Privacy Policy

Last updated: October 17, 2026

This is not legal advice. This policy describes how Swanki Cards Maker collects, uses, and protects your data.

1. Who We Are

Swanki Cards Maker is operated by John Slater, 434 Glenwyth Road, Wayne, PA 19087.

For privacy questions or requests, contact: [email protected]

2. Data We Collect

2.1 Account Information

• Email address: Used for authentication via one-time codes sent to your email
• User ID: A unique identifier (UUID) assigned to your account
• Authentication tokens: Temporary access and refresh tokens stored in secure HTTP-only cookies

2.2 Content You Create

• Source text: Text you paste or extract from uploaded PDFs
• Source metadata: Titles, creation dates, rights basis acknowledgments
• Generated cards: Flashcards created from your sources
• Rights acknowledgments: Your attestations about material ownership and intended use

2.3 Payment Information

• Stripe customer ID: Links your account to your Stripe payment profile
• Credit balance and transaction history: Records of credit purchases and usage
• Checkout sessions: Temporary payment session identifiers

Your payment card details are never sent to or stored by Maker. All payment processing is handled directly by Stripe on their secure platform.

2.4 Analytics (When Enabled)

When PostHog analytics is enabled (controlled by the POSTHOG_KEY environment variable), we collect:

• Event data: Signup events, purchase events, source creation, card generation counts
• User identifier: Your account UUID (never your email address)
• UTM parameters: Marketing attribution data from URL parameters (utm_source, utm_medium, etc.)
• Page views: Which pages you visit

We do NOT collect:

• Your source text or card content
• Your email address in analytics
• Form input contents or text you type
• Session recordings (completely disabled)
• Automatic click or interaction captures (disabled)

2.5 Technical Information

• IP address: Used for rate limiting and security
• Request metadata: Timestamps, request counts, error logs

3. How We Use Your Data

3.1 To Provide the Service

• Authentication: Verify your identity and maintain your session
• Card generation: Send your source text to AI providers (via OpenRouter) to generate flashcards
• Storage: Save your sources, cards, and account data in Supabase
• Billing: Process credit purchases through Stripe and track your credit balance

3.2 To Improve the Service

• Analytics: Understand how the service is used to guide improvements
• Error monitoring: Identify and fix technical issues
• Performance: Optimize response times and reliability

3.3 To Prevent Abuse

• Rate limiting: Prevent excessive requests or abuse
• Fraud detection: Identify and prevent payment fraud or disputes

4. Data Sharing and Third Parties

Your data is shared with these service providers:

4.1 Infrastructure and Storage

• Supabase: Database and authentication services (stores your account data, sources, and cards)
• Railway: Application hosting
• Cloudflare: Content delivery and DDoS protection

4.2 AI Processing

• OpenRouter: Routes your source text to AI providers for card generation. Your content is processed to generate cards but is not used to train AI models.

4.3 Payment Processing

• Stripe: Handles all payment processing, including checkout sessions and customer billing. Stripe's privacy policy governs how they handle your payment data.

4.4 Analytics (When Enabled)

• PostHog: Analytics platform that receives usage events (no source text, card content, or email addresses). PostHog's privacy policy governs their data handling.

We do not sell your data to third parties.

5. Data Retention

5.1 Active Account Data

• Sources and cards: Retained until you delete them or close your account
• Account information: Retained while your account is active
• Rights acknowledgments: Retained as required for copyright compliance

5.2 After You Delete Content

Source deletion: When you delete a source, the source text is removed immediately, except for any copy saved in a generation receipt. Generation receipts are kept as long as your account exists.

5.3 After Account Closure

When you close your account (by emailing [email protected]), sign-in is disabled but your account data is retained. This includes your sources, cards, rights acknowledgments, and transaction history.

6. Data Security

We implement security measures to protect your data:

• HTTPS: All data transmitted to and from the service is encrypted
• Secure cookies: Authentication tokens use HTTP-only, secure, SameSite cookies
• Database security: Row-level security policies enforce data isolation between accounts
• API role restrictions: The API database role does not have superuser privileges or row-security bypass
• Content Security Policy: Browser-side protections against XSS and injection attacks

Despite these measures, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

7. Your Rights and Choices

7.1 Access and Export

You can access all your sources and generated cards through your workspace. You can download your cards as Anki deck files (.apkg) or text files at any time.

7.2 Deletion

You can delete individual sources through the workspace interface. To close your entire account, email [email protected]. Closing your account disconnects it (sign-in is disabled), but account data is retained.

7.3 Email Communications

We only send email when you request a one-time sign-in code. We do not send marketing emails or newsletters.

7.4 Analytics Opt-Out

Analytics are controlled at the service level (via the POSTHOG_KEY environment variable). If analytics are enabled, your usage is tracked as described in this policy. You can use browser privacy tools or ad blockers to block PostHog if desired.

8. Cookies and Tracking

8.1 Essential Cookies

We use cookies to maintain your authenticated session. These cookies are essential for the service to function and include:

• Access token: Short-lived authentication token (expires in hours)
• Refresh token: Long-lived token for session renewal (expires in 30 days)

Cookie names depend on whether the service uses HTTPS: __Host-maker-access and __Host-maker-refresh for HTTPS, or maker-dev-access and maker-dev-refresh for local development.

8.2 Analytics Cookies and Storage

When PostHog analytics is enabled, PostHog may set cookies or use localStorage to track your session and identify returning visitors. We also store UTM attribution parameters in localStorage for acquisition tracking.

9. Children's Privacy

The service is not intended for children under 13 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect data from children. If we learn we have collected data from a child, we will delete it promptly.

10. International Data Transfers

Your data may be processed in countries where our service providers operate, including the United States. These countries may have different data protection laws than your jurisdiction. By using the service, you consent to the transfer of your data to these countries.

11. Changes to This Policy

We may update this privacy policy at any time. Changes will be reflected by the "Last updated" date. Continued use of the service after changes constitutes acceptance of the updated policy.

12. Data Breach Notification

In the event of a data breach affecting your personal information, we will notify affected users as required by applicable law.

13. Contact Us

If you have questions about this privacy policy or how we handle your data, please contact us at:

Email: [email protected]

John Slater
434 Glenwyth Road
Wayne, PA 19087

14. Your Data Rights

Depending on your location, you may have rights regarding your personal data, which may include:

• Access: Request a copy of the data we hold about you
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your data (subject to legal retention requirements)
• Restriction: Request that we limit how we process your data
• Objection: Object to certain types of processing
• Portability: Request your data in a portable format

To exercise any of these rights, please contact us using the information in section 13. We will respond to your request in accordance with applicable law.