Privacy policy

Last updated: October 10, 2026.

The short version

• Chickadee works without an account. Used that way, your decks, cards, recordings, photos and study history stay on your device, and nothing you study is sent to us.
• If you create an account, we keep your email address. If you also turn on sync (Premium), we keep a copy of your decks and study history so they can reach your other devices.
• The free plan in the iPhone and Android apps can show a small ad from Google AdMob. Ads are never shown to people under 13 or to Premium users. On iPhone, ads are personalized only if you allow tracking.
• We don’t sell your personal information, and the app has no analytics or crash-reporting tools.
• You can delete your account and its data at any time in the app, or by asking us (how to delete your account).

Using Chickadee without an account

Decks, cards, audio you record, photos you add, review history, settings, your age group and your privacy choices are stored on your device (in the app’s storage). We can’t see them. Backups and exports are files you save or share yourself. Deleting the app (or clearing the website’s data in your browser) deletes this data, so keep a backup.

Microphone, camera and photos

The app asks for the microphone only when you tap Record on a card, and for the camera or your photo library only when you add a picture to a card. Recordings and pictures are saved with that card on your device. They leave your device only if you turn on sync (below). The app doesn’t read any other photos and never records in the background.

Starter decks and our websites

When you browse or add a starter deck, the app downloads it from our web host, Cloudflare. Like any web server, Cloudflare processes your IP address, the time and your browser or app version to deliver the files and protect against abuse. We don’t use this to identify you. [To be confirmed: how long Cloudflare keeps request logs for our account.] The same applies when you visit our website or use the web app.

The recorded audio in some starter decks was made in advance with Microsoft Azure text-to-speech. Only our deck text was sent to Azure; none of your data is.

Your account (optional)

You can create an account in Settings → Account. We keep your email address and an account id. If you sign in with Apple or Google, we also receive an id from them and, from Google, your name [to be confirmed when Google sign-in launches]. Sign-in codes are emailed through our email provider, Resend. Accounts are run on Supabase, our database and sign-in provider.

Sync and cloud backup (Premium)

If you are signed in and have Premium, the app copies your decks, templates, cards, notes, review history, the audio and pictures on your cards, and a few study settings to our Supabase database and file storage, linked to your account, so they can sync between your devices and be restored. Only you (signed in) can read them. Data is encrypted in transit (HTTPS).

Card reports

If you report a problem with a card in one of our starter decks while signed in, we receive the reason, your note (up to 500 characters), which deck and card it is, and your account id, so we can fix the card. Reports made while signed out, and reports about your own decks, stay on your device.

Purchases

• In the iPhone and Android apps, Premium is bought through the App Store or Google Play. Apple or Google handle the payment; we never see your card details. RevenueCat, our purchase provider, receives your purchase history and receipts and an id (your account id if you are signed in, otherwise a random one) so Premium works on your devices.
• On the web, Premium is bought through Stripe. You enter your payment details on Stripe’s page; we keep only the Stripe customer and subscription ids and the plan.

Ads (free plan in the apps)

The free plan in the iPhone and Android apps shows one small banner from Google AdMob on list screens: never while you study, never in your first three days, never to Premium users, and never to people who are under 13 or didn’t give their age (for them, the ad code isn’t used at all).

• When ads are shown, Google’s ad software collects device identifiers (on iPhone, the advertising identifier only if you allow tracking; on Android, the advertising ID and app set ID), an approximate location based on your IP address, how you interact with ads, and diagnostic data. Google uses this to show ads, measure them and prevent fraud, under Google’s policies.
• On iPhone, the app explains first and then shows Apple’s App Tracking Transparency prompt. If you don’t allow tracking, ads are not personalized.
• In the EU, the EEA, the UK and Switzerland, Google’s consent form asks you first. You can change your choice any time in Settings → Privacy → Ads and analytics.

The website and web app show no third-party ads.

Who processes data for us

• Supabase: accounts, sync and card reports (database and file storage).
• Resend: sign-in emails.
• Cloudflare: hosting of the website, the web app and the starter decks.
• RevenueCat: App Store and Google Play purchases.
• Stripe: web purchases.
• Google AdMob: ads in the free plan of the apps. Google also uses this data for its own purposes, as described above.

[To be completed: where each provider stores data (regions) and the transfer safeguards, such as the EU Standard Contractual Clauses.]

How long we keep data, and deleting it

• Delete account (Settings → Account → Delete account) deletes, right away, your account, everything synced to it (decks, cards, review history, audio and pictures), your card reports and your Premium record on our servers. The copy on your device stays until you delete the app. A web (Stripe) subscription is canceled first. An App Store or Google Play subscription is not: cancel it in your Apple or Google account.
• Without the app, email us from the address on your account (see Delete your account). We delete it within 30 days.
• While your account exists, we keep synced data until you delete it. Records of deleted cards are kept for at least 90 days so your other devices can catch up; media no longer used by any card is removed after 7 days.
• Our providers’ backups are overwritten on their own schedule [to be confirmed: Supabase backup retention]. Purchase and payment records are kept by Apple, Google, Stripe and RevenueCat as the law requires (for example, for taxes).

Children

When you first open the app, it asks for your year of birth. Only the result (13 or older, or under 13) is kept, on your device; the year itself isn’t saved or sent. If you are under 13, or don’t say, the app shows no ads and nothing is personalized. Chickadee is meant for people 13 and older; if you think a child under 13 has created an account, contact us and we will delete it. [To be reviewed: COPPA, GDPR-K and the app stores’ age requirements.]

Your rights

You can see and export your data in the app (backups and deck exports), correct it by editing your cards, and delete it as described above. Depending on where you live (for example, the EU, the UK or California), you may also have the right to ask what we hold about you, to object, or to complain to a data-protection authority. Contact us to use these rights. [To be completed by legal review: legal bases, controller details, representative.]

Contact

[email protected]. [Postal address of the company to be added.]

Changes

We will update this page when the app changes how it handles data, and say so in the app before a change that affects data you have already given us.