Privacy Policy

1. Introduction

Revu ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and store information when you use Revu, a spaced repetition learning platform available at revu.cards.

TL;DR: Your study data is yours. We only process what is necessary to provide the service. We do not sell your data, run ads, or track you across the web.

2. Information We Collect

2.1 Study Data

Revu stores your study data to provide the service, including:

• Courses, flashcard decks, and cards (content, tags, metadata)
• Uploaded source materials (PDFs, notes, text)
• Study history and review logs
• FSRS scheduling state (intervals, difficulty, stability, due dates)
• User preferences and settings
• Attached media files

2.2 Account Information

When you create an account, we collect:

• Email address
• Display name (optional)
• Authentication tokens
• Plan and subscription status
• Usage counters (e.g. AI uploads used this month)

2.3 AI Feature Usage

When you use AI-powered features (card generation, content rewriting, practice exams), we process:

• Content you submit for AI processing (text, PDFs, notes)
• Generated flashcards and explanations
• Usage metadata (token counts, model used, timestamp)

AI processing is performed server-side. Your submitted content is sent to our AI provider (Anthropic) solely to fulfill your request. We do not train models on your data.Anthropic's API usage policy governs how they handle API inputs; they do not use API data to train their models by default.

AI features are entirely optional. You can use Revu indefinitely without ever submitting content to an AI model.

2.4 Analytics and Diagnostics

We do not use third-party analytics, behavioral tracking, advertising pixels, or crash reporting tools. Revu does not embed Google Analytics, Mixpanel, or similar services.

3. How We Use Your Information

• Study Data: To provide review sessions, FSRS scheduling, coverage tracking, and in-app analytics
• Account Information: For authentication, subscription management, plan enforcement, and account recovery
• AI Content: To generate flashcards, rewrite content, create practice exams, or provide explanations — as explicitly requested by you
• Payment Information: Processed exclusively by Stripe. We never receive or store your full card details
• Usage Counters: To enforce plan limits (e.g. 3 AI uploads/month on the Free plan)

We do not use your data for advertising, profiling, or any purpose beyond operating the service you signed up for.

4. Data Storage and Security

4.1 Infrastructure

Your data is stored in Supabase's PostgreSQL database and object storage, hosted on AWS infrastructure in the United States. All data is encrypted in transit (TLS 1.3) and at rest (AES-256).

4.2 Access Controls

Access to your data is restricted to your account via Supabase Row Level Security (RLS) policies. No other user can access your data. Administrative access to the database is limited to service operators.

4.3 Data Retention

We retain your account data and study content for as long as your account is active. If you delete your account, all associated data — including study history, cards, and uploaded files — is permanently removed within 30 days.

5. Data Sharing and Third Parties

We share your information only with the following service providers, and only to the extent necessary to operate the service:

• Supabase: Database, authentication, and file storage (all user data)
• Anthropic: AI model inference for card generation and content features (only content you explicitly submit for AI processing)
• Stripe: Payment processing and subscription management (billing information only)
• Vercel: Application hosting and edge delivery (request metadata; no persistent storage of user content)

We may also disclose your information if required by law, court order, or to protect the rights and safety of Revu or others.

We do not sell, rent, or trade your personal information to any third party.

6. Your Rights and Choices

6.1 Data Access and Export

You can export all your study data at any time from Settings → Data. Exports include all cards, review history, and scheduling state in JSON format.

6.2 Data Deletion

You can delete your account and all associated data from Settings → Account. Deletion is permanent. All data is removed within 30 days of account deletion.

6.3 Opt-Out of AI Features

AI features are entirely optional. You may use Revu — including all flashcard, review, and scheduling features — without ever using AI-powered card generation.

6.4 Corrections

You can update your account information (display name, email) directly within the app. For other corrections, contact privacy@revu.cards.

7. Children's Privacy

Revu is not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account or provided us with personal information, please contact us at privacy@revu.cards and we will delete the information promptly.

8. International Data Transfers

Revu is operated from the Netherlands and your data is stored on servers in the United States (AWS via Supabase). By using the Service, you acknowledge that your data may be transferred to and processed in the United States, which may have different data protection laws than your country of residence.

For transfers from the European Economic Area, we rely on Standard Contractual Clauses as the legal transfer mechanism where applicable.

9. European Privacy Rights (GDPR)

If you are located in the European Economic Area, United Kingdom, or Switzerland, you have the following rights under the GDPR or equivalent legislation:

• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate or incomplete data
• Erasure: Request deletion of your personal data (right to be forgotten)
• Restriction: Request that we restrict processing of your data
• Portability: Receive your data in a structured, machine-readable format
• Objection: Object to processing based on legitimate interests
• Withdrawal of consent: Withdraw consent at any time where processing is consent-based

Our legal basis for processing is contractual necessity (to provide the service you signed up for) and legitimate interests (to operate and improve the service). AI feature processing is based on your explicit consent at the time of use.

To exercise any of these rights, email privacy@revu.cards. We will respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority (in the Netherlands: Autoriteit Persoonsgegevens).

10. California Privacy Rights (CCPA)

California residents have the following rights under the CCPA:

• Know what personal information is collected and how it is used
• Request deletion of personal information
• Opt-out of the sale of personal information — we do not sell personal information
• Non-discrimination for exercising CCPA rights

To exercise these rights, email privacy@revu.cards with "CCPA Request" in the subject line.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Post a notice within the platform
• Send an email to your registered address for significant changes

Continued use of Revu after changes take effect constitutes acceptance of the updated policy.

12. Contact Us

If you have questions or concerns about this Privacy Policy or how we handle your data, please contact us: