Privacy Policy
Last updated: 28 October 2026
This is a convenience translation. The German version is the legally binding one.
1. Controller
Xherdi Lika, Gubitzstr. 6, 10409 Berlin, Germany Email: support@decksmd.app
We are not legally required to appoint a data protection officer.
2. Scope — and what is expressly not covered
This policy covers:
- the website decksmd.app,
- the DecksMD Pro subscription service,
- the deck directory at decksmd.app/decks,
- the DecksMD app for iPhone, iPad and Android (“the app”) and the Decks plugin for Obsidian (“the plugin”), as far as they exchange data with us or, for purchases in the app, with Apple or Google.
The contractual terms are in our Terms of Service and, for the deck directory, in its terms; on questions of data processing, this policy governs.
What stays on your device. The plugin and the app work without an account and without AI. Notes, cards, study progress and statistics stay in your vault — on your device, or in the sync service you choose for it (for example iCloud Drive or Obsidian Sync), which we have no access to. Neither the plugin nor the app contains advertising, tracking or analytics code. AI features are off until you turn them on.
Your own AI provider. This policy does not cover AI use with your own provider. If
you select your own provider — in the plugin OpenAI, Anthropic, Google or a local model; in
the app Anthropic, Google or a server address you enter — the plugin or the app sends your
content directly from your device to that provider, using your own key. That data never
reaches our servers at any point; the provider processes it under its own terms and privacy
policy. Your API keys are never transmitted to us. In the app they are kept in the app’s
own storage on your device. In the plugin they are kept in a file in the plugin folder of
your vault (ai-keys.json), outside the plugin settings that Obsidian Sync replicates; a
service that syncs the whole vault folder, such as iCloud Drive, Dropbox, Syncthing or git,
copies that file to your other devices too, including your DecksMD Pro device token
(section 6).
Apple. When you download the app or buy a subscription in it, Apple processes data under its own responsibility and its own privacy policy. If you allow sharing with app developers in your device settings, Apple gives us crash reports and aggregate usage statistics that do not identify you.
Google. When you download the Android app from Google Play or buy a subscription in it, Google processes data under its own responsibility and its own privacy policy. If you allow sharing of usage and diagnostics data on your device, Google gives us crash reports and aggregate statistics that do not identify you.
3. Processing of your content by DecksMD Pro
This is the most important section of this policy.
What is transmitted
When you use an AI feature with DecksMD Pro, the plugin or the app sends to our service only what that feature works on:
- the text of the note, section or PDF pages you choose as a source,
- your instructions (e.g. “make cards for chapter 3”) and the questions you ask in the PDF reader, together with the passage you selected, the earlier questions and answers of that conversation, and the fronts of the cards you kept,
- cards already generated in the current run, so duplicates are avoided, and cards that are checked, rewritten or repaired,
- when you ask about a source in the app, the fronts of the cards already in the deck you save to, so the answer can take them into account,
- images: rendered images of the PDF pages you select (for example scanned pages whose text has to be recognised), photos you attach in the app and images you attach in the plugin. The app re-encodes photos on your device before sending them, which removes embedded metadata such as the location. The plugin sends images as they are stored, including any such metadata,
- for grading typed exam answers by meaning: the question, the expected answer, your typed answer and a short excerpt of context,
- in the app, text shared to it from other apps, when a capture rule with “Refine with AI” files it.
Your vault as a whole is never uploaded, and your study schedule and review history are not transmitted; a rewrite started from the list of cards you often forget says only that. Each request carries your device token (section 6), which links it to your account so that usage limits can be applied.
This content may contain personal data if your notes contain personal data.
Your permission in the app
Before the app sends anything to an AI service for the first time — DecksMD Pro, your own provider or a server address you set — it shows what is sent and to whom, with a link to this policy, and sends nothing unless you allow it. If you decline, AI stays off and every other feature works as before. You can withdraw your permission at any time by turning AI off under Settings → AI. The app asks again before it sends to a different provider, or when what it sends changes.
