-up plan, league opt-out and the prompts you have seen; your welcome-back offer history, your getting-started message records, your weekly recap email log, and which upgrade cards you were shown; your Recall Race statistics, mini-game counters and referral records; your promo-code records (see below for the coded markers we keep to prevent repeat claims); your username change requests; your decks, cards and folders, your diagrams and their pictures, and the notes, study guides and imports made from your files; your Exam Countdown exams; the courses you own (you are removed from courses you joined); the Cardvoo Live rooms you hosted outside a class (and your place in other players' rooms); your podcast episodes and their audio, so their share links stop working; your study history, your first-step record, streaks, active-time records and league ranks; your friends, friend streaks, friend requests, blocks and invite link, and your league cohort rows; your theme preference; the tutors you made, your copies of other people's tutors and your tutor sample markers; your Ask chats, Cram runs (including anything you typed) and in-app notifications; the question reports you made; the decks you marked "worked for me" and the marks themselves (counts are corrected overnight), the remixes you made; your saved files; and, for teachers, your teacher application records, your Google Classroom connection and tokens, the practice sets and tutor recommendations you made for your classes, your units, substitute-plan pages and link records, printable files, shared units and free-allowance usage records.
• A class's groups, group membership and AI feedback are class records and not part of a teacher's account: they stay with the class, which is transferred to another teacher or closed when a teacher's account is deleted, and they are deleted or anonymized as the class is (see "How long we keep the newer records").
• Copies other people already made of your decks or tutors stay with them, and the credit on copies and remixes of your decks changes to "A former user" and the link to your deck is removed. A student's class records are anonymized rather than deleted, so a class keeps its records without your name. Your username is replaced by "A former user" in the friend notifications other people received. Copies of a shared unit that other teachers already added stay with them, and the credit on them changes to "A former Cardvoo teacher".
• Deleted data also ages out of our backups within 35 days. Counting the 30 days, everything is gone from our systems and backups within about 65 days of your confirming a deletion that you (or a parent) started yourself; the other cases are in Accounts we deactivate below and in the Data Deletion Policy.

What we keep after a deletion.

• Payment and tax records. Stripe keeps its customer record and invoices (the deletion never removes anything at Stripe), and we keep our own billing records, such as plan changes, top-up purchases, subscription events, pauses, failed-payment and renewal-reminder records and the record of what you agreed to at checkout, which carry your account id or, after the deletion, a keyed hash of it. They hold no study content. We keep them for as long as the law requires tax and accounting records to be kept (the checkout consent record for at least 3 years, or 1 year after the subscription ends, whichever is longer). The fact that a promo code or free month was applied to a payment, and the record of a scheduled price change and the notices we sent, are part of these billing records.
• The record that you accepted our legal documents: which documents and versions, the dates, and whether you or your parent accepted. Your account id is replaced by a coded identifier (a keyed hash), and a parent's name and email address are replaced by keyed hashes. We keep it for 3 years after the account is deleted, then delete it.
• For an account created with a parent's consent, the parent consent record: the date, with the account, the parent's name and the parent's email address each replaced by a keyed hash. We keep it for 3 years after the account is deleted, then delete it. This includes the minimal record of a consent request for an account we removed because no parent gave consent within 30 days. In that record the parent name field is empty.
• A deletion audit entry: that a deletion was requested, locked, cancelled or completed, and when, keyed by a hash of the account id, with no personal data. We keep it for 3 years, then delete it.
• Strikes and appeals, and league and race records, as an audit trail, for 2 years after the account is deleted, then we delete them. Reports you filed or that were filed about you are kept for one year after they were filed, then we delete them; when a reporter's account is deleted, the reporter's account ID in the report is replaced by a keyed hash.
• A do-not-email list (stored as address hashes) so that someone who unsubscribed stays unsubscribed. We keep an address on it until the person asks us to remove it, because removing it would allow us to email them again.
• Coded markers to prevent repeat promo and free-month claims. After you redeem a promo code, a referral free month or a welcome-back offer, we keep a keyed hash of the device and IP marker used for 12 months after it was last used, and a keyed hash of the payment-card fingerprint for 24 months after it was last used, with no name or email. The redemption row itself (code, channel, date) is kept for the same 24 months with the account id replaced by a keyed hash. They survive deleting the account only as these hashes, so the same code or free month cannot be claimed again by deleting and re-creating an account. Both are deleted automatically when the period ends.
• School inquiry records (Section 6b) are not part of an account and follow their own 2-year period.
• Admin audit log of feature switches. When an administrator turns a feature on or off we keep who did it, when, and the reason they typed, for 2 years. It holds no end-user data.
• The estimate model's own numbers (Section 5b), which contain nothing about you.
• A keyed hash is a coded identifier made with a secret key that only we hold. It does not show who you are to anyone without that key, but we can work it out again from your account id, so we treat these records as personal data.

