Privacy Policy
Last updated: October 2026
This policy explains what MemorizeCard collects, why, who it's shared with, and the control you have over it. Short version: we collect the minimum needed to run your account, we don't sell or advertise with your data, and you can delete everything at any time.
1. Information we collect
From Google Sign-In
When you sign in with Google, we receive your email address, name, and profile picture. We don't request access to your Gmail, Drive, Calendar, or anything beyond this basic identity information.
From a username account
If you make an account with a username instead, we keep your username and your password. The password is stored only as a salted hash, never as the password itself. Your recovery code is stored the same way. If you add an email address, we use it only to confirm it's yours, to send password reset links, and to let you sign in with it. If you turn on two-step sign-in, we keep the secret your authenticator app uses to make its codes.
Information you provide directly
| What | Why we have it |
|---|---|
| Decks and flashcards you create or import | The core function of the app; nothing works without this |
| Tests and the questions in them | Powers the Tests feature |
| Study progress ("known" / "needs review" status) | Powers the review-loop feature |
| Appearance settings (colors, card style) | Remembers how you've customized the app |
| An optional display name | Shown in the app instead of your Google name, if you set one |
| Suggestion or contact messages | To act on feedback or answer questions |
Collected automatically
Our hosting provider (Cloudflare) automatically logs basic technical information common to virtually all websites, things like IP address and request timing, for security and abuse-prevention purposes (for example, limiting how many messages one address can submit per day). We don't use this for tracking, profiling, or advertising.
2. How we use it
- To create and maintain your account
- To show your decks and cards back to you when you're signed in
- To remember your preferences between sessions
- To respond to suggestions or questions you send us
- To prevent spam and abuse (for example, rate-limiting repeated submissions)
We do not use your information for advertising, and we do not build profiles about you for any purpose beyond running the app itself.
3. Who we share it with
We work with a small number of service providers to run MemorizeCard. We don't sell your information to anyone, and we don't share it for advertising.
| Who | What they see | Why |
|---|---|---|
| Sign-in request only | Authenticating your account, if you sign in with Google | |
| Resend | Your email address and the message, only if you add an email to a username account | Sending email confirmation and password reset links |
| Cloudflare | All app data (decks, cards, settings) | Hosting and storage infrastructure, and the check on the sign-up form that stops automated sign-ups (Turnstile) |
| Web3Forms | The content of a suggestion or contact message, and a reply email if you choose to include one | Delivering that message to us by email |
We may also disclose information if required by law, or to protect the rights, safety, or property of MemorizeCard or our users.
4. Sharing decks with other people
MemorizeCard lets you share a deck by creating a link. Sharing is optional and nothing is shared unless you choose to share it. Decks are never browsable or searchable by other people; the only way someone reaches a shared deck is if you give them the link.
When you share a deck, whoever has the link can see everything in it: its name, description, and every card. Depending on the option you choose when sharing, they may also be able to take their own editable copy.
Two things worth understanding before you share:
- A copy someone takes is theirs. If you later stop sharing, delete the deck, or delete your account, copies other people already made stay in their accounts. We can't retrieve them.
- Reports are reviewed by a person. If someone reports a deck you shared, a copy of what you shared at that moment is stored and read by an administrator so the report can be assessed. That copy includes the deck's contents. It does not include anything the other person added to their own copy.
Don't put anything in a deck you'd be uncomfortable sharing, then share it. Once someone has a copy, it's out of your hands and out of ours.
5. How long we keep it
We retain your account data for as long as your account exists. If you delete your account, your decks, cards, tests, questions, study progress, settings, and account record are permanently and immediately removed. This isn't a soft-delete or a grace period; it's gone right away. The one exception: if sharing on your account was paused or turned off after reports, we keep a small record of that penalty under your email address, holding only the number of strikes and when any pause ends, so deleting and recreating an account can't be used to lift it.
6. Your rights and choices
- Access and correction: everything you've stored is visible and editable directly in the app at any time.
- Deletion: open Manage account then Delete my account to permanently remove your account and everything in it.
- Export: use the Backup feature in any deck or test to download your cards or questions as a file you control.
- Questions or requests: use the contact form below for anything not covered by the tools above.
7. Security
If you sign in with Google, your session is authenticated through Google's own sign-in system. If you use a username, your password is stored only as a salted hash, repeated wrong passwords pause sign-in to that account for 15 minutes, changing your password signs you out everywhere else, and you can turn on two-step sign-in so a code from your phone is needed as well. Administrative access to account data is protected by multiple layers, including two-factor authentication. No system is perfectly secure, but we take reasonable, genuine steps to protect your information rather than treating this as a formality.
8. Family and children's use
MemorizeCard is built to be usable by people of any age within a household, but every account is created and held by an adult: signing in with Google requires a Google account meeting Google's own minimum age requirements, and making a username account requires confirming that an adult, or a parent or guardian, is making it. MemorizeCard does not offer a separate way for a child to independently register or provide their own personal information (email, name, etc.) to us directly.
Children may use the app to study, for example on a family device signed into a parent or guardian's account, but that use happens under the adult's account and supervision. We do not knowingly collect personal information directly from children, and the account holder is responsible for any content added to their account and for supervising how it's used by others in their household.
If you believe a child has independently created their own account in a way that circumvents this, contact us and we'll remove it.
9. International users
MemorizeCard is hosted on Cloudflare's global infrastructure. If you're located outside the United States, your information may be processed in other countries as part of that infrastructure. If you're in a region with specific data protection rights (such as the EU, UK, or California), you can exercise them through the contact options in this policy, including access, correction, and deletion, all of which are also available directly in the app.
10. Changes to this policy
If this policy changes in a meaningful way, we'll update the date at the top of this page.
11. Contact us
Questions about this policy or your data? Send a message directly, no account needed.