In the plugin, AI features are off by default and run only after you turn them on and choose a provider.
What happens to it
Our server receives the request, adds the system instruction and forwards it to an AI routing service, which passes it to a suitable language model. The response is returned to your device.
Your content is not stored. It is processed only for the duration of the request and discarded afterwards. We never retain note content, instructions, questions, answers, images or generated cards. No content appears in our logs either: on failure we log only the error status, the name of the model requested, and the provider’s error message.
We do not use your content to train AI models. In addition, every request we send carries an explicit flag prohibiting storage and use for training, and we route requests only to providers whose published policies exclude training on, or retaining, the content they receive. We set this flag technically on every single request.
After a request completes we retain only consumption figures: the number of tokens processed and the cost incurred. The content of your notes cannot be reconstructed from those figures. For some checks, such as grading by meaning, we also count their outcomes per day (for example “correct” or “unsure”) to tune them — without content and without any reference to your account.
Legal basis
Art. 6(1)(b) GDPR — processing is necessary to perform the contract, because it is the service you asked for. The permission prompt in the app comes on top of this: it makes sure nothing is sent before you know what is sent and to whom.
Special categories of personal data (Art. 9 GDPR)
Many of our users study medical, nursing or psychology material, so one clarification matters here.
Study material about a subject is generally not health data under Art. 9 GDPR. A card about the symptoms of a condition, a textbook extract or a lecture handout contains no personal reference — there is no data subject the information relates to. You can process such content without concern.
It is different for documents relating to specific individuals: patient records, case notes with identifying details, test results, therapy notes or similar. Those do contain special categories of personal data.
We expressly ask you not to submit such material. The service is not intended for it, we do not request it, and our processing is not directed at it. The same applies to third-party personal data for which you have no legal basis.
If you nevertheless submit such content: we process it solely as part of the generation you requested, do not store it (see above), and do not analyse it. We neither intend nor carry out any independent processing of special categories within the meaning of Art. 9(1) GDPR. You remain responsible for whether the input was permissible — in particular towards the individuals concerned and, for professional records, with regard to any duty of confidentiality.
For notes containing personal information we recommend a model you run yourself: a local model in the plugin, or a server address of your own in the app. The data then never reaches us (see section 2).
4. Third-country transfer for AI processing (USA)
The AI routing service through which we run AI processing is based in the United States. When you use DecksMD Pro, the content described in section 3 is transferred to the USA.
The routing service in turn forwards the request to the respective model provider, which performs the actual processing. Those providers are sub-processors of the routing service and may be based in the USA or in further third countries. Which provider is used depends on the subject area and the quality tier selected, and may change.
The USA is a third country without a blanket adequacy decision covering all recipients. The transfer is based on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR), which form part of our agreement with the routing service.
Despite those safeguards, it cannot be entirely ruled out that US authorities may demand access to data under US law, and that you would not have remedies comparable to those under EU law. We draw your attention to this risk explicitly.
A copy of the safeguards is available on request at support@decksmd.app.
5. Account and sign-in
You need an account for DecksMD Pro, and to study decks from the deck directory on the website (section 10).
| Data | Purpose | Legal basis |
|---|---|---|
| Email address, user ID | Account management, sign-in, linking the subscription | Art. 6(1)(b) |
| Password hash or Google sign-in | Authentication | Art. 6(1)(b) |
| Account status, timestamps | Performance of the contract | Art. 6(1)(b) |
Sign-in is handled by an authentication provider in a region inside the EU. Account emails (signup confirmation, password reset) are sent through an email delivery service, which processes your email address and delivery status in the USA under standard contractual clauses (Art. 46(2)(c) GDPR). These emails contain no open-tracking pixels and no click tracking. If you sign in with Google, Google transmits the data required for this (name, email address) to us; Google’s privacy policy applies additionally.
In the app you sign in on decksmd.app in your browser; the app then receives a device token (section 6). You can delete your account yourself at any time (section 13).
