Privacy Policy

AnkiCat is operated by MARTINS HIGH QUALITY SOFTWARE LTDA ("AnkiCat", "we", "us", or "our"), the controller of personal data processed through the AnkiCat web app, iOS app, and Android app (collectively, the "Service") for purposes of the Brazilian General Data Protection Law (Lei nº 13.709/2018, "LGPD") and, where applicable, the EU/UK General Data Protection Regulation ("GDPR").

MARTINS HIGH QUALITY SOFTWARE LTDA CNPJ: 58.943.829/0001-08 Av. Paulista, 171, 4º andar, São Paulo, SP 01311-904, Brazil Phone: +55 61 9919-7207 Data protection contact / LGPD Encarregado: support@ankicat.com

Where required under GDPR Article 27 and UK GDPR, we have appointed a representative in the European Union and the United Kingdom for data protection matters. Their details (to be confirmed before public launch) can be requested at support@ankicat.com.

We collect the following categories of information:

• Account & contact data. Email address you provide when joining the waitlist or creating an account. If you create an account, we may also collect a display name.
• Profile data. Optional fields you choose to add to your profile (avatar, display name).
• Study & usage data linked to your identity. Decks you create, cards you review, review intervals, study streaks, study session timestamps, app version, and device platform. This data is associated with your account so we can provide spaced-repetition scheduling.
• Anonymized analytics. Aggregate page-view and feature-use events and crash logs. These are not linked to your identity and are stripped of identifiers before storage.

We do not collect: precise geolocation, contacts, photo library content, microphone audio, or advertising identifiers (IDFA).

• To operate the Service (account creation, login, syncing).
• To personalize spaced-repetition scheduling based on your reviews.
• To send transactional emails (e.g. waitlist confirmation, account notices, security alerts).
• To prevent fraud and abuse and to enforce our Terms of Service.
• To improve the Service using anonymized analytics only.

Under LGPD and, where applicable, GDPR, we rely on the following bases:

• Contract performance - providing the Service you signed up for.
• Legitimate interest - securing the Service, preventing fraud, and improving features through anonymized analytics, where these interests are not overridden by your rights.
• Consent - for any optional marketing communication. You may withdraw consent at any time.
• Legal obligation - to comply with applicable tax and regulatory requirements.

We share personal data only with the processors listed below, each bound by a data processing agreement:

• Cloudflare, Inc. (United States / European Union) - hosting and R2 object storage.
• RevenueCat, Inc. (United States) - subscription management, purchase receipts, and entitlement sync for App Store and Google Play billing.
• Resend, Inc. (United States) - transactional email (account notices, magic-link login, security alerts).
• OpenAI, L.L.C. (United States) - AI-assisted card generation. When you use AI features, the content you submit (e.g. notes you ask AnkiCat to convert to cards) is transmitted to OpenAI's API for processing. We do not send your account identifier in those prompts. Processing is governed by OpenAI's API terms; API data is not used to train models by default. We may change inference providers in the future and will update this policy before doing so.

We do not sell personal data. We do not share data with advertising networks. We do not permit cross-app or cross-website tracking.

We retain account data for as long as your account is active. When you delete your account or request deletion, we remove personal data from live systems within 30 days and from backups within 90 days. Anonymized analytics, which cannot be re-associated with you, may be retained indefinitely.

Subject to applicable law, you have the right to:

• Confirm whether we process personal data about you and access a copy.
• Correct inaccurate or incomplete data.
• Request anonymization, deletion, or blocking of unnecessary data.
• Receive your data in a portable format.
• Be informed about the third parties with whom we share data.
• Withdraw consent at any time, where processing is based on consent.
• Object to processing based on legitimate interest.

To exercise any of these rights, email support@ankicat.com. We will respond within the timeframe required by applicable law. California residents have additional rights under the CCPA (right to know, delete, and to non-discrimination). We do not sell personal information.

AnkiCat is not directed to children under 13, and we do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided personal data, please contact support@ankicat.com and we will delete it.

In the European Economic Area and the United Kingdom, under GDPR Article 8 the minimum age to consent to our processing is 16, unless your country has set a lower age (no younger than 13). If you are below the applicable age in your country, a parent or guardian must consent on your behalf before you use the Service. Elsewhere, users between 13 and the age of majority in their jurisdiction require parental or guardian consent to use the Service.

Personal data may be processed outside Brazil and the European Economic Area, including in the United States, by our hosting and AI providers. Such transfers are protected by appropriate safeguards, including Standard Contractual Clauses (under GDPR) and the LGPD international transfer mechanisms (Articles 33–36 of LGPD).

We protect personal data with industry-standard measures: encryption in transit (TLS), encryption at rest in our cloud storage and database, encryption at rest of the app's local data on your device (preferences and cached study content) using a key held in your device's operating system keychain/keystore, secure storage of your login credentials in that same keychain/keystore, least-privilege staff access, and periodic review of access controls. AnkiCat is not end-to-end encrypted: to provide syncing and AI-assisted card generation, our systems and the AI providers described in §5 process your content in readable form. No system is perfectly secure; we will notify affected users and the competent authorities of security incidents as required by applicable law, including within 72 hours of becoming aware of a notifiable breach where GDPR applies.

AnkiCat does not track users across apps or websites owned by other companies. We do not collect the IDFA (Identifier for Advertisers) on iOS, and we do not present the ATT prompt because no tracking occurs. The disclosures on this page are aligned with our App Store Privacy Labels in App Store Connect.

On the web, we use only strictly necessary cookies (session and CSRF protection). Aggregate analytics are anonymous and use no third-party cookies. We do not deploy advertising or social-media tracking cookies.

We may update this Privacy Policy from time to time. Material changes will be announced by email or in-app notice at least 14 days before they take effect. Continued use of the Service after the effective date constitutes acceptance.

Questions, requests, or complaints? Email support@ankicat.com. You may also contact the Brazilian National Data Protection Authority (ANPD) if you believe your rights have been violated. If you are in the European Economic Area or the United Kingdom, you have the right to lodge a complaint with your local data protection supervisory authority (in the UK, the Information Commissioner's Office).

MARTINS HIGH QUALITY SOFTWARE LTDA CNPJ: 58.943.829/0001-08 Av. Paulista, 171, 4º andar, São Paulo, SP 01311-904, Brazil Phone: +55 61 9919-7207