CARVPrivacy Policy
Summary
The developer of CARV operates the CARV app and this website. CARV is the new name of the app formerly published as "Flash Card (암기카드)". You can use the app without an account; in that case your cards and study history stay on your device and are not sent to our servers. If you sign in, your cards are synced to our cloud so you can use them on several devices. We do not sell personal data.
The Korean version of this policy is the governing version for users in Korea.
Information we process
| Category | Data | When | Where |
|---|---|---|---|
| Account | Email address, sign-in method (Google, Apple, email), profile name | When you sign in | Supabase |
| Your content | Cards (front, explanation, extra info, tags), study history, settings, Hub deck download history | When synced after sign-in | Device, Supabase |
| Subscription | Subscription status, product ID, expiry, receipt validation data, AI credit history | When you subscribe or use credits | Supabase |
| AI input | Text you enter, images you pick, YouTube links and subtitles | When you generate cards with AI | Not stored after processing |
| App usage | Screens viewed, feature use, errors and performance, device and OS, approximate location (country/region) | Automatically while using the app | Firebase |
| Ads | Advertising ID (GAID/IDFA), ad impressions and clicks | When ads are shown | Google AdMob |
AI cards. When you create cards from text, an image or YouTube subtitles, that input and your card options (languages, card type) are sent through our server (Supabase Edge Functions) to the OpenAI API, and only the generated cards come back. The input is used only to create the cards and is not stored on our server. Data sent to the OpenAI API is not used to train OpenAI's models. This feature is optional.
Payments. We never receive card numbers or other payment details. Payments are handled by the Apple App Store or Google Play.
Device permissions (all optional): notifications, to show review reminders at the time you choose (scheduled on the device only); photos, to create cards from images you pick (the app does not browse your library). Siri and Shortcuts requests are handled by Apple. Home screen widget data stays on the device.
We use this data to run your account and sync, schedule reviews, generate the cards you ask for, manage subscriptions, fix crashes and improve performance, and show ads to free users. We do not use the content of your cards for marketing.
This website
This website is hosted on heremyapp, which runs on Cloudflare's global network. The hosting provider processes technical data such as IP addresses and request details, kept only for a short time. The website uses no cookies, analytics, or external fonts or scripts.
Sharing
We do not sell or share personal data with third parties except as required by law. These service providers process data on our behalf:
| Provider | Purpose |
|---|---|
| Supabase, Inc. | Authentication, data storage and sync, server functions |
| OpenAI, L.P. | AI card generation |
| Google LLC (Firebase) | Analytics, crash reporting, performance monitoring |
| Google LLC (AdMob) | Ads and ad measurement |
| Apple Inc. / Google LLC | In-app purchases |
| heremyapp (Cloudflare network) | Hosting this website |
Where data is processed
These providers operate servers outside your country, mainly in the United States, so your data may be transferred there. If you prefer not to, use the app without signing in and without AI features; your data then stays on your device.
Retention. Data on your device stays until you uninstall the app. Account and synced data is kept while your account exists and deleted without delay when you delete your account. After deletion, anonymized analytics and crash logs (up to 14 months / 90 days, kept by Google), payment records (kept by Apple and Google under commerce law, typically 5 years) and server security logs (up to 90 days) remain for the stated periods and cannot be linked back to you.
Your rights
You can ask to access, correct, delete, or stop the processing of your personal data at any time.
- Delete your account: in the app, Settings → Account → Delete Account removes your account and server data immediately. If you can't use the app, email dev.shellednuts@gmail.com from your account's email address; we confirm it's you and finish within 7 business days. See account deletion.
- Export: Settings → Export backup saves your cards and history to a file.
- Ad personalization: iOS Settings → Privacy & Security → Tracking; Android Settings → Google → Ads. Premium subscribers see no ads.
- Notifications: turn them off in the app's settings or your device settings.
Children
We do not knowingly collect personal data from children under 14 in Korea or under 13 elsewhere. If you believe a child has given us personal data, contact us and we will delete it.
Security
We use encryption in transit (TLS) and at rest, row-level security that keeps each user's data separate, minimal and controlled server access, and keep API keys on the server, not in the app.
Contact
Privacy officer: 정호준 (Jeong Hojun), the developer of CARV — dev.shellednuts@gmail.com
Changes
We will announce changes in the app or on this page with a new effective date, and important changes at least 7 days in advance. October 15, 2026: moved this policy to this website, unified the contact address, and added Hub deck download history and website hosting. Previous version effective September 16, 2026.