Back to Legal

Privacy Policy

Effective Date: May 9, 2026
Last updated: October 7, 2026

1. Introduction

Island Cookie Shop LLC ("we", "us") respects your privacy. This Privacy Policy outlines what data we collect, why we collect it, and how we handle it. We operate on a principle of "Data Minimization"—we only collect what is strictly necessary to provide the Service.

2. Information We Collect

We operate two services, and they collect different things. This section is split accordingly.

2.1 flashcardaudit.com (Flashcard Audits)

  • Email Address: Required to deliver your audit results and provide customer support.
  • User Content (Flashcards): The .apkg files you upload. These contain your flashcard text, images, audio, and scheduling data.
  • Payment Information: Processed entirely by Stripe. We do not store or see your full credit card number.
  • Technical Data: IP addresses and browser headers (required for security and fraud prevention via Cloudflare).

2.2 Arena (Mobile App)

  • Account Identity: If you sign in, we store the account identifier supplied by your sign-in provider and the display name you choose. You can browse and play without an account; signing in is what makes your progress follow you to a new device.
  • Gameplay Data: The questions you are shown, the answers you give, when you play and how long you take (to answer, or to move past a card), the questions you skip, like, dislike or report, the topics you follow or ask for, and the ratings, levels, streaks, and skill standings derived from them. Each record also carries the time zone your device is set to, so that a streak counts the days you played by your own calendar. This is the Service: without it there is no rating to show you.
  • Guild Membership: Which guilds you belong to and your standing within them. Guilds are invite-only, and your standing is visible to the other members of that guild. When Arena shows you a question a guildmate has already answered and you answer it too, we record whose question it was and in which guild, and each of you can see which answer the other picked.
  • Profile Photo (only if you choose one): If you are signed in with Google or Apple, you can choose a profile photo. You need one to create or join a guild, just as you need a display name, but never to play. You select it with your phone's own photo picker, which gives Arena only the one photo you pick, never the rest of your photo library, and you then position it inside a circle. Arena never uses your camera for this. If you signed in with Google, Arena can offer your Google profile photo instead, and uses it only if you choose it. Arena shows your photo, as a circle beside your name, only to you and to people who are in a guild with you, and never to anyone who is not. As with any picture you show other people, a guildmate could save a copy. You can change or remove your photo at any time in Settings or from your profile.
  • How Your Photo Is Checked and Stored: Before anything is stored, Google Cloud Vision checks the photo, and a photo that is likely to be sexually explicit, sexually suggestive, or violent is rejected. We store an accepted photo as a single square image, re-encoded so that it carries no metadata: no location, no time it was taken, and no camera details. We do not keep the file you uploaded. The image is kept on Cloudflare R2 at a web address made from the image itself, which the app gives only to people in a guild with you; someone who already has an identical copy of the image could work that address out. So that we can limit how often photos are uploaded, we also keep a record of each upload attempt: when it was made and whether it was accepted, but never the image itself. That record also notes if we remove a photo of yours for breaking our rules, which makes the check on your next photo stricter and stops that photo being uploaded again.
  • Photo Reports: If you report a guildmate's photo, it is hidden on your device straight away, and we store your report (your account, the account you reported, which photo, and the reason you chose) and email it to ourselves for review. If someone reports your photo, their report names your account and that photo. Hiding a photo without reporting it is remembered only on your device, and nothing about it is sent to us. If a photo is reported, we keep its stored file after the photo is removed or its account is deleted, for up to 30 days after the report and never more than 30 days after the removal. We do this so that we can review the report and meet our legal duties. During that time the app no longer shows the photo, but the file still exists, and anyone who already has its web address could open it.
  • Card Reports: If you report a mistake on a card, we store your report: your account, the card, and the words you wrote, if any. An AI model reads the card and your words to check whether the card is wrong. If it is, the card is taken out for everyone, and the app tells you once. Your reports are deleted with your account.
  • Subscription Status: Whether you hold an active Arena membership, and the permanent member number issued when you first subscribed. Purchases are made through Apple or Google, and we never see your card details.
  • Camera (only while you are scanning): Arena can read a guild invite QR code with your device's camera, and asks for camera access the first time you open the scanner. The camera view is processed on your device to look for a QR code and nothing else: no photo or video is recorded, stored, or sent to us or to anyone else, and Arena never opens the camera outside that screen. You can decline, or turn the permission off later, and still join any guild by typing the invite code.
  • Notifications (only if you allow them): Arena can send you a reminder to keep a study streak alive, and asks your permission the first time. The reminders are scheduled and fired on your own device from your local study history. Declining costs you nothing else in the app, and you can turn them off at any time in your system settings.
  • Local network (development builds only): Arena declares local-network access so a developer build can talk to the development tools on the same machine. The released app makes no use of it, nothing about your network is read, and nothing is sent to us.
  • Feedback You Send Us: Arena has a Feedback screen for writing to us directly. If you use it, we store the message you write. You may optionally give an email address so we can reply; it is used only to answer you, and never added to a mailing list. If you are signed in with Google or Apple, the app fills that field in with your account email so you do not have to retype it, and you can clear it before sending if you would rather not be contacted. So we can act on a bug report, each message also carries your account, the app version, your device model and operating system, an identifier for your installation of the app, and an identifier for that app session.
  • Device and Diagnostic Data: Device model, operating system version, app version, an identifier for your installation of the app, crash reports, and an app-integrity token used to confirm that requests come from a genuine copy of the app. While diagnostics sharing is on (section 3), the app also reports the language your device is set to and the country of the app store account it is signed into, which we keep with your account so we can see which languages and countries our players come from and judge question difficulty by country. We do not collect advertising identifiers and we do not build an advertising profile of you.

