Last updated: October 7, 2026
Kardly is a mobile application provided by Gledson Cruz (“we,” “us,” or “our”). This Privacy Policy explains how we collect, use, share, and retain information when you use Kardly, and how you can exercise your privacy rights.
1. Information We Collect
Account information
When you create an account or sign in, we collect information such as your email address, account identifier, and name when provided. If you use Sign in with Apple, we receive the information Apple makes available based on your choices, which may include a private relay email address.
We use this information to authenticate you, manage your account, and provide account-related support.
Study content and uploaded files
Kardly processes the decks, flashcards, images, and study information you create or import to provide its features.
When you choose to generate flashcards using AI, your selected PDF is uploaded to our backend and its content is sent to OpenAI to generate cards. This processing occurs when you use the AI generation feature.
Usage and technical information
We use PostHog to understand how Kardly is used and improve its reliability and usability. Information collected may include:
App installation, opening, and screen navigation events, with timestamps and session identifiers.
Actions involving accounts, decks, and flashcards, including creating, editing, moving, archiving, or deleting items.
Card types and counts, review ratings such as “Again,” “Hard,” “Good,” or “Easy,” and review-session completion information.
Device type, model, manufacturer, and device name reported by the operating system.
Operating system, app version and build, screen dimensions, language or locale, and network connection type.
Information indicating whether the app is running in TestFlight, on an emulator, or in another supported environment.
IP addresses and approximate location derived from them, such as country, region, city, postal area, time zone, and estimated coordinates.
Kardly does not request precise GPS location for these analytics. IP-based location estimates may be inaccurate.
Identifiers and account association
Analytics may include an automatically generated identifier before sign-in. When you sign in, analytics can be associated with your account identifier and email address, and your name when available.
This information is personal data and is not limited to anonymous or aggregated statistics.
Diagnostics
We collect technical logs and may collect error or crash reports to investigate problems. These records may include error messages, stack traces, app and operating-system versions, app state, timestamps, and account or session identifiers.
AI generation metrics
For AI-generated flashcards, we collect operational information such as the AI provider and model, request identifiers, processing time, token usage, estimated cost, request status, PDF file size, requested and generated card counts, and error or validation outcomes.
Our current AI analytics configuration excludes prompt text and generated card content from PostHog. PDF file contents are processed by our backend and OpenAI to perform generation; they are not included in the AI analytics events sent to PostHog.
Session replay
We may use PostHog session replay to reconstruct interactions within Kardly and investigate usability problems. When active, this can include screen representations, navigation, taps, scrolling, and content displayed inside the app, depending on the recording configuration.
2. How We Use Information
We use information to:
Provide Kardly’s account, flashcard, study, and AI generation features.
Understand which features are used and improve the app.
Diagnose errors, crashes, performance issues, and unsuccessful requests.
Monitor AI generation quality, usage, and operating costs.
Enforce usage limits and help prevent misuse.
Respond to support requests and send necessary account or service notices.
Meet applicable legal obligations and protect our rights and users.
Where applicable, processing relies on providing the services you request, legitimate interests in operating and improving Kardly where permitted by law, legal obligations, or consent where required. This Privacy Policy does not replace any consent required by law.
3. Service Providers and Information Sharing
We use service providers that process information to support Kardly, including:
Supabase, for authentication, backend services, database operations, and uploaded-file storage.
OpenAI, to process documents and generate flashcards when you use AI features.
PostHog, for product analytics, diagnostics, AI generation monitoring, and session replay when active.
Apple, when you choose Sign in with Apple.
These providers receive information relevant to the features they support. Their processing is subject to applicable agreements and privacy terms. PostHog’s privacy information is available in its Privacy Policy.
We may also disclose information when required by law or when reasonably necessary to investigate misuse, protect safety, or defend our legal rights.
4. International Processing
Our providers may process information outside your country. Kardly currently uses PostHog’s US cloud service, so information sent to PostHog is processed in the United States. Other providers may also process information internationally.
Applicable data-protection requirements govern these transfers.
5. Data Retention
We retain account information while your account is active and as needed to provide services, handle support requests, meet legal obligations, and resolve disputes.
Analytics, AI metrics, and diagnostic records have separate retention needs and may remain after you stop using the app. PostHog session recordings, when collected, are currently configured with a 30-day retention period. This period does not apply to all analytics or diagnostic information.
Uploaded PDFs are used for AI generation, and our backend attempts to remove them after processing. Failed requests or cleanup failures may require additional removal.
6. Your Choices and Rights
You can delete your account using the “Delete account” option in Kardly’s settings. You can also contact contact@gledsoncruz.com to request access, correction, or deletion of personal information, including information held in analytics services.
Depending on applicable law, you may also have rights to data portability, information about sharing, objection to certain processing, restriction of processing, or withdrawal of consent. Brazilian users can find information about their LGPD rights through the ANPD.
We may need to verify your identity before fulfilling a request. Some information may need to be retained where permitted or required by law.
Uninstalling Kardly stops new collection by that installation, but does not automatically delete your account or information already stored by us or our providers. Account deletion may require separate removal of analytics records.
7. Children’s Privacy
Kardly is not intended for children under 13. We do not knowingly collect personal information from children under 13.
Where local law requires a higher age or parental authorization, those requirements apply. If you believe a child has provided personal information without the necessary authorization, contact us so we can investigate and take appropriate action.
8. Security
We use reasonable technical and organizational measures to protect personal information. No method of electronic transmission or storage can guarantee complete security.
9. Changes to This Policy
We may update this Privacy Policy as Kardly’s features or data practices change. We will publish the revised policy on this page and update the date above. Where required by law, we will provide additional notice or obtain consent.
10. Contact
Gledson Cruz is responsible for the personal information processed through Kardly.
For privacy questions or requests, contact:
contact@gledsoncruz.com