Cardvoo subprocessors

OpenRouter (routing to DeepSeek, OpenAI, Qwen and Google models)

Cloud AI for writing cards and distractors, grading, study guides, practice exams, podcast scripts, deck title and tag suggestions (paid plans), diagram drafts (paid plans), class practice decks and guides built from a class's weak topics, unit plans and their differentiated versions for teachers, AI feedback drafts on students' written answers for a teacher to approve, the definitions of official party packs, checking Prompt Deck cards against sources, reading Snap & Occlude photos, moderation checks, answering Ask, Class Ask and class tutor questions on the cloud path, and Free-plan cloud fallback decks (text deleted right after the run).

Data: Deck and note text, card text, a short sample of a deck's text for suggestions (at most 1,500 characters), diagram content (a diagram's topic and the text of the cards picked for it), topic names and card or guide text from class results (never student names, emails, scores or answers, and never Class Ask text); for unit plans, the teacher's description, goals, standards codes and materials the teacher includes; for AI feedback, the question, the teacher's answer key or rubric, a source passage and the student's written answer text (after we remove email addresses, phone numbers and the student's class name where we can detect them, and never the student's name or email; sent only when a teacher has turned AI feedback on for the assignment), photos sent for Snap & Occlude, written answers and prompts sent for a request. Card writing goes first to an OpenAI model and falls back to DeepSeek; the same text is sent to either one. For Ask, Class Ask and class tutor answers on the cloud path: the question, the few passages needed and the recent messages of that chat (never a name or email; the practice-material requests above never include Class Ask text). Not account identity. Nothing from an account under 13 for an AI feature, except automatic safety checks.

Agreement: Written agreement or accepted online terms. Does not train on your data: stated in the terms of the hosts named above. Cardvoo does not control or verify what a host does.

Reaches, through this vendor: DeepSeek (A company based in China; model provider reached through OpenRouter: general text tasks and card-writing fallback.); OpenAI (Based in the United States; card-writing model reached through OpenRouter.); Qwen (Alibaba's models, a company based in China; model provider reached through OpenRouter: checking cards against sources and reading Snap & Occlude photos.); Google (Based in the United States; Gemini model reached through OpenRouter: fallback for reading Snap & Occlude photos.)

OpenRouter, not Cardvoo, selects the company that hosts the model for each request.

Every request asks OpenRouter to route only to hosts that state they do not store or train on the data (`data_collection: deny`). That is a request: OpenRouter, not Cardvoo, selects the host that runs each request, Cardvoo does not know in advance which host or country that will be and has not seen each host's agreement, and OpenRouter's own terms say it does not train on this data. Two settings in Cardvoo's own code can switch requests back to OpenRouter's default routing (one for all requests, one for the model that reads photos); both are kept off, and this list is updated before either is used. School controls: Until Cardvoo offers the school administrator view, a Cardvoo administrator can, at a school's written request, switch cloud AI off for all of that school's teachers and students (on-device AI only) and, when Cardvoo offers it, move that school to a US-developed model (for example an Anthropic Claude Haiku model reached through OpenRouter). Neither setting applies to a school until Cardvoo has confirmed the request in writing. After Cardvoo offers that view, the school's administrator can set both. Automatic safety checks, such as the check of a deck before it is made public, are not switched off by either setting.

fal.ai

Text-to-speech for podcasts and Walk & Recall, speech-to-text grading of spoken answers, and image tools.

Data: Podcast script text, card text for speech, and spoken-answer audio (audio is never stored by Cardvoo, only the transcript).

Agreement: Written agreement or accepted online terms. Does not train on your data: stated in the vendor's terms. Cardvoo does not control or verify what the vendor does.

Reaches, through this vendor: Google (Gemini) (Text-to-speech for podcasts and the Walk & Recall fallback voice.); xAI (Primary Walk & Recall text-to-speech voice.); ElevenLabs (Speech-to-text (Scribe v2) for spoken-answer grading.)

The downstream providers have no direct relationship with users; Cardvoo's agreement with fal.ai governs the data.