3. Analytics

In Arena: most of what we measure, the app reports to our own servers directly. We also use Google Firebase (Analytics, Crashlytics, and Remote Config) for crash reporting, aggregate usage measurement, and feature configuration. There is no advertising SDK in the app, we do not collect advertising identifiers, and we do not build an advertising profile of you. We use these reports to see which features are used, to find crashes, and to tune how questions are selected. They are tied to your account so that your own progress is correct, and they are never sold or used for advertising.

You can turn this off. Crash and usage reporting is optional. Arena asks about it when you first open the app, and leaves a "Share anonymous diagnostics" switch in Settings you can change at any time. Turning it off stops Firebase collection and the optional half of our own reporting, including your device language and app store country, and how you move through a question: how long you look at a card before opening it, whether you rearrange an answer before submitting it, whether you swipe back to read a card again and for how long, and whether you leave the app while a question is open. A small amount of essential reporting continues, because it is what keeps your ratings and purchases correct.

On flashcardaudit.com: we use Vercel Web Analytics to understand website traffic and performance. This tool is cookie-free and designed to respect user privacy.

  • No Personal Profiling: It does not track your browsing history across other websites.
  • Data Minimization: It collects anonymized metrics (e.g., browser type, geography, page load speeds). Visitor IPs are anonymized and not stored permanently.
  • No "Consent Banner" Needed: Because this data is anonymized and strictly necessary for benchmarking our site's performance, it typically does not require a "Cookie Consent" opt-in.

4. How We Use Data

  • To Provide the Audit Service: We process your flashcards to generate "QualityScores" and audit reports.
  • To Provide Arena: We use your gameplay data to work out your ratings and skill standings, decide which question to show you next, keep streaks and guild leaderboards accurate, and grant membership benefits. Arena carries no advertising, and we neither sell this data nor share it for advertising.
  • Communication: We use your email to send: (a) your audit results (Transactional); (b) a reply, if you gave us an address when you wrote to us through Arena's Feedback screen (Transactional); and (c) occasional updates or newsletters about the Service (Marketing). You may unsubscribe from Marketing emails at any time.

5. Data Retention

  • Raw Uploads: We automatically interpret and delete your raw .apkg files from our processing servers within 30 days of upload.
  • Anonymized Data: We may retain indefinitely (a) aggregated, anonymized statistics derived from your User Content (e.g., "Average score for Anatomy cards"); and (b) de-identified text excerpts, structural transformations, and underlying factual concepts derived from your User Content. This anonymized data is essential for maintaining our global card registry, improving the "QualityScore" algorithm, conducting internal research, and powering related educational tools, features, and services across our platform. It cannot be linked back to you and is not used to train third-party generative AI models.
  • Email Records: We retain email addresses indefinitely to maintain a record of your audit history, unless you request deletion.
  • Arena Account Data: Your account, ratings, history, membership record, and guild memberships are kept until you delete your account, which you can do at any time from inside the app or through Delete Your Account. Deletion is immediate and permanent.
  • Arena Feedback: Messages you send through the Feedback screen are stored with your account and are deleted with it when you delete your account. A message we have already emailed to our support inbox stays in our email records, as any email you sent us would.
  • Arena Profile Photos: Your photo is kept until you change or remove it or delete your account. The stored file is then deleted, with two exceptions. If another account uploaded exactly the same image, both accounts share one stored file, which is deleted once no account uses it. If the photo was reported, the file is kept for up to 30 days after the report, and never more than 30 days after the removal, and then deleted (see Photo Reports in section 2.2). The record of your upload attempts and any photo reports you filed are stored with your account and deleted with it. A report someone else filed about your photo is not deleted with your account: it names your former account and which photo, and is kept until the person who filed it deletes their account. A report we have already emailed stays in our email records, as any email would.
  • Arena Usage Analytics: Performance and usage records expire automatically within 12 to 24 months depending on the record. Once your account is deleted, nothing in them identifies you.

