Privacy Policy

This policy explains what personal data Deckbee handles, why, and the rights you have. It applies to the Deckbee app, its servers and this website. The Terms of Use explain how Deckbee itself works.

Who is responsible

The controller of your personal data is:

Contact us at info@deckbee.app with any question about your data or to use your rights. We have not appointed a data protection officer, as the law doesn’t require one for us.

The short version

• You can use Deckbee without an account. Your decks then stay on your phone, and we don’t receive them.
• With an account, we keep a backup of your learning data so you can get it back on another phone.
• We don’t sell your data or use it for advertising.
• You can delete your account and its data in the app at any time.

Data we handle and why

For each use of data, we name its legal basis under the EU General Data Protection Regulation (GDPR).

Using the app without an account

Your decks, cards and study history are stored only on your phone. When the app loads ready-made decks or checks for updates, your phone connects to our servers or our service providers, which process your IP address and technical information about the app and device, such as its version and operating system, to deliver what the app asked for.

Legal basis: contract, to provide the app you use.

Your account

When you sign in with a supported sign-in service, such as Google, we receive from that service an identifier for your account and your email address, and possibly other basic profile information it shares, such as your name. We keep only what we need to run your account. We use it to create and recognise your account, and your email address to contact you about your account, these terms or the service. We don’t send you marketing email without your consent.

Legal basis: contract.

Your content and backup

While you are signed in, we keep a backup of your learning data, such as your decks, cards, pictures and study history. We use it to restore your decks on another phone and to provide the features you use, such as AI assistants. When you add a picture, our servers resize it and remove its metadata, such as location, before storing it.

Your cards are yours to write, so they can contain anything you type or picture. Please don’t add sensitive information, such as about health, or other people’s personal data unless you have the right to. We don’t use your content for any purpose other than providing Deckbee to you, keeping it secure and meeting legal duties.

Legal basis: contract.

AI assistants

When you connect an AI assistant, we keep the details of the connection, the information about your decks the assistant needs to find them, and the changes it asks for until your phone has handled them. The assistant can read your cards from your backup.

Anything Deckbee sends to an AI assistant at your request is then handled by the company that provides it, such as Anthropic for Claude or OpenAI for ChatGPT, under its own privacy policy. That company is responsible for what it does with the data.

Legal basis: contract.

Deckbee Plus

Purchases are made through the App Store or Google Play, which handle the payment. We never receive your payment card details. From the store, we and the service we use to manage subscriptions receive what is needed to give you Plus: your Deckbee account identifier, the store, what you bought, and when it renews or ends, along with technical information about your device.

Legal basis: contract; and legal obligation for the records the law requires us to keep, such as for bookkeeping.

Limits, security and misuse

To keep Deckbee reliable and stop misuse, we count how much each account uses features with limits, and how often requests come from an account or an IP address. Our servers and our hosting providers log requests and errors, which can include technical data such as IP addresses. If you let your phone share diagnostics with app developers, Apple or Google may also send us crash reports, which don’t identify you.

Legal basis: our legitimate interests in keeping Deckbee secure and working, enforcing its limits and preventing misuse. Counting usage also serves the contract, where limits are part of your plan.

Contacting us

If you email us, we use your message and contact details to answer you.

Legal basis: our legitimate interest in answering you, or contract when your message is about the service you use.

Legal claims and authorities

We may use data to establish, exercise or defend legal claims, and to answer lawful requests from authorities.

Legal basis: our legitimate interest in protecting our rights, or legal obligation.

The website

This website uses no cookies and no analytics. Our hosting provider processes your IP address to deliver the pages.

Legal basis: our legitimate interest in running the website.

Our legitimate interests and consent

Where we rely on legitimate interests, we have weighed them against your rights and interests and keep the processing to what those interests need. You can object to it; see Your right to object.

Where we ask for your consent for something, such as marketing email, you can withdraw it at any time without affecting what we did before.

Signing in is optional. Without the data it needs, the features that require an account aren’t available, but you can still study.

We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects. Deckbee’s study schedule is calculated automatically, but only to decide when you see each card.

Storage on your phone

The app stores on your phone what its features need, such as your decks, your settings and the key that keeps you signed in. It contains no advertising identifiers or tracking. Uninstalling the app removes this data from the phone.

Who receives data

We use service providers that process data for us under data processing agreements and only on our instructions. They provide:

• hosting for our servers, database and website;
• storage for pictures;
• management of subscriptions;
• delivery of app updates;
• email.

Ask us for the current list of our service providers.

Data also goes to others in these cases:

• Sign-in services, app stores and AI assistants you choose to use receive data from you or from Deckbee at your request, and handle it as separate controllers under their own privacy policies.
• Authorities receive data when the law requires it.
• A buyer or successor may receive data if Deckbee or our business is transferred, under the same protections.

We don’t sell personal data or share it for advertising.

Data outside the EU

We prefer service providers that process data in the EU or the European Economic Area. Some providers, or their subcontractors, may process data elsewhere, such as in the United States. When they do, we rely on an adequacy decision of the European Commission, such as the EU–US Data Privacy Framework, or on the Commission’s standard contractual clauses. Ask us for a copy of the safeguards.

How long we keep data

We keep personal data only as long as needed for the purposes above:

• Account and content: as long as you have your account. When you delete it, we delete your account and the data we keep for it, such as your backup, pictures, assistant connection and subscription status.
• Pictures: until you remove them from your decks, or delete the deck or your account. A picture that never becomes part of your backup is deleted, normally within a few days.
• AI assistant connection: until you disconnect, and at the latest after it has gone unused for 180 days. Changes an assistant asked for are deleted within 90 days after your phone has handled them.
• Usage counts: as long as needed to apply the limit they count. Counts used against misuse are kept for at most 7 days, linked only to a pseudonymised form of your sign-in identifier, also after you delete your account, so that deleting and recreating an account can’t reset them.
• Logs: up to 30 days.
• Emails with us: as long as needed to handle the matter and any follow-up.
• Database backups: deleted data can remain in them for up to 30 days. They are used only to recover from failures.
• Inactive accounts: an account unused for a long time and without an active subscription may be deleted, as the Terms of Use explain.

We may keep data longer when the law requires it, such as bookkeeping records, or when it is needed to resolve a dispute or defend a legal claim, and only for that purpose.

Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and get a copy of it;
• correct inaccurate data;
• delete your data, which you can do in the app or by email, as Delete your account explains;
• restrict how we process your data in certain cases;
• receive the data you have given us in a machine-readable format and have it sent to another service (portability);
• withdraw consent you have given, at any time.

To use your rights, email info@deckbee.app. We may ask you to confirm your identity, for example by writing from the email address of your account. We answer within one month, or tell you within that time if a complex request needs longer, as the GDPR allows. Using your rights is free unless a request is clearly unfounded or excessive.

If you think we handle your data unlawfully, you can complain to the Finnish Data Protection Ombudsman (tietosuoja.fi) or the data protection authority where you live. We’d appreciate the chance to sort it out with you first.

Your right to object

You have the right to object, on grounds relating to your situation, to processing based on our legitimate interests. We then stop, unless we have compelling legitimate grounds that override your interests, or need the data to establish, exercise or defend legal claims. You can always object to the use of your data for direct marketing, and we then stop. To object, email info@deckbee.app.

Permissions on your phone

The app asks for a permission only when a feature needs it. For example, it asks for access to your photos when you add a picture to a card, and uses only the photos you pick. You can change permissions in your phone’s settings.

Children

Deckbee is for people aged 13 and over. If we learn that we hold data about a child under 13, we delete it. If you believe a child under 13 uses Deckbee, contact us.

Security

We protect data with measures suited to the risks, such as encrypted connections, storing secrets only in a form that can’t be read back, limiting who can access data, and keeping pictures in private storage. No system is perfectly secure; if a breach puts your rights at risk, we tell you and the authorities as the law requires.

Changes to this policy

We may update this policy when Deckbee or the law changes. The date at the top shows when it last changed. If a change matters to you, we tell you in the app or on this website before it takes effect. If we want to use your data for a new purpose that needs your consent, we ask for it first.

Contact

Questions about privacy or this policy: info@deckbee.app.