1. What this policy covers
This policy describes how Zuppi processes data when you visit the site, create flashcards, study, or use an account.
2. Data we use
We use the data needed to provide the service and support your studies.
- Account data, such as email, access identifier, language, and time zone.
- Study data, such as collections, flashcards, ratings, sessions, and objectives you choose to create.
- Technical security and service data, such as error records, usage-limit signals, and product events without the source material you submitted.
- Usage events containing the milestone name, time, language, and limited properties, associated with a random cookie identifier that is hashed on the server.
3. Text, PDFs, and AI generation
When you submit text or a PDF to generate flashcards, the content is processed to produce the response you requested. Source material is not persisted in collections, history, or product analytics events.
Generation is assisted by AI. Review the result before using it as study material: the tool can make mistakes or simplify information.
4. Where processing happens
We use technical providers to host the application, authenticate accounts, store study data, and process generations. When you sign in with Google, the authentication provider receives the information needed to confirm your identity.
- Supabase for account and study authentication and data.
- Google for the sign-in you choose and AI generation.
- Cloudflare to deliver the site and the application.
- Railway to run the application server.
- Stripe to process payments and Apoiador subscriptions.
- Cloudflare R2 to briefly hold larger PDFs during generation; the file is deleted afterwards.
5. Your controls
You can edit your flashcards, end a session, and delete your account using the controls available in the app. To request access, correction, or deletion that you cannot complete in the app, use the contact below.
6. Product measurement
We measure steps such as visits, starts, generations, first answers, study completion, authentication, import, and return activity to understand where the experience works or fails. These events do not include your email, submitted text or PDF, or the content of questions and answers.
The random analytics identifier is not used for advertising. Events are retained for up to 180 days, and operational queries are restricted to the service.
7. Security and changes
We apply access controls and rely on specialized providers to operate the service. No system removes every risk; do not submit content you would not want processed to create flashcards.
We may update this policy as the product changes. The date at the top identifies the version in force.