Inkword Flashcards

Privacy Policy

Effective date: October 13, 2026

Also in 日本語 · 한국어 · 繁體中文

This Privacy Policy explains how Inkword Flashcards (“Inkword,” “we,” “us”) collects, uses, and shares information when you use our mobile app and this website. It is written in plain language as a starting point — not legal advice.

Who is responsible: Inkword is operated by Huu Phuc Nguyen, an individual developer. Contact: [email protected]. Our postal address and telephone number are given without delay to anyone who asks at that address.

Information we collect

  • Account data: email address and name when you create or sign in to an account (for example via Google sign-in).
  • Content you submit: photos or text you scan, words and phrases you select, native-language preference and English level, flashcards or decks you create, and what you write when you ask Inky for help (a practice sentence, or messages in a practice chat).
  • Usage and entitlement data: how many cards you keep (the free plan's limit), subscription status, and app events needed to run the product.
  • Device information: basic technical data such as device type and app version, used to keep the service reliable.

How we use your information

  • To provide the core product: read text from the page you scan, generate flashcards for the words and phrases you select, schedule them for review, and sync your decks when you are signed in.
  • To answer when you ask Inky for help: explain a sentence, write more examples and a memory hook for a card, check a sentence you wrote, or reply in a practice chat. The app asks your permission before anything is sent for this, and you can withdraw it in Settings.
  • To enforce the free tier's library limit and Pro entitlements. Scanning and reviewing are not metered.
  • To process subscriptions and restore purchases.
  • To respond to support requests you send us.
  • To improve reliability and understand how the product is used (for example product analytics).

Third-party processors we use

We use the following services to operate Inkword Flashcards. Each processes data only as needed for its role:

  • Supabase — authentication and database. Processes account data (email, name / auth identity) and your app content (scans, phrases, flashcards, decks) stored for your account.
  • OpenRouter, OpenAI and Anthropic — language-model inference. OpenRouter passes each request to a model (an OpenAI model to write cards, an Anthropic model for Inky's help) and returns its answer. They process the words and phrases you select with the sentence each one appeared in; for Inky's help, also the sentence you ask about, a sentence you write for a check, the messages of a practice chat, and your English level and language. Your name and email are not sent to them. Scanning alone sends nothing: the page stays on your device unless you choose words from it. We store a sentence explanation and a card's extra examples so that asking again gives the same answer; we do not store practice sentences or chat messages after the answer, only a record of the use (which feature, when, and its cost). Do not submit content you are not comfortable sending to these processors.
  • RevenueCat — subscription and purchase management. Processes purchase receipts, subscription status, and identifiers needed to update your Pro entitlement.
  • Hetzner (Hetzner Online GmbH, Germany) — operates the server our API runs on, in its data centre in Ashburn, Virginia, United States. Handles the same data in transit and in server logs, never as a separate consumer of your content.
  • PostHog — product analytics on this website only. Receives anonymous page and click events with a random identifier that is discarded when you leave the page; it is never given your email, your account, or anything you scan. The Inkword app itself sends no analytics.

Legal bases and sharing

We share data with the processors above to provide the service you request. We do not sell your personal information. We may disclose information if required by law or to protect the rights, safety, and integrity of Inkword and our users.

Data retention

We keep account and content data while your account is active and as needed to provide the service. You can delete your account and everything in it from inside the app — Profile → Delete account. It removes your decks, cards and scans along with the account itself, and the same email and password no longer sign in. Backup and legal retention windows may apply for a limited time after deletion.

Children

Inkword Flashcards is not directed at children under 13 (or the minimum age required in your country). We do not knowingly collect personal information from children.

Your choices

  • You can use limited free features without a paid subscription.
  • You can sign out, or delete your account outright, from Profile inside the app.
  • You can withdraw your permission for Inky's AI help at any time in Settings → Inky's AI help; nothing more is sent for it until you allow it again.
  • You can manage or cancel a subscription in your Apple ID subscription settings.

International transfers

Inkword's servers are in the United States (Ashburn, Northern Virginia). The processors listed above are United States companies, except Hetzner, a German company whose servers for Inkword are in the United States. If you use Inkword from outside the United States, your data is transferred there and processed there.

For users in the European Economic Area, the United Kingdom and Switzerland, that is a transfer to a third country. Where a recipient is certified under the EU–U.S. Data Privacy Framework, the transfer relies on the European Commission's adequacy decision of 10 July 2023; where it is not, it relies on the European Commission's Standard Contractual Clauses. Write to us at the address below and we will tell you which applies to a given processor and send you a copy of the clauses.

Users in Japan

The business operator handling your personal information is Huu Phuc Nguyen (contact above; address on request). Your information is provided to the processors listed above, in the United States, to carry out the service on our behalf. The United States has no comprehensive federal privacy law comparable to Japan's Act on the Protection of Personal Information; protection there rests on sector-specific federal laws and on state laws. Each processor is bound by contract to use the data only to provide its service to us and to keep it secure. On request we tell you the measures each recipient takes. Security measures we take: access to stored data is limited to the operator, data is encrypted in transit, and deleting your account deletes its data. To ask for disclosure, correction, deletion or that we stop using your information, write to the address above; there is no fee, and we answer without delay.

Users in Korea

Overseas transfer of personal information (Personal Information Protection Act):

  • Recipients and countries: Supabase, Inc. (United States); OpenRouter, Inc. (United States); OpenAI, L.L.C. (United States); Anthropic, PBC (United States); RevenueCat, Inc. (United States); Hetzner Online GmbH (Germany; servers in the United States). Each can be reached through its website.
  • Items: email address, name and sign-in identity; the words and sentences you choose and the cards made from them; sentences you write and chat messages when you ask Inky for help, with your English level; purchase and subscription status.
  • When and how: when you use the service, sent over the network, encrypted in transit.
  • Purpose: to store your account and cards, to write card explanations and answer Inky's help requests, and to manage purchases.
  • Retention: until you delete your account, or until the purpose is served.
  • How to refuse, and what follows: you can refuse by not creating an account or by deleting it (Profile → Delete account); the service cannot be provided without these transfers.

Destruction: when you delete your account, your data is deleted from our database at once; copies in the database provider's backups expire on its backup schedule. Your rights: you, or your legal representative, may ask to see, correct, delete or suspend the processing of your information by writing to us. Privacy officer: Huu Phuc Nguyen, [email protected]. For help with a privacy infringement you may also contact the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118), the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972), the Supreme Prosecutors' Office (spo.go.kr, 1301) or the Korean National Police Agency (ecrm.police.go.kr, 182).

Users in Taiwan

Under the Personal Data Protection Act: the collector is Huu Phuc Nguyen (contact above). The purposes, the kinds of data and who processes it are described in this policy. We use your data while your account exists, in Taiwan and in the United States where our servers and processors are, by automated processing to provide the service. You may ask to review your data or get a copy, to supplement or correct it, to have us stop collecting, processing or using it, and to delete it, by writing to us. If you do not provide an email address or sign-in, you cannot create an account, and the service cannot keep or sync your cards.

Changes

We may update this policy from time to time. The effective date at the top will change when we do. Continued use of the service after an update means you accept the revised policy.

Contact

Questions about privacy? Email us at [email protected].