6. Third-Party "Sub-Processors"

We share specific data with the following trusted third-party vendors to operate the Service:

  • Google Cloud (GCP/Vertex AI): Compute (Iowa, US), storage (US), and AI model inference, which Google may run in any of its regions.
  • Supabase: Database hosting (Ohio, US).
  • Cloudflare & Vercel: Security (DDoS protection), DNS, and Hosting (Global Edge Network).
  • Vercel Analytics: Website traffic measurement and performance monitoring (Data is anonymized).
  • Stripe: Payment processing.
  • Upstash: Rate limiting and caching.
  • Resend: Sending transactional and marketing emails.
  • Google Firebase: for the Arena mobile app. Firebase Authentication (sign-in), Firebase Crashlytics (crash reporting), Firebase Analytics (usage measurement), Firebase Remote Config (feature configuration), and Firebase App Check (app-integrity checks).
  • RevenueCat: Managing Arena membership entitlements. It receives your account identifier and the receipt issued by the app store, never your payment details. Its record of you is deleted when you delete your account.
  • Google Cloud Vision: Checking Arena profile photos for unsafe content before they are stored. It receives each photo only after it has been resized and its metadata removed.
  • Cloudflare R2: Storing Arena profile photos and serving them to the app.
  • Apple and Google: Processing Arena membership purchases through their respective app stores. Your payment details are held by them under their own privacy policies, and are never shared with us.

7. International Transfers

The Service is hosted in the United States. Its AI processing runs on Google Cloud, which may perform it in any country where Google operates. If you access the Service from the European Union (EU) or other regions, you acknowledge and consent to your data being transferred to and processed in the United States and those countries, which may have different data protection laws than your jurisdiction.

8. Children's Privacy

Neither service is for children under 13, and we do not knowingly collect data from them. If a parent or guardian discovers that their child under 13 has provided us with personal information, contact us and we will delete it.

Above that floor the two differ, matching our Terms of Service. The audit service on flashcardaudit.com is for adults only (18+), because it involves payment and a content license. Arena is available from 13, because it is a study app and students are who it is for. Users between 13 and 17 need a parent or guardian's permission to use Arena, and any membership purchase is made through an adult's app store account.

Where local law sets a higher minimum age for consenting to data processing (for example 16 in parts of the European Economic Area), that higher age applies in your jurisdiction.

9. Your Privacy Rights (GDPR, CCPA, & Other Privacy Laws)

We operate under the principle of data minimization and strive to extend core privacy rights to all our users, regardless of their geographic location.

  • For European Economic Area (EEA) and UK Users (GDPR): We process your personal data under specific "Lawful Bases." Processing your email and uploaded files is necessary for the performance of a contract (delivering the audit Service you requested). We rely on our legitimate business interests to cache anonymized data to improve site performance, maintain security, and prevent fraud. Under the GDPR, you have the right to access, rectify, erase, restrict, or object to our processing of your personal data, as well as the right to data portability.
  • For California Residents (CCPA/CPRA): While Island Cookie Shop LLC may not currently meet the statutory revenue or data-volume thresholds that strictly mandate CCPA compliance, we voluntarily grant you the right to know what personal information we collect, the right to request its deletion, and the right to non-discrimination for exercising these rights. We explicitly do not sell or "share" (for cross-context behavioral advertising) your personal information to third parties.
  • Exercising Your Rights: To request the deletion of your email, raw uploaded files, or cached data, or to exercise any of the rights listed above, please contact us via our Contact Page.
  • Deleting Your Arena Account: You can delete your Arena account and everything tied to it from inside the app, in Settings, and it takes effect immediately. You do not need the app installed to ask us to do it. See Delete Your Account for exactly what is erased. Anonymized usage analytics are an exception: once your account is gone nothing in them identifies you, and they expire automatically within 12 to 24 months.

10. Changes to This Policy

We will update this Policy as our services change. Every revision changes the "Last updated" date at the top of this page, so that date is the reliable signal that something has moved.

  • Material Changes: If we begin collecting a new category of personal data, use existing data for a genuinely new purpose, or add a sub-processor that changes where your data goes, we will take reasonable steps to bring it to your attention before it takes effect, such as a notice on this site or in the Arena app. Continued use after that point constitutes acceptance of the revised Policy.
  • No Retroactive Reduction: We will not retroactively apply a materially less protective policy to personal data we have already collected without asking for your consent first.
  • Prior Versions: Every version of this Policy is kept, and you may request an earlier one through our Contact Page.