How long we keep the newer records.

• Study-activity estimate: 30 days, recalculated; deleted at once if you choose Essentials only.
• Reminder delivery and open times: 30 days (under 13: delivery records 7 days; no open times).
• Daily push counts: 8 days.
• Win-back log and welcome-back offers: 12 months after each was sent.
• Active study time, raw events and daily totals (13 and over): 90 days.
• Active study time (under 13): a per-account total over a rolling 90 days; no per-day or per-session series.
• First-review time: 90 days.
• Seen-prompt markers: 400 days.
• Catch-up plan: until the day after it ends; its undo list 24 hours.
• Friend streak: until the friendship ends or either account is deleted.
• League cohort row: the same period as other league records.
• Question report: 90 days.
• Feedback you send us: deleted 12 months after you send it, or when your account is deleted, whichever comes first. The site-wide counts of plan-message taps carry no account ID and are kept with our other daily counts.
• Diagrams: until you delete them, the deck or your account.
• Podcast episodes, including shared copies: 90 days.
• Account security log: 400 days after each entry, or until the account is deleted.
• Class practice sets and tutor recommendations: 12 months.
• Promo, referral and welcome-back redemption rows: with your account; after deletion, 24 months after last use with the account id replaced by a keyed hash; the billing line follows the tax period.
• Repeat-claim markers: device and IP hash 12 months after last use; card fingerprint hash 24 months after last use.
• Free month saved for a Free referrer: expires 12 months after it is earned.
• Pause, failed-payment, renewal-reminder and price-change records: the tax-and-accounting period.
• Checkout consent record: 3 years, or 1 year after the subscription ends, whichever is longer; a checkout never completed, 30 days.
• Schools inquiry: up to 2 years.
• Admin feature-switch audit log: 2 years.
• Summary report tables (no user ids): 24 months.
• Guest session progress: on your own device only, deleted by the app 14 days after last use, or sooner when you clear your browser's site data. Your guest progress is not kept on our servers.
• Getting-started message record: until your account is deleted, so that it is never sent twice.
• Weekly recap email log: 12 months after each was sent. The recap card itself is not stored.
• "Worked for me" marks: until you remove them or delete your account.
• Reports about public decks: one year after they were filed; if the reporter's account is deleted, the reporter's account ID becomes a keyed hash.
• The link from a remix to its original: with the remix; removed from copies when the original's owner deletes their account.
• First-step record (starter deck, Describe, Import or blank, subject picked, times): 90 days. Anonymous sign-up, tour and download counts: 24 months with the other summary tables; they carry no ID.
• Daily plan time choice: until you change it or your account is deleted. The plan itself is not stored.
• Class leaderboard: the weekly points are worked out when the class page is opened and are not stored; your switch to be left off the list is deleted when you leave the class and when the class is closed or deleted.
• Unit outlines: until you delete them or your account is deleted.
• Groups and group membership: while the class exists. A group is deleted when you delete it and when the class is deleted or anonymized; a student is taken out of every group on leaving the class, on removal and on account deletion. Groups stay with the class if the teacher's account is deleted.
• AI feedback drafts that were not approved: 30 days; a rejected draft is deleted at once; approved feedback stays with the student's work until the class is deleted or anonymized.
• Substitute-plan records: until 30 days after the link expires or is revoked.
• Printable files: 7 days. Meeting prep sheet files: 7 days.
• Weekly summary totals: 12 months, deleted with the account.
• School proof you add to a teacher application: 30 days after we decide, or when the account is purged, whichever is first.
• Class Live game results and questions: while the class exists; anonymized when the class is anonymized. Live game event records (connection and error events for running the game): 30 days.
• Notification prompt record: while the account exists.
• A shared unit: until the teacher unshares it or deletes their account; copies others made stay with them.
• Free-allowance usage records: with the account; the per-call AI log: 90 days.
• Seat records: while the seat exists; quotes and invoices: the tax and accounting period.
• Decks in Recently deleted: 30 days after you deleted the deck, or when you choose Delete forever, or when your account is deleted, whichever comes first.
• Unsent study answers kept on your device: until they are sent, until you choose Sign out or lock your account for deletion, or until you clear this site's data in your browser. They are not kept on our servers.
• Error reports: kept by our error-monitoring service for 90 days.
• Error-report account code: a one-way code; deleting your account removes our ability to link it to you.
• Email send record: for every email we send (including account email), the type, the time, whether it was sent and a one-way code of the address: 90 days. You can ask for yours.
• Do-not-email list: the one-way code of an address that unsubscribed, bounced or complained: kept so we honor it.
• Product news answer: your choice is stored with your account and deleted with it; the do-not-email list above is what remains if you unsubscribed.
• Bulk import records (a record of a batch of files you imported, with the names of the files and the decks made): deleted 30 days after the import finishes, or when your account is deleted, whichever comes first.
• Visual templates you submitted: deleted when your account is deleted, except an approved template other people's cards use, which stays without your name.

Children's information: how long we keep it. We keep a child's (under 13) personal information only as long as we need it for the reason we collected it, and then we delete it. In practice:

• Account and study data (decks, cards, review history): until the account is deleted by the child or parent, then as in this Section 10. After a deletion, only the records listed under "What we keep after a deletion" remain, each for the period stated there.
• Daily activity, study-session and active-time totals (internal operations): 90 days, then deleted.
• Push notification records (what was sent, to count the daily and weekly limit): 7 days.
• An account still waiting for a parent's consent: deleted 30 days after it was created, with the parent's email address entered at sign-up. The parent receives one notice email. A minimal consent record (hashed, as described under "What we keep after a deletion") is kept for 3 years after the deletion.
• Parent consent record: as stated in this Section 10.
• For a child we use a study-activity estimate only to lower the number of reminders, and we create no win-back contact list or marketing profile.
• The parent's name and email address: kept with the parent consent record while the account exists, so that we can reach the parent; after a deletion, only as keyed hashes for 3 years, as stated above in this Section 10.
• The second email to the parent (Section 9): the time it was sent is kept with the parent consent record.
• Parent contact change requests (Section 9a): deleted 7 days after the window ends, 30 days after a decline or a cancellation, and one year after a rejection or a report; a completed change is kept until the account is deleted.
• League placement (the private league of accounts under 13, Section 4h): the current group and weekly score, and league records for 2 years after the account is deleted, as stated above.
• Our written retention schedule. This list, together with the lists above in this Section 10, is our written retention schedule for children's information. We review it at least once a year and whenever we add a feature that stores something new about a child.

A parent can ask us to delete a child's information at any time (Data Deletion Policy).

Accounts we deactivate. If we deactivate an account ourselves (for example a permanent ban) or process a deletion request for you, the account is deactivated at once and we keep its data for 90 days (for backups and compliance) before permanently purging it; deleted data then ages out of our backups within 35 days, so everything is gone within about 125 days of the deactivation. If an account is permanently banned, that 90-day clock doesn't start until any appeal is resolved or the appeal window has passed unused, so we can still show the record if the ban is appealed. For these accounts the legal acceptance record and the parent consent record are kept as described under "What we keep after a deletion".

See our Data Deletion Policy for the full steps.

11. Your rights

You can delete your account yourself in Settings (Section 10). You can also ask us to access, correct, or delete your personal data at any time by emailing [email protected]. Depending on where you live, you may have additional rights under laws like the GDPR or CCPA/CPRA. Contact us and we'll do our best to honor them even where not strictly required.

US state privacy rights. If you live in a US state with a privacy law, you can ask us to tell you what personal information we hold about you and to give you a copy, to correct it, and to delete it. You can also ask us to stop selling or sharing it or using it for targeted advertising; we do none of these, and we do not sell or share the personal information of anyone under 18. Email [email protected] from the address on your account (for a child's account, a parent can write), and we will check that it is you. We aim to answer within 45 days and, if we need more time, we tell you why. If we say no, you can reply with the word "appeal" and we will answer within 60 days and tell you how to contact your state attorney general. An authorized agent can make a request for you with your written permission. We do not treat you differently for making a request.