6. Device linking
Linking a vault in the plugin, or the app, to your account creates a device token.
- We store only a cryptographic hash of the token, never the token itself. The token cannot be derived from that value.
- We also store a label — your vault name for the plugin, “DecksMD mobile” for the app — a random device ID, and the times of linking and last use.
- On your device the token is kept with your API keys (section 2): in the app in the app’s own storage, in the plugin in the same file in the plugin folder of your vault.
- One-time linking codes are likewise stored only as a hash and expire after five minutes.
Legal basis: Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(f) GDPR — legitimate interest in securing access and in making linked devices visible and revocable to you.
7. Consumption and billing
Per account we store the tokens consumed and the cost incurred for the current day and month, the remaining free allowance, and monthly totals for previous months.
Purpose: enforcing the agreed usage limits, billing, and detecting abuse. Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR (legitimate interest in abuse prevention and cost control).
8. Payment processing
Purchases on the website
Sales on the website run through Lemon Squeezy LLC as Merchant of Record. You enter payment details (card data, billing address, tax details) directly with Lemon Squeezy; we neither receive nor store payment data.
From Lemon Squeezy we receive by webhook: subscription, customer, order and variant IDs, status, renewal and end dates, and the email address. We need these to link your subscription to your account and enable access.
Purchases in the app
If you subscribe in the app, the purchase runs through Apple’s App Store on iPhone and iPad, and through Google Play on Android. The store is the seller and handles payment, renewal, cancellation and refunds; we receive no payment data from Apple or Google.
To link the purchase to your account, the app passes your account’s user ID to the store with the purchase — to Apple as the “appAccountToken”, to Google as the “obfuscated account ID”. Our server then verifies the purchase directly with the store and receives its notifications about renewals, cancellations and refunds. Google delivers those notifications through a cloud messaging service, and our server confirms each new Google Play purchase to Google. We store Apple’s transaction and product IDs or Google’s purchase token and product ID, the subscription status, and the renewal and end dates.
Legal basis for both: Art. 6(1)(b) GDPR; for what we keep after an account is deleted, Art. 6(1)(f) GDPR (section 12).
9. Website, logs and analytics
Hosting: The website and the service run with hosting providers. Our database runs with its primary location inside the EU. On access the providers process technically necessary connection data including IP address. Legal basis: Art. 6(1)(f) GDPR (secure and functional provision).
Service logs: The service’s technical logs may contain your user ID next to technical events such as a usage-limit check or a subscription update — never content. They are deleted automatically after at most seven days. Legal basis: Art. 6(1)(f) GDPR (operating and securing the service).
Analytics: We use the web analytics of our website host. It operates without cookies and without cross-device recognition, collecting aggregate metrics such as pages viewed, country of origin and device type. No personal profile is created. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in statistical evaluation of usage).
Content from Apple and Lemon Squeezy: The home page loads the App Store badge image from Apple’s servers. The account and pricing pages, and the device linking page where it offers a subscription, load Lemon Squeezy’s checkout script so that checkout can open on the page. Your browser then connects to Apple or Lemon Squeezy, which receive your IP address and browser details, whether or not you buy anything. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in showing the official App Store badge and in offering checkout on our pages).
Fonts: The typeface we use (Inter) is served from our own servers. There is no connection to Google Fonts or any other font CDN, so no IP address is transmitted to a third party for this purpose.
Cookies and browser storage: We set only technically necessary cookies for your sign-in session. Your choice of light or dark appearance is kept in your browser’s storage and is not sent to us. No advertising or tracking cookies are set, so no consent is required (§ 25(2)(2) TDDDG).
Admin log: Administrative changes to accounts (such as blocking or enabling) are logged with a timestamp and the acting person. The deletion of an account is logged in the same way, with the user ID but without contact data. Legal basis: Art. 6(1)(f) GDPR (accountability).
10. Deck directory
In the deck directory at decksmd.app/decks we publish decks for studying. The deck directory terms apply.
