Privacy Policy

1. Who We Are

CardStacks is operated through cardstacks.xyz and app.cardstacks.xyz. For privacy or account-data requests, contact feedback@cardstacks.xyz.

2. Data We Collect

• Account data such as name, email address, auth-provider identifiers, and session records.
• Training data such as deck selection, progress, stats, streaks, reminders, and custom decks.
• Purchase and entitlement metadata needed to verify access to paid features.
• Support communications and operational logs used for security, debugging, and abuse prevention.

Version 3.0 requires a registered account to train. Current clients use our self-hosted Appwrite service; older clients and preserved migration copies may still use Appwrite Cloud during the upgrade period.

Free Android and iOS builds use Google AdMob for non-personalized ads, subject to consent requirements. Its SDK may collect approximate location derived from IP, device identifiers, app/ad interactions, crash logs and performance diagnostics and share those with Google for ads, measurement and fraud prevention. Ad-Free and Supporter remove ads.

CardStacks does not store full payment card numbers. Purchases are processed by Apple App Store or Google Play.

3. How We Use Data

• To create and secure accounts and sign users in.
• To sync training progress, decks and entitlements across devices. Training reminders are scheduled locally on each device and require notification permission.
• To provide support, detect fraud or abuse, and keep the service reliable.
• To meet legal, accounting, tax, refund, and security obligations.

4. Sharing

We share data only with service providers and platforms needed to run CardStacks, such as authentication, hosting, analytics, email, and native mobile billing providers. We may also disclose data when required by law or to protect users, CardStacks, or the public.

5. Retention

We keep personal data only as long as it is reasonably needed for the purposes above. When accounts are deleted, we aim to delete or de-identify the related data unless we need to retain limited records for legal, tax, refund, fraud, or security reasons.

6. GDPR and Similar Privacy Rights

If you are in the EEA, UK, Switzerland, or another region with similar laws, and where applicable, you may ask to:

• access the personal data we hold about you;
• correct inaccurate or incomplete data;
• delete personal data that is no longer needed or is processed unlawfully;
• restrict or object to certain processing;
• receive portable copies of the data you provided to us; and
• withdraw consent where processing relies on consent.

To exercise these rights, email feedback@cardstacks.xyz. We may request reasonable identity verification. We aim to respond without undue delay and, in principle, within one month. You may also complain to your local data protection authority if you believe your rights were not handled properly.

7. Account Deletion

Open Profile → Delete account in CardStacks, or use the account deletion page. The authenticated flow requires explicit confirmation and covers your account, linked identities, private stacks, practice, statistics and account-linked purchase/promotion data. Older versions that support guest accounts provide their deletion flow on the original device; version 3.0 does not create guest accounts. Contact us if you cannot access an older account.

Authenticated initiation accepts confirmed pending requests. Completion still requires verified handling of all stored copies and retained records. A pending receipt does not mean that the account or its data has already been removed.

Protected migration copies and backups remain. Their deletion or lawful retention must be resolved before complete deletion is reported. No verified removal period is currently promised. Store purchases are not automatically refunded and account-linked access cannot be transferred to another CardStacks account.

Contact feedback@cardstacks.xyz for questions about existing copies or retention. Email is not a substitute for the authenticated deletion flow.

8. Facebook / Meta Login Data Deletion Instructions

If you signed in with Facebook Login, you can revoke CardStacks' access from your Facebook account and request deletion of any remaining CardStacks-side data tied to that login.

• Open Facebook and go to Settings & Privacy -> Settings.
• Open Apps and Websites.
• Find CardStacks in the active apps list and click Remove.
• Then email feedback@cardstacks.xyz with the subject Facebook Data Deletion Request.

Please include the following in your email:

• your name;
• the email address used with CardStacks or Facebook Login;
• your Facebook app-scoped user ID if available; and
• whether you want full account deletion or only the Facebook login link removed.

Once verified, we will remove Facebook-linked identifiers, tokens, and identity-link records stored by CardStacks, and we will delete any additional account data you ask us to remove unless we must keep limited records for legal, fraud-prevention, security, or accounting reasons.

9. Changes

We may update this policy as the service, vendors, or legal requirements change. The current version is always published on this page.