UlarioSoft ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how information is handled when you use the UlarCard applications, sync servers, and websites ("Service").
1. Local-First and Privacy-by-Design
UlarCard is built with a local-first architecture:
Local Storage: Your flashcards, review histories, learning paces, and deck configurations reside in a local SQLite database on your device.
Optional Cloud Sync: You can use UlarCard completely anonymously without creating an account or sending any data over the network. Network operations only occur when you explicitly sign in to sync across devices.
End-to-End Encryption (E2EE): Cards in protected decks are encrypted client-side with AES-GCM before being synced. We operate under a Zero-Knowledge architecture for protected decks—the server receives only ciphertext blobs and cannot inspect, read, or parse your protected cards.
2. Information We Collect When You Use Sync
2.1 Account and Authentication Information
When you choose to connect an account for multi-device sync, we collect minimal identifiers:
Email Sign-In: Your email address to deliver temporary one-time login tokens.
Google Sign-In: Your Google account identifier and verified email address received through Google OAuth. We do not access your Google Drive, contacts, or other Google services.
2.2 Device and Sync Metadata
To enforce device registration limits and perform incremental revision synchronization:
Unique random device identifier and user-friendly device name (e.g., "MacBook Pro").
Sync cursors, revision timestamps, and total active card counts (to verify tier synchronization limits).
2.3 Payment and Purchase Data
All in-app purchases and subscriptions are processed by Apple (App Store) or Google (Google Play). We do not collect or store your credit card numbers, bank details, or billing addresses. We receive only transaction tokens and subscription status receipts to grant plan entitlements.
2.4 Analytics and Tracking
We do not use third-party behavioral analytics, ad trackers, or advertising SDKs. We do not sell your personal data to third parties.
3. Third-Party Service Providers
We rely on trusted cloud infrastructure to deliver sync and authentication services:
Cloudflare: Secure edge compute (Cloudflare Workers), relational database (D1), and encrypted media storage (R2). Data in transit is protected via modern TLS encryption.
Google OAuth: Optional brokered identity verification.
4. Data Retention and Account Deletion
User Control: You can export complete archive backups of your collection directly within the application at any time.
Account Deletion: You may initiate permanent account deletion in the app settings (Settings > Account > Delete Account). This permanently purges your server collection, sync revisions, and media assets from our servers.
Inactive Data Purging: For expired subscriptions, server collections are retained for 180 days to allow resubscription before being scheduled for cloud deletion. Free accounts inactive for 12 months may be purged after notice. Local copies on your devices are never deleted by our servers.
5. Children's Privacy
Our Service is not directed to children under 13, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal information, please contact us for immediate removal.
6. Changes to This Policy
We may update this Privacy Policy to reflect changes in our service or legal requirements. Material changes will be noted on this page with an updated effective date.
7. Contact Us
If you have any questions or concerns regarding this Privacy Policy, please contact: