Privacy Policy
Controller
[Name]
[Street and number]
[Postcode and city], [country]
Email: [email address for privacy requests]
What Cardex is
Cardex is a flashcard app. You can use it without an account; then all your decks, cards and study progress stay on your device and we receive nothing. With an account, your data is synced between your devices and can be shared with other users.
Data we process
Account. When you register, we store your email address, a hash of your password and, if you enable it, your two-factor authentication settings. We use them to sign you in, to verify your email address and to let you recover your account. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
Decks, cards and study progress. With an account, the decks and cards you create, the images you attach and your study progress (when you reviewed which card and how) are stored on our servers and synced to your devices. Decks you share are visible to the people you share them with; your study progress is never visible to others. Legal basis: Art. 6(1)(b) GDPR.
Crash reports. When the app crashes or hits an unexpected error, it sends a report with the error, the app and system version and the device model to our own crash reporting server (GlitchTip). Reports contain no account, email or IP address and no card content. They are deleted after 30 days. Legal basis: our legitimate interest in a working app (Art. 6(1)(f) GDPR).
Server logs. Our servers log technical data of requests (time, endpoint, status, IP address) to operate and secure the service. They are deleted after [retention period of server logs]. Legal basis: Art. 6(1)(f) GDPR.
We do not use analytics, advertising or tracking, and we do not sell data. This website sets no cookies and loads nothing from third parties.
Where your data is stored
All data, including crash reports and the images you attach, is processed on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in data centres in Germany. Hetzner processes it on our behalf under a data processing agreement (Art. 28 GDPR). Emails for verifying your address and recovering your account are sent through IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, also under a data processing agreement.
How long we keep data
- Account and synced data: until you delete them or your account.
- Deleted decks and cards: removed from our servers 90 days after you delete them, so that your other devices can apply the deletion.
- Crash reports: 30 days.
- Backups: [backup retention period].
Deleting your account
Settings › Delete account deletes your account immediately. Your study progress, your preferences and the decks only you can edit are deleted. Decks you shared with editors pass to the editor who joined first, so their work is not lost; decks shared only with viewers are deleted for them too. Images you added to other people's decks stay part of those decks. Data in backups is overwritten within [backup retention period].
Your rights
You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Settings › Export my data gives you a copy of all your data. For other requests, write to [email address for privacy requests]. You can lodge a complaint with a supervisory authority, for example [competent supervisory authority].
Changes
We will announce material changes to this policy in the app.