Resend

Sending email: sign-in and verification codes, account and billing notices (price and plan changes, the reminder before a price change, free month or pause ends, failed-payment and renewal reminders, welcome-back offer emails), reminder emails a user turned on, win-back email to adults (when enabled), getting-started email after sign-up and weekly recap email, both to adults only (when enabled), teacher decisions and class invitations, and replies to school inquiries.

Data: Recipient email address, and the message content (for invitations: the teacher's name, the class name). For feedback notices to Cardvoo's own support inbox: the feedback answer, note, the moment it was asked and the plan, never the sender's name or email address.

Agreement: Written agreement or accepted online terms. Does not train on your data: stated in the vendor's terms. Cardvoo does not control or verify what the vendor does.

Google Workspace (Google LLC)

Email hosting for Cardvoo's support inbox: receive and answer email sent to [email protected] and other Cardvoo addresses.

Data: The content of messages people send to Cardvoo and their email address, including feedback notices, support requests, deletion requests and replies to Cardvoo's own emails. Cardvoo does not send this mailbox's contents to any AI model. Students never sign in with Google and no student data is sent to this mailbox by Cardvoo; a teacher or parent who emails support chooses what to send.

Agreement: Written agreement or accepted online terms. No-training terms: Not applicable

Located in the United States and other Google data centers.

Google Classroom

Optional, teacher-initiated import of a class roster and return of grades to Classroom.

Data: Only what the teacher chooses to push: roster names and email addresses are READ from Classroom; Cardvoo-created coursework carries a title, description, due date and a link; grades are the numeric grade only. Never student answers, and nothing at all for under-13 accounts. Students never sign in with Google.

Agreement: Written agreement or accepted online terms. Does not train on your data: stated in the vendor's terms. Cardvoo does not control or verify what the vendor does.

Available once the Google OAuth client is configured and verified; CSV import and export always work without it.

Stripe

Payments and subscriptions (Standard, Pro, Educator) and student-discount checkout; promo codes, referral free months, welcome-back offers and price changes to existing subscriptions; pausing and restarting subscriptions; retrying failed payments and updating replaced or expired cards through the card networks (card account updater).

Data: Billing email, payment details entered into Stripe (never seen by Cardvoo), subscription status, the promo code entered and referral status; Stripe returns a card fingerprint and the card's last four digits and expiry to Cardvoo.

Agreement: Written agreement or accepted online terms. No-training terms: Not applicable

Only the account holder's own billing is sent. No class content or student data.

Cloudflare

Hosting the web app (Pages), the status page, CDN, and object storage (R2) for uploads and generated files.

Data: Web requests, uploaded files and images, generated audio and PDFs.

Agreement: Written agreement or accepted online terms. No-training terms: Not applicable

Cloudflare Workers AI

Three narrow jobs. (1) A safety pre-screen (Cloudflare's Clef-flash model) that checks a deck's title and card text before a deck goes public. (2) Embeddings (the bge-m3 model) that help Ask anything find the right passages in a paid account's own study material. (3) A quick check of some typed practice answers for adult accounts that are not in a class.

Data: For the pre-screen: the deck title and card terms of a deck being made public. For embeddings: the question and the study-material passages of a Standard, Pro or admin account using the cloud Ask path. Not account identity. Free-plan and on-device questions are never sent to it. A class's material (its decks, guides, assignments, answers, results and roster) and Class Ask questions are never sent. The one teacher text that is sent is the text of a unit that a teacher chooses to share with other teachers, read once for the safety pre-screen when it is shared; it holds no student data. For grading: to check some typed answers faster, the question, the expected answer and the answer (no name or email) of an account aged 18 or over that is not in a class. Never sent for an account under 18, a student in a class, or a spoken answer.

Agreement: Written agreement or accepted online terms. Does not train on your data: stated in the vendor's terms. Cardvoo does not control or verify what the vendor does.

Used under Cloudflare's agreement, which does not allow the content to be used to train models. Embedding results are kept as numbers (vectors) for 90 days and are deleted with the account. If Workers AI is unavailable, Cardvoo falls back to keyword matching or its other moderation route.

