Privacy policy

Who we are

Card Reps is operated by Walking Forest LLC, a Florida limited liability company (“Walking Forest”, “we”, “us”). This policy explains how we handle personal information when you use the Card Reps website at cardreps.com, the Card Reps mobile apps, and related services (the “Service”). For users in the European Economic Area (EEA) and the United Kingdom, Walking Forest is the “controller” of your personal data.

This policy is part of our terms of use. You can reach us about anything in it at cardreps@walkingforeststudio.com.

Information we collect

Information you give us

• Account details: your email address, password, first and last name, and username. If you sign in with Google or Apple on the website, we receive your email address and basic profile details from them, but not your Google or Apple password.
• Your content: the decks and cards you create or import, their titles and descriptions, whether each deck is public or private, and the images you add to cards with their descriptions.
• Text for AI card generation (Pro): the text you choose to generate cards from. See AI card generation.
• Settings and preferences: such as your daily goal, reminders, time zone, profile visibility, and study and deck settings.
• Reports and appeals: if you report a public deck or appeal a moderation decision, the reason and any note you write.
• Messages to us: if you use the contact form, your name, email address, topic, and message.

When you import a file or generate cards from a document, the file is read on your device and only the resulting cards or text are sent to us.

Information created as you use Card Reps

• Study activity: your reviews (which card, your rating, when, and how long it took), and the schedule, streaks, and statistics we calculate from them.
• AI generation records: your generation requests, the cards suggested, how much AI usage each one used, and changes you make to generated cards soon after creating them, which we use to improve card quality.
• Subscription status: whether you have Pro, your plan, which store you bought it through, and when your subscription started, renews, or ended. We receive this from our subscription provider; we never receive your full payment card details.
• Consent records: which version of these terms and this policy you accepted, when, and how, and in some cases basic details about your browser.
• Technical information: your IP address, basic device and request details, and error reports when something breaks, used to keep the Service secure and working.

We don’t collect your precise location (we remove location details from images you add), contacts, or advertising identifiers, we don’t access your photos except the ones you choose to add to a card, and we don’t ask for your date of birth.

How we use information

We use personal information to:

• create and run your account, and sync your decks and progress across your devices;
• schedule your reviews and show you your statistics, streaks, and reminders;
• generate cards with AI when you ask us to, and keep AI usage within plan allowances;
• process your Pro subscription and apply the right plan limits;
• show your public profile and public decks to others, if you choose to make them public;
• keep the Service safe: preventing abuse and spam, reviewing reported decks, and enforcing our terms;
• fix bugs, monitor errors, and improve the Service, including the quality of AI-generated cards;
• send you service messages, such as sign-up confirmation, password reset, and moderation notices; and
• comply with the law and respond to lawful requests.

We don’t send marketing email, we don’t sell personal information, we don’t share it for targeted advertising, and we don’t use your content to train third-party AI models.

Legal bases (EEA and UK)

• Performing our contract with you — running your account, your study, AI generation, and your subscription.
• Legitimate interests — security, abuse prevention, moderation, error monitoring, and improving the Service. We balance these against your rights, and you can object (see your rights).
• Consent — for example, making your profile public, and device notifications for reminders. You can withdraw consent at any time in settings.
• Legal obligation — for example, keeping records we’re required to keep and responding to lawful requests.

What other people can see

Your profile is private by default. While it’s private, other users can’t open your profile page, and your name isn’t shown on any public decks you publish.

If you make your profile public, anyone, including people without an account, can see your first and last name, username, when you joined, your totals (decks, cards, and reviews), and your public decks.

Your decks are private by default. If you make a deck public, anyone can see its title, description, and cards, it can appear in Explore and in search engines, and signed-in users can follow or copy it. Copies people make, and the decks of people already following yours, stay with them if you later make the deck private or delete it. Reports you make are not shown to the deck’s owner as coming from you.

Card images are never public. Only you can see them, and our staff if we need to investigate a report.

How we share information

We share personal information only with service providers that help us run Card Reps, under contracts that limit how they can use it, and only as much as each one needs:

• Supabase — sign-in, account security, and our database. Stores your account and the data described above, and sends sign-in emails such as sign-up confirmation and password reset.
• DigitalOcean — hosts the servers that run Card Reps and stores card images. Your browser or the app loads images directly from DigitalOcean, so it also receives your IP address.
• Google (Gemini API) — receives the text you submit for AI card generation, and the draft cards made from it, to generate and refine cards. See AI card generation.
• RevenueCat — manages Pro subscriptions across the App Store, Google Play, and the web. It receives an account identifier (not your name or email from us), your purchase and subscription information, and basic device and network information such as IP address. Web purchases are processed by RevenueCat’s payment processor, which receives the payment details you enter at checkout.
• Apple and Google — if you subscribe through the App Store or Google Play, or sign in with Apple or Google, they process that purchase or sign-in under their own privacy policies.
• Resend — delivers the other emails we send, such as moderation notices, and your contact-form messages to us.
• Sentry — receives error reports from our website and servers. These contain technical details about the error, such as browser and device type and the page involved, and sometimes an account or deck identifier.

We may also disclose information:

• if required by law, or to respond to valid legal process such as a court order;
• to protect the safety, rights, or property of our users, the public, or Walking Forest;
• as part of a merger, acquisition, or sale of assets, in which case this policy will continue to apply to your information, and we’ll tell you before it becomes subject to a different policy; or
• with your permission.

