Privacy Policy

Summary: We collect only the data needed to run accounts, process AI workflows, secure the platform, and handle billing when paid plans are enabled.

1. Scope

This Privacy Policy explains how Cramblr, operator of Cramblr, collects, uses, stores, shares, and deletes personal information when you use the Service.

2. Information We Collect

Depending on how you use the Service, we may collect:

Account data: name, email, password hash (if you register with email and password), Google account identifier when you sign in with Google, account settings, terms acceptance metadata, and login/session metadata.
User content: uploaded images and documents, extracted text, generated flashcards, tags, deck metadata, audio files, and exports.
Usage and technical data: IP address, browser/user-agent, timestamps, error logs, queue/job status, and security events.
Payment data (if paid plans are enabled): billing events, plan status, invoices, credit transactions, and transaction identifiers from Stripe. Full card numbers are processed by Stripe, not stored by us.

3. How We Use Information

Provide authentication (including Google sign-in), account management, and core study workflows.
Run AI extraction, card generation, and optional text-to-speech features.
Store and deliver private files, downloads, and exports tied to your account.
Track and manage your credit balance and billing status.
Prevent abuse, enforce policies, detect fraud, and secure the Service.
Provide support, incident response, and service reliability operations.

4. AI and Third-Party Processing

To provide AI functionality, we may transmit your prompts, uploaded images, and related text to third-party AI providers.

We also use infrastructure providers for hosting, storage, logging, email delivery, and payment processing. These providers process data under their own terms and privacy commitments. We limit disclosure to what is reasonably necessary to provide the Service.

You may create an account or log in using Google OAuth instead of email and password. When you choose “Continue with Google”, you are redirected to Google to authenticate. Google processes that step under its own terms and privacy policy.

Depending on your Google account settings and the permissions you grant, Google may share with us:

Your name
Your email address
A unique Google user identifier, which we store as your Google account ID to recognize returning sign-ins

We use this information only to create or access your Cramblr account, link an existing account that uses the same email address, record terms acceptance for new Google sign-ups, and maintain your session. We do not receive or store your Google password.

If an account with the same email already exists, we may link your Google sign-in to that account so you can log in either way. You can review Google’s data practices at Google’s Privacy Policy.

We do not sell personal information for monetary consideration. We may share information:

With service providers that help operate the Service.
To comply with legal obligations, court orders, or lawful requests.
To protect rights, safety, and security of users and the Service.
As part of a merger, acquisition, financing, or asset sale.

6. Retention and Deletion

We retain information for as long as needed to provide the Service and meet legal, accounting, security, and dispute-resolution obligations. Retention periods may vary by data type.

When you delete your account, we remove associated database records and private files linked to your account, including import images, generated audio, and export files.

Some information may persist after deletion where required by law or for legitimate operational needs, including payment and billing records held by Stripe, server and security logs, and backup copies deleted on a rolling schedule.

7. Security

We use administrative, technical, and organizational safeguards designed to protect personal information, including account-scoped authorization checks, signed media links, and restricted storage paths. No method of storage or transmission is completely secure.

8. Cookies and Similar Technologies

We use essential cookies and similar technologies for authentication, session management, security, and user preferences (such as theme selection).

When enabled, we use Google Analytics to understand how visitors use our public marketing pages and where sign-up interest comes from. Google may set analytics cookies and receive usage data such as pages viewed, approximate location, device/browser information, and referral source. You can learn more in Google's Privacy Policy. Where required by law, we will provide cookie choices before loading non-essential analytics.

We do not use third-party advertising cookies.

9. Your Rights and Choices

Depending on your jurisdiction, you may have rights to access, correct, delete, or export personal information, and to object to or limit certain processing. You may also have rights related to marketing communications.

You can update your profile information and delete your account from your account settings. To submit a privacy request, contact [email protected].

10. Children’s Privacy

The Service is not intended for children under 13. If you are under the age required to consent to online services in your jurisdiction, you may use the Service only with verifiable parental or guardian consent. If we learn we collected personal data from a child in violation of applicable law, we will take steps to delete it.

11. International Data Transfers

Your information may be processed in countries other than your own where our providers operate. Where required, we use appropriate safeguards for cross-border data transfers.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version with a revised effective date. Continued use after the effective date means you accept the revised policy.

13. Contact

For privacy questions, complaints, or rights requests, contact [email protected].