Privacy Policy

Last revised: November 11, 2026

DRAFT — COMPLETE ALL BRACKETED FIELDS, VERIFY YOUR PROVIDERS AND DATA REGION, AND REVIEW LOCAL LEGAL REQUIREMENTS BEFORE PUBLICATION.

1. Who operates Rolling Recall

Rolling Recall is operated by [LEGAL OPERATOR NAME AND ADDRESS] ("we", "us"). Contact us about privacy at [PRIVACY CONTACT EMAIL]. Privacy lead: [NAME OR RESPONSIBLE DEPARTMENT].

2. Information we process

We process account email addresses, authentication and security metadata, flashcard text you create or import, study progress, deck settings, and operational diagnostics generated by our hosting/authentication providers. Passwords are handled by our authentication provider rather than stored in application data tables.

3. Why we use it

We use this information to register and authenticate accounts, synchronize flashcards between devices, restore study progress, prevent abuse, maintain security, and respond to support and privacy requests. Specify your applicable lawful bases for each purpose before launch: [LAWFUL BASES AS APPLICABLE].

4. Storage, processors, and international transfers

We plan to use Supabase for authentication and database hosting, and [HOSTING PROVIDER] to serve this website. The production database region will be [ACTUAL SUPABASE REGION]. Service providers may process technical logs and account information as necessary to provide their services. Describe actual recipient entities, transfer countries, safeguards and processor arrangements here: [PROCESSORS / TRANSFER DETAILS].

5. Retention and deletion

Card content and account information are retained while an account is active, subject to [RETENTION AND LEGAL PRESERVATION PERIODS]. On a verified deletion request, we will delete data in accordance with applicable laws and document any limited retention required for legal or security purposes. Backups and security logs may be retained for [PROVIDER BACKUP / LOG RETENTION PERIOD].

6. Local storage

Rolling Recall uses browser local storage to remember sign-in sessions and maintain a per-account backup of study data for interrupted connections while you are signed in. Local copies are removed on sign-out. You can also clear stored data using your browser's settings. Clearing it may sign you out or remove local unsynchronized changes. We do not include advertising trackers in this release. Reassess this section if you add analytics or marketing tools.

7. Sharing

Flashcards are private to the account that created them under our database access rules. We do not build a public card-sharing feature in this version. We may disclose information when legally required, or to the providers described above to run the service. Complete any other disclosures before launch.

8. Your rights

Depending on where you live, you may request access to, correction of, export of, or deletion of your information, and may have additional privacy rights. You can export study data within the app. For other requests contact [PRIVACY CONTACT EMAIL]; we may need to verify that you control the account.

9. Security

We use authenticated requests, encrypted HTTPS connections, and per-account database access controls. No online service can guarantee absolute security. Report concerns to [SECURITY CONTACT EMAIL].

10. Children

This service is not designed for children below [APPLICABLE MINIMUM AGE]. Set and enforce an appropriate eligibility policy for the jurisdictions where you launch.

11. Updates

We may revise this policy to reflect changes to the service or legal requirements. Significant changes will be communicated where required.