Viewing. You can open deck pages with their preview cards without an account. Only the connection data and the analytics described in section 9 are involved. Everything on these pages, including the images in the cards, is loaded from decksmd.app.
Downloading. You can download decks without an account, from the deck pages and from the deck directory inside the app and the plugin. For a download from a deck page we create a download ticket that can be used once and is valid for ten minutes. For it we store a hash of the ticket, the deck and its version, when the ticket was created, expires and was used, and your user ID if you are signed in.
To prevent bulk downloading, we count how many decks each visitor adds without signing in per minute, using the visitor’s IP address. The count is kept only in the working memory of our hosting provider’s servers, is never written to storage, and is discarded a few minutes after the last add at the latest. For signed-in users we also limit the number of tickets per hour.
For the download itself we store only the deck, the version and the time — not who downloaded it. That gives the download count we show on deck pages.
Opening in the app or the plugin. With “Open in DecksMD” or “Open in Obsidian”, the website passes only the deck’s name and the ticket to the app or the plugin, which then downloads the deck directly from decksmd.app. The deck directory inside the app and the plugin loads the list of decks from decksmd.app and downloads a deck directly when you add it. The deck then lives in your vault (section 2). If a device is missing images for a deck it received through your sync, it fetches them from decksmd.app without signing in.
Studying on the website. To cram or take an exam on the website you sign in; the website then loads all of the deck’s cards into your browser. Your answers, ratings and results stay in your browser; we neither transmit nor store them.
Likes and comments. Signed in, you can like decks and comment on them. For a like we store the deck, your user ID and the time; deck pages show only the number of likes. For a comment we store its text, the deck, your user ID and the time, and the display name you choose for your comments. The text, the display name and the time are public on the deck page; your user ID and email address are not shown. To limit spam we count how many comments you posted in the last hour. When we delete a comment, at your request or in moderation, it is erased entirely. If you report a comment by email, we use your message only to review the report.
The directory’s technical logs are handled like the service logs (section 9).
Legal basis: Art. 6(1)(b) GDPR (providing downloads, study, likes and comments under the deck directory terms) and Art. 6(1)(f) GDPR (legitimate interest in preventing bulk downloading, spam and other abuse, and in moderating comments).
11. Recipients at a glance
Service providers acting for us
These providers process personal data only on our behalf and on our instructions. Each does so under a data processing agreement (Art. 28 GDPR) and is required to protect your data at least to the standard of this policy. We list them by category; on request we tell you the specific companies (Art. 15(1)(c) GDPR).
| Recipient (category) | Task | Data processed | Location |
|---|---|---|---|
| Hosting and network provider | Operation of the service, databases and deck directory | Connection data, account data | EU (database), global |
| Website host | Website hosting, analytics | Connection data, usage statistics | USA/EU |
| Authentication provider | Sign-in | Email address, user ID | EU |
| Email delivery service | Sending account emails | Email address, delivery status | USA |
| Cloud messaging service | Delivering Google Play’s purchase notifications to our server | Purchase token, type of notification | USA/EU |
| AI routing service, and the model providers it uses | AI processing for DecksMD Pro | The content you submit | USA |
Independent controllers
These recipients decide themselves how they use the data they receive. They process it under their own responsibility and their own privacy policies.
| Recipient | Role | Data processed | Location |
|---|---|---|---|
| Apple (Apple Distribution International Ltd., Apple Inc.) | App Store, purchases in the app, App Store badge on the home page | User ID, transaction and subscription data, connection data | Ireland/USA |
| Google (Google Ireland Ltd., Google LLC) | Google Play, purchases in the Android app | User ID, purchase and subscription data | Ireland/USA |
| Lemon Squeezy LLC | Merchant of Record for website purchases, checkout script | Payment and subscription data, connection data | USA |
| Google LLC | Only if you sign in with Google | Name, email address | USA |
Transfers outside the EU
Where a recipient processes data in the USA or another country outside the EU and EEA, the transfer is based on the EU-US Data Privacy Framework (Art. 45 GDPR) where the recipient is certified under it, and otherwise on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR). A copy of the safeguards is available on request at support@decksmd.app.
