How it worksJoin early access

Legal

Privacy Policy

Last updated: October 6, 2026

This Privacy Policy explains how Cardo ("Cardo", "we", "us") collects, uses, stores, and processes personal data when you use the Cardo app and related services.

Cardo is operated by:

Sarp Semih Altunel

Wesereschstr. 54

49084 Osnabrück

Germany

For privacy-related questions, you can contact us at support@trycardo.com.

1. What data we process

Depending on how you use Cardo, we may process the following categories of data.

Account and authentication data

When you create or use a Cardo account, we process information necessary to authenticate you and maintain your account, including:

  • email address
  • account identifier
  • authentication provider
  • optional display name where provided through Sign in with Apple or another authentication provider
  • authentication and session information

Cardo currently supports email and password authentication, Google Sign-In, and Sign in with Apple on supported platforms.

Passwords are handled by our authentication provider and are not stored in Cardo's application database in plain text.

Learning and app data

To provide Cardo's learning functionality, we process information associated with your account, including:

  • learning spaces
  • languages and proficiency settings
  • categories and subcategories
  • flashcards and their contents
  • notes, examples, translations, tags, and related card information
  • study and review history
  • spaced-repetition and scheduling information
  • study session information
  • learning goals and app preferences
  • reminder preferences

Your flashcards and learning content are private to your account. Cardo does not currently provide a public feed or public sharing of your flashcards.

AI feature data

Cardo includes optional AI-assisted features that can help generate or translate flashcard content.

When you actively use one of these features, the information necessary to perform your request may be sent to our AI service provider. This may include:

  • words or phrases
  • example text
  • source and target languages
  • proficiency information
  • other text required to complete the requested generation or translation

Do not submit sensitive personal information through AI features unless it is necessary for your use of the service.

Device and local app data

Cardo stores certain information locally on your device to keep you signed in and provide app functionality. This may include:

  • authentication session information
  • onboarding state
  • app language and preferences
  • temporary study-session state
  • recently used categories or learning settings

Some local preferences may remain on your device after you sign out.

Notifications

If you choose to enable study reminders, Cardo requests permission to send notifications.

Study reminders are currently scheduled locally on your device. Your reminder preferences and selected reminder time may be stored with your Cardo profile so that your settings can be synchronized.

Cardo does not currently use remote push notifications for study reminders.

2. Why we process your data

We process personal data where necessary to provide Cardo and its features, including to:

  • create and manage your account
  • authenticate you
  • store and synchronize your flashcards
  • organize your learning content
  • calculate study schedules and spaced-repetition progress
  • maintain your study history and learning preferences
  • provide AI-assisted generation and translation when requested
  • provide study reminders when enabled
  • maintain the security and technical operation of the service
  • respond to support or privacy requests
  • comply with applicable legal obligations

Where processing is necessary to provide the Cardo service you request, the legal basis is generally Article 6(1)(b) GDPR.

Where processing is necessary to comply with a legal obligation, the legal basis is Article 6(1)(c) GDPR.

Where we rely on legitimate interests for security, service integrity, or similar operational purposes, the legal basis is Article 6(1)(f) GDPR.

Where your consent is required for a particular feature or device permission, processing is based on Article 6(1)(a) GDPR and you may withdraw your consent at any time.

3. Service providers

We use selected third-party providers to operate Cardo.

Supabase

Cardo uses Supabase for authentication, database services, and backend functionality.

The primary Cardo Supabase project is hosted in the EU West (Ireland), AWS eu-west-1 region.

Supabase processes account information, authentication information, flashcards, study data, preferences, and other application data on our behalf as necessary to provide Cardo.

OpenAI

Cardo uses the OpenAI API to provide certain optional AI-assisted features.

When you request an AI feature, the text and contextual information required to perform that request is transmitted to OpenAI for processing.

According to OpenAI's API data policies, data submitted through the API is not used to train OpenAI models by default unless the customer explicitly opts in to data sharing. OpenAI may retain certain API data for a limited period for abuse monitoring, security, and legal purposes.

Google

If you choose Google Sign-In, Google processes information necessary to authenticate you. Cardo receives the authentication information necessary to create or access your Cardo account.

Apple

If you choose Sign in with Apple, Apple processes information necessary to authenticate you. Depending on your choices, Apple may provide Cardo with information such as your email address or name. If you use Apple's Hide My Email feature, Cardo may receive an Apple private relay email address instead of your regular email address.

4. International data transfers

Cardo's primary Supabase database and authentication infrastructure is hosted in the European Union.

Some service providers used by Cardo, including providers involved in authentication or AI processing, may process personal data outside the European Economic Area.

Where required by applicable data protection law, such transfers are subject to appropriate safeguards provided by the relevant service provider, such as adequacy mechanisms or Standard Contractual Clauses.

5. Analytics and advertising

Cardo does not currently use third-party advertising SDKs or behavioral advertising.

The current version of Cardo does not use a third-party product analytics service.

If we introduce analytics or other measurement technologies in the future, we will update this Privacy Policy and, where required, request consent before such processing takes place.

6. How long we keep your data

We retain your account and learning data for as long as your Cardo account remains active or as necessary to provide the service.

When you delete individual flashcards or other learning content, the corresponding active application data is deleted in accordance with the functionality of the service.

When you delete your Cardo account, Cardo deletes your authentication account and the application data associated with it from the active Cardo database.

Some information may remain temporarily in infrastructure logs, backups, security systems, or systems operated by our service providers in accordance with their applicable retention policies or where retention is required by law.

Data sent to an external provider while using a feature may also remain subject to that provider's applicable retention rules.

7. Account deletion

You can delete your Cardo account directly from the Cardo mobile app through Settings.

Deleting your account deletes the Cardo authentication account and associated Cardo application data, including your profile, flashcards, categories, learning spaces, study-session information, and related account data from the active application database.

Account deletion is permanent and cannot be undone.

If you are unable to access your account or the in-app deletion function, contact us at support@trycardo.com.

8. Your rights

If the GDPR applies to you, you may have rights regarding your personal data, including the right to:

  • request access to your personal data
  • request correction of inaccurate data
  • request deletion of your personal data
  • request restriction of processing
  • receive certain personal data in a portable format
  • object to certain processing based on legitimate interests
  • withdraw consent where processing is based on consent

You also have the right to lodge a complaint with a competent data protection supervisory authority.

To exercise your rights, contact support@trycardo.com.

9. Children and younger users

Cardo is a general learning tool and is not specifically designed as a service directed at young children.

We do not intentionally require users to provide more personal information than is necessary to operate the service.

Where applicable law requires parental or guardian authorization for the processing of a younger user's personal data, such authorization may be required.

If you are a parent or guardian and believe that a child has provided personal data in circumstances where appropriate authorization was required, please contact us at support@trycardo.com.

10. Security

We use technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, or loss.

No online service can guarantee absolute security. You are responsible for keeping your account credentials secure and for notifying us if you believe your account has been compromised.

11. Changes to this Privacy Policy

We may update this Privacy Policy when Cardo changes, when we introduce new features or service providers, or when legal requirements change.

When we make material changes, we will provide appropriate notice where required.

The date at the top of this page indicates when this Privacy Policy was last updated.

12. Contact

For questions about this Privacy Policy, your personal data, or your privacy rights, contact:

Sarp Semih Altunel

Wesereschstr. 54

49084 Osnabrück

Germany

Email: support@trycardo.com