AI card generation

When you generate cards from a document, the text is extracted on your device and only that text is sent to us. The file itself is never uploaded. We send the text to Google’s Gemini API to generate and refine cards. Under Google’s terms for the paid Gemini API, Google doesn’t use this content to improve its products, though it may keep it for a limited period to detect abuse.

We don’t keep the submitted text: it’s deleted within a day after generation ends, whether or not it succeeds. The suggested cards are deleted about 30 days after generation, whether or not you added them to a deck. Don’t submit text that contains other people’s personal information or that you aren’t allowed to share.

Cookies and on-device storage

Website: we use only the cookies needed to keep you signed in. We don’t use advertising or analytics cookies, so there’s nothing to opt out of. Your browser also stores a few preferences, temporary data for your current study session, and copies of card images you’ve viewed.

Mobile apps: the app stores some data on your device, such as your sign-in session and a copy of your recent study data, so it works offline and picks up where you left off.

Because we don’t track you across other websites or apps, we don’t respond differently to “Do Not Track” signals; there is no cross-site tracking to turn off.

How long we keep information

We keep personal information only as long as we need it:

• Your account, content, and study history: for as long as your account exists, then deleted as described in deleting your account.
• Text submitted for AI generation: within a day after generation ends. Suggested cards: about 30 days after generation.
• Card images: images you remove from a card are deleted after 7 days, and uploads you never add to a card after 24 hours.
• Security and sync records: IP addresses we use to protect the Service are deleted within an hour, and records used to sync your offline reviews after about five weeks.
• Copies of emails we send (such as moderation notices): 90 days after sending, or until we resolve a message that couldn’t be delivered.
• Contact-form messages: kept in our email inbox as long as needed to answer you and keep a record of the conversation.
• Error reports: kept by Sentry for up to 90 days.
• Moderation records: reports, a copy of the reported deck, and the actions we took are kept after the accounts involved are deleted, to handle appeals, spot repeat abuse, and meet legal obligations. Once the reporter’s account is deleted they’re no longer linked to it, but they keep the reported deck’s contents and its owner’s username and account identifier. Card images a report relies on are kept, visible only to staff, until the report is resolved.
• AI usage totals: kept for cost and capacity records, no longer linked to you once your account is deleted.

Apple, Google, and RevenueCat’s payment processor keep their own purchase records as their policies and the law require.

Deleting your account

You can delete your account at any time from account settings on the web or in the app. If you have an active Pro subscription, you need to cancel it first, and you can delete your account once the paid period you’ve already been charged for has ended. Deleting your account doesn’t cancel billing with Apple, Google, or the web checkout, so cancel it through the store or portal you subscribed through, or you will keep being charged.

When you delete your account, we deactivate it immediately: your public profile and public decks are hidden, and you can no longer use the app normally. If you sign back in within 30 days, you can restore your account from account settings, with everything intact.

If you don’t restore it, your account is permanently deleted 30 days after you asked: your sign-in details, profile, content, card images, study history, settings, AI generation records, and consent records are erased, and we ask RevenueCat to delete its record of you. People following your public decks keep their own copy, as described in what other people can see. The exceptions are moderation records, AI usage totals no longer linked to you, and copies of emails we sent you, as described above. Deleted data may remain in our providers’ backups for a limited time until those backups are overwritten.

Your rights and choices

Wherever you live, you can:

• see and correct your account details, and change your profile and deck visibility, in settings;
• turn reminders on or off in settings, or in your device’s notification settings;
• delete your account at any time from settings; and
• email us at cardreps@walkingforeststudio.com for a copy of your personal information or with any privacy question.

EEA and UK

You have the right to access, correct, delete, or receive a portable copy of your personal data; to restrict or object to how we use it (including processing based on our legitimate interests); and to withdraw consent at any time. You also have the right to complain to your local data protection authority. We’d appreciate the chance to address your concern first.

United States

Depending on your state, you may have the right to know what personal information we hold about you, to access, correct, or delete it, to receive a copy, and to opt out of its sale, its use for targeted advertising, or profiling. We don’t sell personal information, share it for targeted advertising, or use it for profiling that produces legal or similarly significant effects. We won’t discriminate against you for exercising your rights.

Making a request

Email cardreps@walkingforeststudio.com from the address on your account. We may need to confirm your identity before we act. We’ll respond within 30 days (or sooner if your local law requires), and tell you if we need more time. An authorized agent can make a request for you with proof of authorization. If we decline a request, we’ll explain why, and you can appeal by replying to our answer.

Children

Card Reps isn’t directed at children under 13, and you must be at least 13 (16 in the EEA and UK) to create an account. We don’t knowingly collect personal information from children under those ages. If you believe a child has given us personal information, contact us at cardreps@walkingforeststudio.com and we will delete it.

Security

We protect your information with encryption in transit, access controls that limit each account to its own data, and restricted administrative access. No service can guarantee perfect security. If we learn of a breach that affects your personal information, we’ll notify you and the authorities as the law requires. Please use a strong, unique password.

International transfers

Walking Forest is based in the United States, and our service providers may process your information in the United States and other countries whose data protection laws may differ from yours. When we transfer personal data from the EEA or UK, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses and the UK addendum to them, or a provider’s certification under the EU-U.S. Data Privacy Framework.

Changes to this policy

We’ll update this policy when our practices change, for example when we add a new service provider. The effective date at the top shows when the current version took effect; it changes only when we make a material change. The last revised date shows the most recent edit of any kind, including wording changes that don’t change our practices. If a change is material, we’ll tell you in the app or by email before it takes effect.

Contact

Walking Forest LLC, Florida, USA. Privacy questions and requests: cardreps@walkingforeststudio.com. You can also reach us through the contact form.