Privacy Policy

Last updated: 28 September 2026

This page explains what WakeCards collects, why, who else sees it, and how to get it deleted. It describes what the software actually does — including the parts that are inconvenient.

1. Who is responsible

WakeCards ("we", "us") operates this site and the study app. For any privacy question or request, write to 43137888@qq.com.

2. What we collect

• Account details. Your email address, a salted hash of your password (never the password itself), and a hashed recovery code.
• Your documents. The files you upload, and the text we extract from them.
• Your cards. The flashcards generated from your documents, along with the review ratings you give them.
• Usage records. How many credits you have, how many you have used, the size and status of each generation job, and token counts. We use these to run billing and to debug failures.
• Technical data. Your IP address and standard request information, kept in server logs, used for rate limiting, security, and abuse prevention.

We do not ask for your name, address, phone number, or payment card details. If you buy credits, the payment provider collects your payment details directly — we never see your card number.

3. How we use it

• To create your account, sign you in, and let you recover access.
• To generate flashcards from your documents and show them back to you.
• To count and enforce credits.
• To send service email (verification, password recovery). We do not send marketing email.
• To keep the Service secure and working, and to diagnose faults.

We do not sell your personal data, we do not share it with advertisers, and we do not use your documents to train AI models.

4. Who else processes your data

We use a small number of third-party services. Each one only receives what it needs to do its job:

• DeepSeek (api.deepseek.com) — the AI model that drafts your flashcards. The selected text from your document is sent to DeepSeek for this purpose. DeepSeek's servers are located in mainland China. See section 5.
• Resend (api.resend.com) — sends account email such as verification links and password resets. It receives your email address and the contents of that message.
• DigitalOcean — hosts the application and the database. Servers are in the United States. This is where your account, documents, and cards are stored.
• A payment provider, once payments are live. If you buy credits, the Merchant of Record processes the payment and receives your billing details. It shares back only the order status we need to add credits to your account.

We may also disclose data if the law requires it, or to protect the Service and its users from abuse.

5. International transfers — please read this one

WakeCards is hosted in the United States, and the AI processing step sends your document text to a provider in mainland China. Your data therefore leaves the country you are in.

If you are in the EU, the UK, or Switzerland, this means your document text is transferred outside the EEA/UK and processed in a country that does not have an adequacy decision for this purpose. We rely on your consent for this specific transfer, which you give by uploading a document after seeing this notice. If you do not want your document text processed in China, do not upload documents — the Service cannot generate cards without this step.

Backups used for migration are temporarily kept in China as well, and are deleted once the migration window closes.

We do not use your documents for anything other than generating your own cards.

6. Cookies

We set one cookie: study_session. It is strictly necessary — it keeps you signed in. It is HttpOnly and SameSite=Strict, and it disappears when you sign out or when it expires.

There are no advertising cookies, no analytics cookies, no tracking pixels, and no third-party scripts on this site.

7. How long we keep it

• Account and cards: until you ask us to delete them.
• Documents: until you delete the document or your account.
• Server logs: a short rolling window, then discarded.
• Backups: retained on a rolling schedule for disaster recovery, then overwritten.
• Payment records: the Merchant of Record keeps transaction records for as long as tax law requires, independently of us.

8. Your rights

Depending on where you live, you may have the right to access your data, correct it, delete it, get a copy in a portable format, restrict or object to certain processing, and withdraw consent.

There is currently no delete-my-account button in the app. To exercise any of these rights, email 43137888@qq.com from the address on your account and tell us what you want. We will action it, and we may ask you to confirm you control the account first.

Deleting your account removes your documents, your cards, and your sign-in details. Backup copies are overwritten as the backup cycle rolls.

If you are in the EU or UK, you also have the right to complain to your national data protection authority.

9. Security

Passwords are stored only as salted hashes. Sessions use HttpOnly, SameSite=Strict cookies. The database file is not world-readable, access to the server is restricted to key-based logins, and the app runs as an unprivileged user. The site is served over HTTPS only.

No system is perfectly secure. If you believe your account has been compromised, email us immediately.

10. Children

The Service is for people 18 and older. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, contact us and we will remove it.

11. Changes to this policy

If we change how we handle data — for example, by adding a new processing provider — we will update this page and change the date at the top. Material changes will be announced by email or in the app before they take effect.

12. Contact

Privacy questions and data requests: 43137888@qq.com.