Privacy Policy

1. Who runs BrainCards

BrainCards (the "Service", at braincards.app) is run by Anton Kurnosov, an individual based in Armenia. For anything about your data, write to [email protected] or use the Contact Support page in the app when you are signed in.

This policy says what the Service does with your data today. When the Service changes, this page changes with it — see section 8.

2. What we collect, and why

Your account. Your email address (the only thing we require), your password (stored only as a hash, never in clear), and — if you choose to fill them in — your name, interface language, time zone and avatar. We use them to run your account, sign you in and send you the emails the account needs (address confirmation, password reset, sign-in codes, account deletion notices). Basis: our agreement with you (the Terms of Service).

Your learning content. The cards you create or import, their tags and comments, your exercise sessions and results. This is the Service. Basis: the agreement.

Your onboarding answers. When you first sign in you answer a few questions — the languages you learn, your level, the topics you like. These answers, and nothing else about you, are sent to a third-party provider of AI language models to generate your first set of cards. Basis: the agreement. The cards it writes can contain mistakes.

Technical records. The IP address and time of your sign-up and of each sign-in, and the language and time zone your browser reported when you signed up. We keep them to protect accounts, to apply the usage limits and to stop automated abuse. Basis: our legitimate interest in keeping the Service secure.

Support messages. What you write to us through the Contact Support page, so that we can answer you. Basis: the agreement.

Usage statistics. Which pages are viewed and a few steps people take — a sign-up button pressed, the onboarding finished, an exercise finished, a file handed over for import, an achievement shared — counted by the Service itself (section 3). Basis: our legitimate interest in learning which parts of the Service help people learn.

We do not collect data about you from other sources, we do not profile you, and we do not send marketing emails.

3. Cookies and browser storage

The Service sets only what it needs to work:

• a session cookie, so you stay signed in while you use the app (the session ends after 7 days of inactivity);
• a remember-me cookie, set when you sign in, so you stay signed in on this device for up to a year;
• browser local storage for your preferences on this device: the colour theme and exercise settings.

The sign-up and password-reset pages are protected by Google reCAPTCHA, which tells people from bots. On those two pages Google receives technical data about your browser and connection and may set its own cookie; the Google Privacy Policy and Terms of Service apply to it.

There is no advertising on the Service. Page views of the public pages and the steps listed in section 2 are counted by the Service itself, on our servers; nothing is stored in your browser for it and no cookie is set. A record holds the page's path (without its query string, numbers and ids replaced), the other site you came from (its name only), the campaign a link was tagged with (utm_source, utm_medium, utm_campaign), and for a step its name and a few short labels (such as which button). To tell visits apart without knowing who you are, your IP address and the identification your browser sends (its name, version and system) are mixed with a random key of the month into a code; neither is stored, and the month's key is deleted when the month ends, after which no code can be traced back to anyone. A record carries no email, no card text and no account id, and is not linked to your account.

To compare versions of the home page, the Service counts which version a page view showed and whether a sign-up followed from it. The count uses a random number made for that one view, kept in no cookie. The record holds that number, the version shown and the time of the sign-up, but not your account.

4. Who processes your data, and where

Your data is stored on servers in the European Union: the database and the application at a hosting provider, and your files (avatars, imported card files) at an object-storage provider. The operator accesses it from Armenia.

The Service relies on a few providers that act on our instructions:

• a hosting provider and an object-storage provider in the EU, where everything above is stored;
• a transactional email provider in the EU, which delivers the account emails;
• a provider of AI language models in the United States, which receives your onboarding answers to generate your first cards;
• Google, for reCAPTCHA on the sign-up and password-reset pages;
• an error-monitoring service in the United States, which receives technical reports when the Service fails; these reports do not include your account data.

Where a provider processes data outside the European Economic Area, we rely on the European Commission's standard contractual clauses or on the EU–US Data Privacy Framework. We do not sell your data and we do not share it with anyone else, except when the law requires it.

5. How long we keep it

• Your account, content, technical records and support messages: for as long as your account exists.
• When you delete your account (Profile → Delete account), everything is erased 24 hours later; you can cancel the deletion within that time. Your onboarding answers, your cards and your records go with it.
• Sessions: 7 days of inactivity. Remember-me: up to one year.
• Usage statistics (section 3) are not linked to your account, so deleting it does not remove them. The records themselves are kept for 90 days; after that only daily totals remain (such as how many views a page had, from which site or campaign), with no code that tells visitors apart.

6. Your rights

You can see and change your account details in your profile, and delete your account there. You can also ask us to give you a copy of your data, to correct it, to delete it, or to object to how we use it: write to [email protected]. We answer within a month.

If you live in the European Economic Area, you can also complain to your data protection authority.

7. Children

The Service is not meant for children under 16, and we do not knowingly keep accounts of children under 16. If you think a child has an account, tell us and we will remove it.

8. Changes to this policy

When what the Service does with your data changes, we update this page and the date at the top. If the change matters to you — for example a new kind of data or a new purpose — we tell you in the app before it takes effect.

9. Contact

[email protected], or the Contact Support page in the app.