We do not pass your data to anyone beyond these recipients unless legally obliged to. A provider you choose yourself in the plugin or the app receives your content directly from your device and is not a recipient of ours (section 2).
The service providers we use may change over time. We update this overview accordingly; the version published on this page is the applicable one.
12. Retention
- Account data: for the life of the account; deleted when you delete the account (section 13), apart from what is listed below.
- Subscription data: for the life of the account. Once the account is deleted, only a stripped billing record remains: the user ID, the Lemon Squeezy, Apple or Google Play IDs, the status and the dates — no email address and no other contact data.
- Stripped billing record, record of payment notifications and admin log: kept for three years — the stripped billing record from the deletion of the account, each payment notification and admin log entry from when it was recorded — then deleted automatically. The notification record holds only event IDs and types; the admin log holds user IDs but no contact data. We keep them to handle refunds, chargebacks and reconciliation, and so that a late payment notification cannot recreate a deleted account. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in handling those cases). Invoices and receipts are issued and kept by Lemon Squeezy, Apple or Google as the sellers.
- Google Play notifications: held by the cloud messaging service only until our server confirms receipt, at most seven days.
- Device tokens: until the account is deleted; a revoked token no longer grants access.
- Linking codes: valid for five minutes; their hash is deleted with the account.
- Deck directory download tickets: valid for ten minutes; deleted automatically at the latest two days after they expire, also if you delete your account before then. The download count contains no personal data (section 10).
- Deck directory add limit: the per-visitor count is kept only in working memory and discarded a few minutes after the last add at the latest (section 10).
- Deck directory likes, comments and display name: until you take a like back, until we delete a comment at your request or in moderation, or until you delete your account. A comment hidden in moderation is kept, hidden, on the same terms.
- Monthly consumption totals: while the account exists. On deletion they are separated from your account and contact details. They can no longer be linked to you once the admin log and the stripped billing record are deleted after three years (see above).
- Service logs: at most seven days (section 9).
- Backups: deleted data can remain in backups until they expire — about 7 days for the sign-in database and about 30 days for the service databases (point-in-time recovery). Backups are used only to restore the service after a failure.
- Your content: not stored (section 3).
13. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21).
An informal message to support@decksmd.app is enough. We reply within the statutory period of one month.
Deleting your account
You can delete your DecksMD Pro account yourself: in the app under Settings → AI, in the “DecksMD Pro account” section, or on the website on your account page. Both ask you to confirm first. Deletion takes effect immediately:
- Pro access ends at once, including any paid time left in the current period.
- A subscription bought on the website is cancelled first. If that fails, nothing is deleted and you are told why.
- A subscription bought in the app on iPhone or iPad is billed by Apple and cannot be cancelled by us. Cancel it in your Apple ID settings, or Apple keeps charging you.
- A subscription bought in the app on Android is billed by Google Play and cannot be cancelled by us. Cancel it in the Play Store under Payments & subscriptions, or Google keeps charging you.
- Your sign-in (email address, password or Google link), device tokens, linking codes and email-related records are deleted. What remains is listed in section 12.
- Your likes, comments and display name in the deck directory are deleted.
- Your notes, decks and review history are in your vault and are not affected.
Lemon Squeezy, Apple and Google keep their own records of a purchase as sellers; to have those deleted, contact them directly. If you signed in with Google, you can also remove DecksMD from the apps connected to your Google account. You can still ask us by email to delete your account instead.
You also have the right to lodge a complaint with a supervisory authority. Ours is:
Berliner Beauftragte für Datenschutz und Informationsfreiheit Alt-Moabit 59–61, 10555 Berlin, Germany www.datenschutz-berlin.de
14. Changes to this policy
We update this policy when the service or the legal position changes. The version published on this page applies; the date above shows its status.