Fly.io

Running the Cardvoo API, on machines in the United States (Ashburn, Newark and Chicago).

Data: All data processed by the API in transit and in memory.

Agreement: Written agreement or accepted online terms. No-training terms: Not applicable

MongoDB Atlas

The database that stores accounts, decks, classes and grades, in a cluster in the Ashburn, Virginia region of the United States.

Data: All stored account and study data.

Agreement: Written agreement or accepted online terms. No-training terms: Not applicable

Sentry

Error and performance monitoring.

Data: Error reports and technical details from the app and API; Cardvoo scrubs content where it can.

Agreement: Written agreement or accepted online terms. No-training terms: Not applicable

Google AdSense

Display ads on the cardvoo.com free tier.

Data: Ad requests from the browser, always non-personalized with restricted data processing. Under-13 accounts, teachers, Educator subscribers, the Teacher Hub and every account that is a member of a class never load ads, on any page; accounts aged 13 to 17 get requests tagged as under the age of consent.

Agreement: Written agreement or accepted online terms. No-training terms: Not applicable

Not shown today (the ad display is switched off). Never used inside the Teacher Hub or for any member of a class.

Unsplash

Searching and attributing stock photos for cards, guides and deck covers.

Data: The image search term the user typed, the photo the user picked, the request that tells Unsplash which photo was chosen (the photo id only), and the IP address and browser details of any person aged 13 and over who is logged in, outside a class and not a teacher, whose browser loads a cover photo.

Agreement: Written agreement or accepted online terms. No-training terms: Not applicable

Class accounts (students and teachers) and accounts under 13 never load a cover.

Companies that receive a child's information (accounts under 13)

For an account under 13, only the companies in this table receive the child's information. Each is a vendor in the main list above, runs part of Cardvoo for us as a service provider, and is used under a written agreement or online terms that Cardvoo has accepted. We give a child's information to none of them for its own use. No advertising company, payment company or photo service receives information from an account under 13, and the only AI providers that read text from an account under 13 are OpenRouter and Cloudflare Workers AI, for automatic safety checks only (last row). We update this table before a new company receives a child's information, and a new use waits for a parent to accept (Privacy Policy, Sections 9b and 14).

Fly.io: Everything the account sends to our servers, in transit and in memory (Runs the Cardvoo API in the United States)

MongoDB Atlas: The account's stored data (account, decks, study records, parent consent record) (Database in the United States)

Cloudflare: Web requests and files the account uploads or that are made for it (Hosts the app, delivers pages and stores files)

Resend: The parent's email address and the content of the emails to the parent (consent, the follow-up email, deletion and contact-change links) (Delivers email)

Sentry: Technical crash reports with no account or user ID (Finds and fixes bugs)

OpenRouter and Cloudflare Workers AI: Text for an automatic safety check only (for example a chosen username, or the title and cards of a deck before it is made public). OpenRouter passes it to a model host that it chooses; Cardvoo has no agreement with that host and relies on OpenRouter's terms and settings (Keeps the service safe)

Google Workspace: Only what a parent or a child writes to our support inbox (Support email)

Public services your browser or our servers contact

These are public services and not vendors that process data for Cardvoo. Cardvoo has no agreement with them. Each one sees only what is listed.

Hugging Face (huggingface.co): contacted by Your browser; sees Your IP address and browser details, as for any download; no study content or account details; When you turn on on-device AI and download a model.

GitHub (raw.githubusercontent.com): contacted by Your browser; sees Your IP address and browser details; no study content or account details; When you download the runtime library for a larger on-device model.

jsDelivr (cdn.jsdelivr.net): contacted by Your browser; sees Your IP address and browser details; Only if the copy of the Safari and iPhone runtime on cardvoo.com cannot be loaded.

Wikipedia, PubMed, Crossref: contacted by Our servers; sees A short search query made from a card's wording; never your name, email or account details; When a Prompt Deck's uncertain cards are checked against sources.

Google Funding Choices: contacted by Your browser; sees Your IP address and browser details; Only where a consent message for ads can be shown to visitors in the European Economic Area, the United Kingdom and Switzerland.