Privacy Policy

Who we are

EasyPalmCards (easypalmcards.com and the EasyPalmCards apps) is run by Easy Palm Cards, a registered Australian business. In this policy “we”, “us” and “our” mean Easy Palm Cards.

This policy explains what information we collect when you use EasyPalmCards, why, who we share it with, and the choices you have. We follow the Australian Privacy Principles, and we also give the rights described below to people in the European Economic Area, the United Kingdom and other places with similar laws.

The short version

• You can make, print and study cards without an account. Those cards are saved in your browser, not on our servers.
• With an account we keep your name, email address and the sets you save, so you can open them on any device.
• We never sell your personal information, and we never use your card text to build advertising profiles.
• Live listening in rehearsal runs on your device. We never record or store audio of you speaking.
• Card text is sent to an AI provider only when you use an AI feature, and only the text that feature needs.
• The free plan shows ads on some pages. Gold members, class members, the editor canvas, study and rehearsal modes never show ads.

What we collect

When you create an account

• Your name and email address, and whether your email is verified.
• The sign-in details our sign-in provider (Auth0) gives us, such as an account ID and, if you sign in with Google, the basic profile Google shares (name, email and profile picture). Passwords are handled by Auth0; we never see or store them.
• Your language and region choices.

What you make and do

• Card sets you save to your account: titles, card text, speaker notes, images you add, folders, tags, design settings and earlier versions (Gold).
• Study progress for synced sets (Gold): which cards you reviewed, when, your answers' results, stars and a daily count.
• Rehearsal history (Gold): run length, pace, filler-word counts, time per card and short quotes of lines you skipped. Never audio and never a transcript.
• IELTS speaking practice history (Gold): the topic, your notes and timings. Any recording you make stays in your browser.
• Files you import (Word, PDF, PowerPoint and similar). See “Document imports” below for how briefly we hold them.

Payments

Payments are made through Stripe. Stripe collects your card or other payment details; we never see your full card number. We receive and keep your Stripe customer ID, the card brand and last four digits, what you bought, the amount, currency and dates, and your billing country and address when needed for tax.

Technical information

• Your IP address, browser type and device details, kept with your sign-in session and in server logs for security and to fix problems.
• Your approximate country, worked out from your connection, to show local wording, paper sizes and prices. We don't store it.
• Usage counts to enforce fair-use limits (for example PDFs and AI actions). For visitors without an account we use a scrambled (hashed) value instead of the raw IP address.

When you contact us or report a set

If you email us we keep the conversation. If you report a shared set, we keep the reason, your comment and, if you give it, your email address. We store a scrambled version of your IP address to stop abuse of the report form, never the address itself.

What stays on your device

Without an account, and for many features on the free plan, your work is kept in your browser's local storage: the set you are editing, editor preferences, study progress, starred cards, streaks and rehearsal summaries. It never reaches our servers unless you save the set to an account or share it. Clearing your browser data deletes it, and it doesn't move to another device.

Speech recognition in rehearsal uses your browser's on-device recogniser, and only starts when the browser confirms it can run locally. Read-aloud uses your device's own voices.

How we use your information

• To provide the service: save and sync your sets, make PDFs and share links, run classes and Gold features. (Legal basis in the EEA and UK: performing our contract with you.)
• To take payments, prevent fraud and keep tax records. (Contract and legal obligation.)
• To keep EasyPalmCards secure, stop abuse and check uploaded images are safe. (Legitimate interests.)
• To understand which features are used and fix what is broken, using analytics. (Consent where the law requires it, otherwise legitimate interests.)
• To show ads on free pages. (Consent where the law requires it.)
• To reply to you and send service messages, such as sign-in and password emails from Auth0 and receipts from Stripe. We don't send marketing emails.

Services we use

We share information only with the providers that run parts of EasyPalmCards for us, only what each one needs, and they may use it only to provide their service (and, for Google's advertising and Stripe, under their own policies too).

• Auth0 (Okta): sign-in, password reset, email verification and two-step sign-in.
• Google sign-in, if you choose it.
• Stripe: payments, subscriptions, tax and the billing portal.
• Cloudflare: delivers the website, protects it from attacks, and stores Gold card images, saved set content and PDFs for a few minutes while you download them.
• Amazon Web Services: imported documents are virus-scanned and converted in an isolated AWS environment.
• Google Cloud Vision: checks images uploaded by Gold members for unsafe content before they can be shared. Only the image is sent, not your name or set.
• Google Gemini: AI features (see below).
• Google Analytics: anonymous usage statistics. We turn off Google signals and ad personalisation for analytics, don't send your name, email or account ID, and strip set links down to a generic page name.
• Microsoft Clarity: shows us how pages are used (clicks, scrolling and session replays) so we can find confusing or broken parts. All text on the page, including your cards, is masked in replays. We don't use Clarity for visitors in the European Economic Area, the United Kingdom or Switzerland.
• Google AdSense: ads on free pages.
• Google Fonts and Fontsource: if you pick an extra font in the editor, your browser loads it from these services.
• RevenueCat: purchases made in the EasyPalmCards mobile app.
• Our hosting provider: our servers and database are in Sydney, Australia.

We may also disclose information if the law requires it, to protect people's safety, or to a buyer if the business is ever sold (this policy would still apply to your information).

Document imports

When you import a file, it is uploaded to a private storage area, scanned for malware, and converted to text in an environment with no internet access. The original file is deleted before the result is returned, anything left over is removed within a day, and the result itself is deleted from our side within 24 hours. File names and results are stored encrypted while we hold them.

