Privacy Policy | Cardary

Effective date

July 2, 2026

Scope

This Privacy Policy explains how Cardary and related services provided by AIBase.biz collect, use, disclose, retain, and protect information when you use the Cardary mobile applications, website, sync service, account service, AI features, OCR features, advertising-supported surfaces, purchase flows, and support channels.

This policy is written for app-store review and user transparency. It describes the product as currently implemented and should be reviewed by legal counsel before publication, store submission, or regulatory use.

Information we collect or process

Cardary processes different information depending on which features you use:

Category	Examples	Main purpose
Account and profile	email address, display name, avatar, sign-in provider id, authentication tokens, account status	sign-in, profile display, account recovery, abuse prevention
User content	decks, cards, notes, fields, tags, categories, comments, prompts, generated drafts, formulas, images, audio, files, imports, exports	create, edit, study, sync, publish, share, and restore content
Learning records	queue state, answer grades, due time, review logs, quiz results, schedule settings, statistics, learning-day state	spaced repetition, progress tracking, study planning, statistics
Sync and device state	local update time, server time, USN, device sync state, conflict metadata, cache metadata	cross-device sync, conflict handling, reliability
Purchases	product id, transaction id, receipt or purchase token, purchase date, expiry date, renewal state, trial state, entitlement state	verify purchases, restore CardaryPlus, prevent fraud, support refunds through stores
Device and diagnostics	device model, OS, app version, IP address, network state, crash traces, performance data, app events, device identifiers	security, analytics, crash diagnosis, service reliability
Advertising data	advertising identifiers where permitted, ad requests, ad impressions, placement, app-open/banner/interstitial ad state	show ads, measure ads, support AdMob and platform ad controls
Permission-based data	camera images, photo library items, selected files, microphone recordings, notification preferences, exact alarm settings	OCR, attachments, avatars, audio cards, reminders, local notifications
AI and OCR inputs	card text, deck context, user prompts, chat history for the feature, captured or selected OCR images, recognized text	AI explanation, AI card creation, OCR text/question/formula/card recognition
Support data	emails, screenshots, sample files, device information, account details you provide	respond to support, privacy, deletion, and billing questions

How we use information

We use information to provide and improve Cardary, including to:

create, import, edit, store, study, export, publish, download, and share decks and cards;
sync content, resources, and learning state across devices;
schedule new, learning, review, relearning, completed, and suspended cards;
verify subscriptions and restore CardaryPlus entitlements purchased through Apple App Store or Google Play;
operate OCR, AI explanation, AI card creation, formula recognition, and related editing workflows;
display ads on supported free surfaces and request App Tracking Transparency permission on iOS when required;
send local reminders, app notifications, and account or service messages;
measure feature usage with Firebase Analytics and diagnose reliability issues with Firebase Crashlytics;
prevent abuse, protect users, enforce terms, secure accounts, and comply with legal obligations;
respond to user support, account deletion, privacy, and data access requests.

Analytics, diagnostics, and advertising

Cardary uses Firebase Analytics to understand feature usage, navigation, screen activity, and selected product events. Analytics events may include event names, screen names, timing, device and app metadata, and non-content parameters. We do not intentionally send full deck content as analytics event parameters.

Cardary uses Firebase Crashlytics to diagnose crashes and serious runtime errors. Crash reports may include stack traces, app state, device details, OS version, app version, and diagnostic metadata.

Cardary uses Google Mobile Ads / AdMob for app-open, banner, and interstitial ads. Ad requests may involve Google advertising services and identifiers permitted by your device settings. On iOS, Cardary uses App Tracking Transparency before accessing identifiers for tracking or personalized ad measurement when required. You can manage ad personalization and tracking through Apple, Google, and device settings.

AI and OCR processing

AI features use Firebase AI / Google Gemini. When you ask Cardary to explain a card or create card drafts, the relevant card text, deck type, allowed card styles, deck context, prompts, and conversation history for that feature may be sent to Firebase AI / Google Gemini so the model can respond.

