Your study data stays yours.

Overview

This policy explains how NeuroCards handles personal data when you visit neurocards.net, use the application there, contact us or use a feature connected to the NeuroCards API.

Personal data means information that identifies you or can reasonably be linked to you. Study content can become personal data when it is stored inside your account, even if the subject of a card is not about you.

Who we are

NeuroCards is operated by [COMPANY NAME], a company registered in England and Wales under company number [COMPANY NUMBER]. Its registered office is [REGISTERED OFFICE ADDRESS].

[COMPANY NAME] is the controller of the personal data described in this policy. That means it decides why and how this data is processed. Privacy questions and rights requests can be sent to privacy@neurocards.net.

What personal data we collect

Account and profile information

• Your email address and display name.
• A profile image and provider identifier if Google supplies them when you choose Google sign-in, or a provider identifier and the name and email you choose to share when you choose Sign in with Apple. Apple may give us a private relay address in place of your email.
• Email-verification status, account tier, study preferences and account creation or deletion dates.

Authentication and security information

• Password hashes for password accounts; NeuroCards does not store readable passwords.
• Google or Apple authentication tokens where needed to keep that sign-in connected.
• Session identifiers, expiry times, IP address, browser or device user agent and short-lived verification codes.

Study information

• Folders, decks, cards, descriptions and any text you enter.
• Card scheduling state, review ratings, review dates, time spent thinking or reviewing and study-profile settings.
• Import, export and generation results that you choose to save in your library.

Messages and technical information

• Information you include when contacting the privacy address or requesting support.
• Request, delivery, security and error information processed by our hosting, network and email providers.

NeuroCards does not currently collect payment information, precise location, advertising identifiers or contact lists.

How we collect personal data

We receive data in three ways:

• From you, when you create an account, make study content, review cards, use generation or contact us.
• From Google or Apple, when you choose Google sign-in or Sign in with Apple and authorise it to provide basic account information.
• Automatically, when the service creates a secure session, saves review progress or records the technical information needed to deliver and protect the app.

Why we use personal data

If we introduce a use that requires consent, we will ask for it separately. We will not quietly repurpose your study data for advertising or unrelated profiling.

Optional AI card generation

AI generation is optional and runs only when an eligible user deliberately submits text, instructions or a PDF. The submitted material is sent through OpenRouter to an AI model, such as Anthropic's Claude models run by Google Vertex AI, so it can produce flashcards.

NeuroCards does not save the original submitted text or PDF in its active database. It saves the resulting deck or cards and a generation record containing operational details such as the model, status, token counts, card count, completion time and any generated notes or error message.

NeuroCards only sends material to AI providers with zero data retention: they process it to answer the request, then don't keep it or use it to train their models. PDFs are read by the model itself, not by another service first. Do not submit personal, confidential or copyrighted material unless you have a lawful reason and permission to use it.

Publishing and sharing

Display names, planned usernames, folders, decks and cards are private by default. NeuroCards does not currently make a deck public merely because you create it.

If NeuroCards makes publishing available and you deliberately choose Publish, the selected deck and cards, together with your display name and username, will become visible to other signed-in NeuroCards users. The publishing screen will explain this before anything is shared.

Other users may be able to import an independent copy into their own library under the licence described in the Terms of Service. Removing the original or deleting your account stops NeuroCards displaying the original listing, but copies already imported or lawfully redistributed may remain. Where reasonably practical, NeuroCards will remove the deleted account's profile link and replace its identity on copies we control with “Deleted user”.

Who processes data for us

We use a small number of providers to operate NeuroCards. They receive only the information needed for their role.

• Railway — application hosting and PostgreSQL database hosting, currently using a Netherlands region.
• Cloudflare — DNS, static-site delivery, caching, network security and related request metadata across its network. Cloudflare does not hold the NeuroCards account database.
• Resend — delivery of verification, sign-in, password-reset, email-change and redeem-code emails, currently using an Ireland email region.
• Google and Apple — identity information when you choose Google sign-in or Sign in with Apple.
• OpenRouter, and the AI model's provider: Microsoft Azure, Amazon Bedrock or Google Vertex AI — optional AI generation when you submit material to that feature, with zero data retention.
• Our mailbox provider — messages sent to privacy@neurocards.net.

Ireland and the Netherlands are in the EEA and are covered by UK adequacy regulations. Some providers operate globally. Where personal data is transferred beyond the UK to a place without an applicable adequacy arrangement, we rely on the provider's contractual safeguards or another lawful transfer mechanism.

We may also disclose information where required by law, to protect users or the service, or as part of a genuine corporate reorganisation where the recipient takes on the obligations in this policy.

Cookies and browser storage

NeuroCards does not use advertising cookies. It uses a secure authentication cookie and browser storage needed to provide the service you request, including:

• A theme preference.
• A minimal signed-in identity snapshot.
• Offline copies of account-specific API responses.
• A pending review queue used to safely retry offline saves.
• Cached application files used by the service worker.

This information remains on the device until NeuroCards clears it, the relevant cache expires or you clear the site's browser data. If we introduce non-essential analytics or advertising storage, we will update this policy and request consent where required.

How long we keep data

• Active accounts and study content: kept while the account remains active so the service can sync and schedule your cards.
• Scheduled account deletion: the account is disabled immediately and can be restored for seven days. It is then removed from the active application database with its sessions, sign-in methods, folders, decks, cards, reviews and generation records. If you used Sign in with Apple, we also ask Apple to revoke NeuroCards' access to your Apple ID.
• Empty unverified accounts: may be removed automatically after seven days.
• Verification codes: expire after ten minutes and are retained only as needed to complete or protect the relevant authentication flow.
• Provider logs and backups: limited residual copies may remain until overwritten under each provider's retention and security schedule.
• Privacy correspondence: kept only for as long as needed to answer the request, demonstrate compliance or resolve a related dispute.

Account deletion cannot recall published content that another person already copied under a continuing licence, although the original listing and profile are removed from NeuroCards.

How we protect data

NeuroCards uses encrypted network connections, secure session cookies, password hashing, access controls, verified-email gates and restricted production credentials. No online service can promise absolute security, but we aim to keep the data and access we hold proportionate to a focused study application.

You can help by using a unique password, protecting access to your email, Google or Apple account and signing out on shared devices. Contact us promptly if you believe an account has been compromised.

Children and the minimum age

You must be at least 13 to create or use a NeuroCards account. NeuroCards is designed with high-privacy defaults for everyone: content is private unless deliberately published, data collection is limited, and there is no advertising or behavioural profiling.

If you believe a child under 13 has created an account, contact privacy@neurocards.net so we can investigate and remove it where appropriate.

Your data-protection rights

Depending on the circumstances, UK data-protection law gives you rights to:

• access a copy of personal data we hold about you;
• correct incomplete or inaccurate data;
• request deletion of personal data;
• restrict or object to certain processing;
• receive eligible data in a portable format; and
• withdraw consent where processing relies on consent.

Many account details can be corrected or deleted directly in the app. For anything else, email privacy@neurocards.net. We may need enough information to confirm that the request concerns your account.

You may also complain to the Information Commissioner's Office, the UK data-protection regulator.

Changes to this policy

We may update this policy when the service, providers or law changes. The effective date at the top will change. We will give a clear in-app or email notice before a material change takes effect where that is appropriate.

We will review this policy before launching community publishing, payments, advertising, additional analytics or any materially different use of personal data.

Contact us