AI features

AI features (drafting cards, rewriting, summarising, practice questions, personalising templates and rehearsal feedback) send the text needed for that request to Google's Gemini service, which sends back a result. We send card text, your topic or your answers, never your name or email address. For practice questions we also hide email addresses and phone numbers in your cards before sending.

Rehearsal feedback only runs after you tick a box to agree, and what you said is only included if you tick a second box. Nothing is sent to the AI provider unless you use an AI feature. We keep a count of AI actions for your monthly allowance, not the prompts or results, unless you add the result to your cards.

Cookies, local storage and ads

Needed for the site to work

• A session cookie and a security (CSRF) cookie; a “remember me” cookie keeps you signed in; short-lived sign-in cookies hold the sign-in step's security codes.
• Your language and region choices, if you set them.
• A referral cookie for 30 days if you arrive through a friend's invite link, so they can get their reward.
• Local storage for your work and preferences (described above), and a cache so the site loads faster and works offline. Pages that show your private data are never cached.

Analytics and ads

Google Analytics, Microsoft Clarity and Google AdSense use their own cookies. Visitors in the European Economic Area, the United Kingdom and Switzerland see a consent message from Google first: until you agree, Google's ad and analytics storage stays off (Google Consent Mode), and Clarity is not loaded at all. If your browser sends a Global Privacy Control signal, we turn analytics storage off. Elsewhere, ads are not personalised by default.

Ads never appear in the editor canvas, in study or rehearsal modes, in print or PDFs, on sign-in, pricing, account or class pages, for Gold members, or for anyone in a class. The embeddable card player sets no cookies and loads no ads or analytics. You can learn how Google uses data from its partners' sites at policies.google.com/technologies/partner-sites, and change Google ad settings at adssettings.google.com.

Classes and students

Teachers can create classes and invite students with a code. Joining asks for nothing beyond a normal account. Teachers see each student's first name and last initial (never their email), when they opened and studied each set, how many times, their latest score and whether an assignment is done. Most-missed cards are shown as class totals with no student names. In live practice, individual answers are deleted when the round ends and only class totals are kept.

Teachers must have their school's, and where needed parents', permission to use EasyPalmCards with students. A student can leave a class at any time, and a teacher can remove them; either way that student's class activity is deleted. No one in a class sees ads.

Share links and embeds

Anyone with a share link can view that set, and any embed of it on another website. Speaker notes stay private unless you turn on sharing them for that set. Images uploaded by Gold members are shown to others only after the safety check approves them. You can stop sharing at any time; the link and embeds then stop working (embeds within about five minutes).

How long we keep data

• Account information and saved sets: while you have an account. If Gold ends, your sets are kept.
• Recently deleted sets: 30 days, then permanently deleted.
• Share links made without an account: 7 days.
• Earlier versions of a set (Gold): the most recent 30.
• Uploaded images no set uses any more: deleted after 48 hours.
• PDFs: deleted a few minutes after they are made. Imported documents: see “Document imports”.
• Live practice sessions: deleted within a day.
• Payment and tax records: as long as Australian tax law requires (generally five years), even after you delete your account.
• Safety reports and moderation records: kept to protect users and handle repeat abuse.
• Server logs: kept for security and troubleshooting, then deleted.

When you delete your account we permanently delete your sets (including recently deleted ones), uploaded images, study and rehearsal history, class memberships and your sign-in account. You can delete your account yourself under Profile Settings. Doing so cancels any active Gold or Classroom subscription straight away, so you are not charged again; we keep records of your payments as described above.

Your choices and rights

Wherever you live, you can ask us to:

• give you a copy of the personal information we hold about you;
• correct it;
• delete your account and its data;
• stop using it for a purpose you object to, or restrict how we use it;
• give you your saved sets in a portable format (you can also export any set yourself as PDF, Word, PowerPoint, text, CSV or Anki).

You can change your name and email in your profile, withdraw consent for ads and analytics through the consent message or your browser settings, and stop sharing any set. To make a request, email [email protected] from the address on your account. We reply within 30 days and may need to confirm it is you. We don't charge for requests.

California residents: we don't sell or “share” personal information for cross-context behavioural advertising as those terms are defined in California law, and we don't use sensitive personal information to infer characteristics about you.

Where data is stored

Our servers and database are in Australia. Some of the providers above process data in other countries, including the United States and the European Union. When information leaves Australia, the European Economic Area or the United Kingdom, we rely on providers that protect it with contracts such as the European Commission's standard contractual clauses or equivalent safeguards.

Security

Connections use HTTPS. Passwords are handled by Auth0, two-step sign-in is available, imported files are scanned in isolation, uploaded images are re-encoded to remove hidden data such as location, and access to our systems is limited. No service is perfectly secure; if a breach is likely to cause you serious harm we will tell you and the regulator as the law requires.

Children

EasyPalmCards is used by students, including school students. If you are under 16, or under the age your country sets for agreeing to online services, please get a parent's or guardian's permission before creating an account, or use EasyPalmCards through your school. We collect no more from students than from anyone else, and students in a class never see ads. If you believe a child has given us information without the permission they needed, contact us and we will delete it.

Changes to this policy

We will update this page when what we collect or how we use it changes, and change the “Last updated” date. If a change is significant, we will also tell signed-in users in the app before it takes effect.

Contact and complaints

Questions or complaints about privacy: email [email protected]. We aim to resolve complaints within 30 days. If you are not satisfied, you can contact the Office of the Australian Information Commissioner at oaic.gov.au, or, if you live in the EEA or UK, your local data protection authority.