Personalization and profiling. You can switch off reminder personalization at any time by setting Reminders to Essentials only (Settings, Notifications). It does not affect any other feature. The estimate we hold is in your data export. The export also shows the three facts that counted most in each estimate. We make no decision about you with a legal or similarly significant effect from the estimate. If you are in the EEA or the UK you can object to this processing and we will stop it. Promo codes and free months: if we refuse a code or a free month because we think it has already been used, write to [email protected] and a person will review it. On request we can tell you whether a repeat-claim marker exists for you, but we do not export the hash itself.

12. Security

Passwords are hashed, not stored in plain text. Traffic to Cardvoo is encrypted in transit, and our servers tell browsers to use only encrypted connections. Google Classroom access tokens are additionally encrypted at rest (Section 6a). Sign-in is locked for 15 minutes after 5 wrong passwords, requests are rate limited across all our servers, and two-step sign-in with an emailed code is available on every account in Settings and is required for Cardvoo administrator accounts and for teacher accounts. No system is perfectly secure, but we take reasonable, industry-standard steps to protect your data.

12a. Our written security program

We keep a written security program of one page. We review it at least once a year and after any security incident. It names who is responsible (our founder, Bleart Emini, who is also the privacy contact in Section 15), and says that access to personal information is limited to the people who need it to run the service. It lists the protections in place: passwords stored hashed, encrypted connections, rate limits across all our servers, a lock on sign-in after repeated wrong passwords, two-step sign-in on every account that turns it on, and the vendors on our subprocessors page, each under a written agreement or online terms that Cardvoo has accepted. It says how we respond to a problem: we investigate, contain it, and tell the people affected and, where a law or an agreement requires it, the authorities and the school. It says when information is deleted (Section 10). This is a short description of our own practice. We do not hold a security certification (such as SOC 2 or ISO 27001), we have not had an independent security audit or penetration test, and we have not signed the Student Privacy Pledge. You can ask for a copy of the program by writing to the privacy contact.

13. Copyright / DMCA

For how we handle claims of copyright infringement in user-uploaded or user-generated content, see our Copyright / DMCA Policy.

14. Changes to this policy

We'll update the date at the top of this page whenever we make a meaningful change to how we handle your data.

Some changes need your agreement ("must accept") and others only need you to know ("notice only"). Most changes are notice only. We ask for your agreement only when a change takes something away from you, adds a rule or a duty you must follow, starts using your information in a new way that you cannot decline, changes who you are dealing with or how you are billed, or when a law or a vendor requires it. For a must-accept change, accounts aged 13 and over see a screen that explains what changed and must accept before they can keep using Cardvoo (you can still export your data, delete your account and sign out). For a notice-only change we show a notice that you can dismiss. For an account under 13, nothing is blocked for 30 days: we email the parent on day 0, day 7 and day 21 with a link (it works for 14 days) to read and accept, where they give their full legal name and confirm they are the parent or guardian. If no parent has accepted after 30 days the account is paused, with nothing deleted, until a parent accepts. A change that adds a new use of the information of an account under 13 does not apply to that account's information until a parent has accepted it. A person aged 13 or over accepts for themselves. For teachers, a must-accept change to the Teacher terms or the DPA acknowledgement pauses the Teacher Hub only.

We never edit a version after we publish it: a correction is a new version. We record which version each account accepted or was shown, the date, and who accepted (Section 1). We keep the full text of each published version and a fingerprint (a hash) of it, so you can read the version you accepted and we can show that it has not changed.

15. Contact

Privacy contact. Our privacy contact, for parents, for questions about a child's information and for every request in Sections 9, 10 and 11, is Bleart Emini, Cardvoo, 200 Greenville St Ste C, Newnan, Georgia 30263, United States, [email protected], telephone (678) 675-6808. A parent can ask there to see what we hold about a child, to have it deleted, or to withdraw consent and refuse any further collection.

Privacy and deletion requests, security reports and copyright notices: [email protected]. Operator: Bleart Emini, a sole proprietor, 200 Greenville St Ste C, Newnan, Georgia 30263, United States. If Cardvoo moves to a company owned by its founder, or to a new owner, that company becomes the operator on the date we announce on this page and in the app, everything in this policy keeps applying to it, and we tell you before the change takes effect. We give at least 30 days of notice when the new operator is a company owned by our founder. A new owner may not use information about a child under 13 in a way this policy does not describe without the parent's new consent. Service status: status.cardvoo.com.