Privacy notice
Last updated: October 6, 2026
Contact Make AI Flashcards at hello@makeaiflashcards.com with privacy questions.
Your study material
PDF files are read locally in your browser. Your PDF bytes and rendered source images are not uploaded for generation. Pasted notes, extracted text, and your deck remain in this tab's memory. AI trial generations are currently unavailable. For AI requests, generated cards and their source quotations may be held temporarily for recovery, for up to ten minutes from the original request start. Non-content request proofs, usage and account or payment records may remain after recovery content is removed. The full submitted source text is not kept in this recovery record. Recovery access expires at that deadline. Cleanup removes expired recovery content from active storage when it runs; physical storage and infrastructure backups may follow separate retention processes. Closing, reloading, or clearing the workspace removes this working copy; download your deck if you want to keep it.
When you choose AI generation
Clicking Generate sends text from the selected pages, page numbers, and your requested card count to our generation service. The service forwards that text to its configured AI provider to create questions, answers, and source quotations. Avoid submitting personal, confidential, or sensitive material, and only use content you are allowed to process.
Generation uses Grok through the 9Router gateway. The gateway and the upstream Grok service receive the selected source text to produce the draft cards. Our application requests that responses are not stored, but this request is not a guarantee of zero retention by the gateway or upstream service. Their applicable processing, security-record and data-control policies still apply. See the Grok provider's privacy information for its services; the rules that apply depend on the service used.
Before generation, selected source text is sent to Waffo for a prompt safety check. Our safety logs do not store the submitted text. Waffo prompt scanning does not provide complete coverage of policies for educational or other text. Waffo and generation providers apply their own handling and retention terms.
Hosting and technical records
The website and generation API run on our Hostinger VPS. Our hosting service processes technical connection information to deliver the website and protect it from abuse. Generation limits use a network-address hash that changes each UTC day. A daily budget record stores only these hashes and request counts, removed from active storage by hourly cleanup after that budget day has been over for one day. Infrastructure backups and service records can follow their own retention periods. Application logs contain request status, timing, page counts and card counts; our application does not log your submitted text or generated answers. Hosting and AI providers may keep their own service and security records.
Accounts, cookies, and exports
The free tool does not require an account. Buying or using paid credits requires an account. We store your account email and verification status. Google sign-in provides your email, verification status, name, profile picture, and a unique Google account identifier. We use these identity details to create and recognize your account and keep its credits and orders together. We do not request access to Gmail, Drive, or Calendar. Google authorization records and access tokens are stored for the authentication flow and are not used to read those services. Current sign-in uses Google only; email-code sign-in is disabled. You do not need a recovery file. Essential, HttpOnly cookies keep you signed in for up to 30 days, with renewal during continued use. Session records include your IP address and browser information for account security. A cleanup runs every minute to remove expired sessions, verification records, and email-request limits from active storage. Infrastructure backups can follow their own retention periods. We keep purchase references, payment state, credit balances and a usage ledger to deliver paid service and resolve payment issues. Waffo processes payment details for current purchases under its own privacy notice; we do not store your card number. Your browser session may retain the identifier of your latest paid generation for recovery, but not the source text. It does not use advertising trackers. Optional Google Analytics remains off unless you consent as described below. Anki packages, CSV files and print previews are produced in your browser. Exports can include source quotations and PDF page images, so review them before sharing.
Payments and support
We use Waffo for current checkout. Review Waffo’s privacy notice on the checkout page before paying. Existing historical PayPal order records remain subject to PayPal’s privacy notice. Payment and credit records are retained while needed to provide your account, resolve disputes and meet accounting requirements. Email hello@makeaiflashcards.com to request access, correction or deletion of your account records. We may ask you to verify account or record ownership before acting. Records needed for account security, payment disputes, accounting or legal requirements may be retained; this does not promise deletion of provider records or every physical storage copy. Do not include a sign-in code in support messages. Earlier anonymous credit holders may use their old recovery code once to move credits and orders into a verified account; the old code is then retired.
Optional analytics
Google Analytics 4 is off by default. Its script is not loaded and no analytics request is made unless you accept analytics. After consent, Google Analytics may set first-party _ga cookies with a pseudonymous browser identifier and receive approximate location, browser and device information, a sanitized page path and sanitized referrer.
This release measures consented page views only. Tool completion and export events are not connected in this production overlay. We do not send uploaded files, file names, source text, generated cards, form values, email addresses, account identifiers, payment details, query strings or URL fragments. Analytics settings lets you reject or withdraw consent for later activity. See Google's privacy policy.
Your choices
You can use the example deck or manually create and export cards without sending study material to an AI service. Choose Clear workspace to remove the in-memory copy. Files you downloaded remain on your device until you delete them.