Privacy Policy

1. Who we are

Frase Cards is run from the United Kingdom by Joe Dimambro (17 Finsbury Road, Stockport, SK5 6EZ, United Kingdom), and we are the "controller" of your personal data under UK data protection law. You can reach us at joe@givingitajoe.com.

2. Information we collect

Account information

When you create an account we collect your email address and password (your password is hashed by our authentication provider — we never see or store it in readable form). You may also give us your name, which we use to personalise the app. We detect your device's time zone (for example "Europe/London" — not your precise location) so your daily review schedule lines up with your actual day.

Learning content and progress

We store the words and phrases you add, the example sentences generated for you, your review history (what you rated, and when), your settings, and your progress and mastery data. This is what makes the app work — without it we can't schedule your reviews or track your progress.

Subscription and payments

If you subscribe, payment is handled entirely by Stripe. Your card details go straight to Stripe and never reach our servers. We keep only your Stripe customer and subscription reference numbers and whether your subscription is active, so we know which features to unlock.

Emails

We send a welcome email when you sign up, and emails about your free trial (such as when it's ending). We record that those emails were sent so we never send the same one twice. If you tick the optional box at sign-up, we may also send occasional emails about features and tips — we store that choice and when you made it, and you can withdraw it at any time using the unsubscribe link in any such email.

Notifications, reports and requests

If you turn on reminders, we store the push-notification address your browser gives us for that device so we can send them. If you send us a bug report or request a language, we keep what you write (and, for a bug report, which page you were on) and the email address you give us, so we can respond.

Automatically collected information

Like virtually all web apps, our hosting provider (Vercel) processes standard technical information as part of normal operation — such as IP address and request timestamps. We don't use this for tracking or profiling; it exists to serve the app to you and keep it secure.

3. Why we use it, and our legal basis

• To provide the service you signed up for — running your account, scheduling reviews, generating sentences, and handling your subscription (this is the contract between us).
• To keep the app working and secure, and to tell you about your own trial or account (our legitimate interests, which we've weighed against your rights).
• To send marketing emails and push reminders — only if you've opted in (your consent, which you can withdraw at any time).
• To keep payment and tax records as the law requires (legal obligation).

We do not use your data for advertising, we do not sell it, and we do not make automated decisions about you that have legal or similarly significant effects.

4. Who we share information with

We use a small number of service providers ("processors") who help us run the app, and only share what each needs to do its job:

• Supabase — our database and sign-in provider. Stores your account and learning data.
• Anthropic — its AI models write and check your example sentences and dictionary lookups. It receives the word or phrase you're adding, its translation and the language — not your email, name or other account details.
• Vercel — hosts the app and processes standard web traffic as described above.
• Stripe — takes and manages subscription payments. Stripe is also an independent controller of the payment information it collects, under its own privacy policy.
• Resend — delivers our emails, so it processes your email address and the content of messages we send you.
• Push notification services run by your browser or device maker (such as Apple, Google, Mozilla or Microsoft) deliver reminders to your device if you turn them on.

We don't share your information with advertisers or data brokers. We may disclose information if the law requires it.

5. International transfers

Some of these providers are based in, or process data in, countries outside the UK (including the United States). Where that happens we rely on a recognised safeguard, such as the UK–US Data Bridge or the UK International Data Transfer Agreement / Addendum, so your information keeps an equivalent level of protection.

6. How long we keep it

We keep your data for as long as your account is active. If you delete your account (from Settings, at any time), your profile, words, sentences, review history and notification settings are deleted immediately — this isn't a "soft" deletion, and we can't recover it afterwards. Any active subscription is cancelled at the same moment.

A few things are kept for legal or practical reasons: payment records held by Stripe (and our own accounting records) for as long as tax law requires, and routine encrypted backups, which are overwritten on a rolling basis.

7. Your rights

Under UK data protection law you have the right to access the personal data we hold about you, to have inaccurate data corrected, to have your data erased, to restrict or object to certain processing, to receive your data in a portable format, and to withdraw consent at any time (for example by using the unsubscribe link in our emails or turning off notifications in Settings).

You can update your name and preferences, and permanently delete your account and data, yourself from Settings. For anything else — including asking for a copy of your data — email joe@givingitajoe.com and we'll respond within one month.

If you're unhappy with how we've handled your data, you can complain to the UK Information Commissioner's Office at ico.org.uk. We'd appreciate the chance to put things right first.

8. Security

Your data is protected by row-level security rules that ensure only you can access your own account data, and all traffic to and from the app is encrypted (HTTPS). Passwords are never stored in readable form. No online service can promise perfect security, but we take reasonable steps to protect your information.

9. Children's privacy

Frase Cards is not directed at, and we do not knowingly collect information from, children under 16.

10. Cookies

We use a small number of strictly necessary cookies to keep you signed in. We do not use advertising, analytics or tracking cookies, so there is no cookie banner to dismiss.

11. Changes to this policy

If we make meaningful changes to this policy, we'll update the date at the top of this page and, where the change matters to you, let you know.

12. Contact us

Questions about this policy or your data? Email joe@givingitajoe.com.