Privacy Policy

• Account data: your email address, and a display name and profile picture if you sign in with Google. You can sign in with Google or with an email address and password. We never receive your Google password.
• Age confirmation: a confirmation at sign-up that you are 16 or older. We do not collect your date of birth.
• Study data: the decks, vocabulary, and study progress you create or upload, stored so we can sync them across your devices (cloud-primary for Max).
• AI request data: the words, sentences and deck content you submit to AI features — and, if you use photo scanning to build a deck, the photograph you upload.
• Support data: if you send a bug report, the text you write and any screenshot you choose to attach.
• Subscription data: your plan, trial status, and a Stripe customer/subscription ID. We do not store your full card number.
• Technical data: minimal logs (e.g., access and error logs) needed to run and secure the Service.

We do not sell your personal data.

• Provide and sync the Service (performance of our contract with you).
• Generate AI study aids you request (performance of our contract).
• Process subscriptions and billing (contract / legal obligation).
• Prevent abuse and secure the Service (legitimate interests).
• Communicate about your account (e.g., trial-ending and billing emails): contract / legitimate interests.
• Comply with legal obligations (e.g., tax, accounting): legal obligation.

We use the following providers. We rely on their Data Processing Agreements (DPAs) and, for transfers out of the EU/UK, on their Standard Contractual Clauses (SCCs) and/or Data Privacy Framework participation.

Important note on the AI provider (OpenAI). When you use an AI feature, we send OpenAI the specific content that feature needs — the word or deck content you are studying, and, for photo scanning, the image you upload. We do not send your password, and we do not include your email address or account identifier in the request itself. Please do not submit personal, sensitive, or confidential information to AI features, and do not photograph pages containing information you would not want processed by a third party.

If you supply your own OpenAI key. The app lets you enter a personal OpenAI API key. If you do, AI requests go directly from your browser to OpenAI under your own OpenAI account — they do not pass through rikai’s servers, and that content is governed by your agreement with OpenAI. The key is stored only in your own browser.

Your account and study data are stored in our database, which is hosted in the United States. We protect it with per-user access controls (Row-Level Security) so other users cannot read your data, plus reasonable technical and organizational safeguards. No system is perfectly secure.

Study progress is also kept on your own device so the app works offline. Clearing your browser storage removes that local copy.

Your data may be processed in countries other than where you live, including the United States. Where we transfer personal data from the EEA or UK, we rely on appropriate safeguards such as our providers’ Standard Contractual Clauses and/or Data Privacy Framework certifications.

We keep your data while your account is active. When you delete your account, we delete or anonymize your personal data within 30 days, except records we must keep for legal, tax, or billing reasons (typically up to 7 years for financial records). Backups containing your data are purged on our regular rotation within 90 days.

You can edit or delete your decks at any time. To delete your account and its associated data, email support@rikai.cloud and we will action it for you — there is currently no self-service delete button in the app.

Depending on where you live, you may have rights to:

• Access the personal data we hold about you;
• Correct inaccurate data;
• Deleteyour data (“right to erasure”);
• Port / export your data;
• Object to or restrict certain processing; and
• Withdraw consent where processing is based on consent.

EU/UK (GDPR / UK GDPR): you may also lodge a complaint with your local supervisory authority. California (CCPA/CPRA): you have rights to know, delete, correct, and to opt out of “sale”/“sharing” of personal information. We do not sell or share your personal information for cross-context behavioral advertising. We will not discriminate against you for exercising your rights.

We respond to verified requests within the timeframes required by law (e.g., about 30 days under GDPR; 45 days under CCPA, extendable).

If a data breach affects your personal data, we will notify the relevant authorities and affected users as required by law (for example, within 72 hours of becoming aware, to the relevant EU/UK supervisory authority, and to affected users where required).

rikai is not directed to children under 16 (or the local minimum digital-consent age, if higher). We do not knowingly collect personal data from children under that age. We use an age confirmation at sign-up; if we learn we have collected a child’s data without proper consent, we will delete it. If you believe a child has provided us data, contact support@rikai.cloud.

We use only the cookies/storage needed to keep you signed in, remember your language preference, and run the Service. We do not use advertising cookies.

We use Vercel Analytics and Vercel Speed Insights to measure page views and performance. Inside the app, we also record basic product-usage events (for example, which features are opened) so we can see what is being used.

The free vocabulary level checker records anonymous, non-identifying usage data (such as which questions were answered, how they were answered, and where in the checker someone stopped) so we can improve its accuracy. This data is not linked to your name, email, account, or IP address.

We will post updates here and update the Version and Last updated date. For material changes we will notify you in-app or by email.

Privacy questions or requests: support@rikai.cloud.