OCR features upload the selected or captured image to Cardary servers. Cardary may use third-party OCR providers, including Aliyun OCR for text, question, and card recognition and Xfyun / iFlytek OCR for formula recognition. OCR and AI outputs may be inaccurate, incomplete, or unsuitable. Review outputs before saving, studying, publishing, or sharing them.

More detail is available in the AI and OCR policy.

Storage, sync, and content hosting

Cardary stores account, deck, card, learning, purchase, and sync data on backend infrastructure. Resources such as avatars, card images, audio files, deck packages, and published assets may be stored through Aliyun OSS or similar infrastructure providers.

Some information is stored locally on your device, including SQLite databases, preferences, cached resources, generated files, local reminders, local draft content, and downloaded media. Local-only data may be lost if you delete the app before syncing or exporting.

We may share information with service providers that help operate Cardary, including Apple, Google, Firebase, Google Mobile Ads, app-store billing services, Aliyun OSS, Aliyun OCR, Xfyun / iFlytek OCR, backend hosting, sync infrastructure, email/support tools, and security providers.

We may disclose information if required by law, to protect users or the service, to enforce our terms, to investigate fraud or abuse, or as part of a business transfer such as a merger, acquisition, financing, reorganization, or asset sale.

We do not sell your deck content or learning records.

App permissions

Cardary requests permissions only when a feature needs them:

Camera: take photos, scan text/questions/formulas/cards, add images, update avatars.
Photos and files: choose images, import files, export content, attach resources, save generated output.
Microphone: record audio for cards or resources.
Notifications and exact alarms: schedule study reminders and local alerts.
Network and device information: sync data, load resources, diagnose problems, serve ads, and operate analytics.
Tracking permission on iOS: request access to identifiers for ads and measurement where required.

You can manage permissions in device settings. Denying a permission may disable the related feature.

App-store privacy and data safety

For Apple App Privacy and Google Play Data Safety purposes, Cardary may process user content, identifiers, purchase history, usage data, diagnostics, contact information, and permission-based media depending on feature use. Some data is linked to your account, some is used for app functionality and analytics, and advertising identifiers may be used for third-party advertising where permitted.

Store disclosures should be kept consistent with this policy, the implemented SDKs, and the active app configuration.

Retention

We retain information for as long as needed to provide Cardary, maintain sync, verify purchases, restore entitlements, comply with law, resolve disputes, prevent fraud and abuse, keep backups, and enforce agreements.

Data type	Typical retention approach
Account/profile	until account deletion or as needed for security/legal obligations
Decks/cards/resources	until deleted by the user or account deletion is processed
Learning logs/statistics	while the deck/account exists, unless deleted through product workflows
Purchase records	retained as needed for entitlement, tax, fraud, support, and legal obligations
Crash/analytics data	retained by Firebase/Google according to their service settings and policies
Backups/security logs	retained for limited operational periods and then overwritten or deleted

Your choices and rights

You can manage permissions, ad settings, tracking settings, connected sign-in providers, account profile information, deck content, local files, and synced content through the app, device settings, Apple, Google, or support channels. You may contact us to request access, correction, deletion, portability where applicable, or help with privacy concerns.

For deletion details, see the Account Deletion policy.

International processing

Cardary may process information in countries or regions where AIBase.biz, service providers, infrastructure providers, app stores, analytics providers, advertising providers, AI providers, and OCR providers operate. These locations may have privacy laws different from your jurisdiction.

Security

We use reasonable administrative, technical, and organizational safeguards to protect information. No internet-based or mobile service can guarantee absolute security. Keep your account credentials secure and contact support if you suspect unauthorized access.

Children’s privacy

Cardary is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information to Cardary, contact us so we can review and take appropriate action. More detail is available in the Children Privacy policy.

Policy changes

We may update this policy from time to time. The latest version will be posted on this page. If changes are material, we may provide additional notice through the app, website, or another appropriate channel.

Contact

For privacy questions, contact xiaofuhai@outlook.com.