Privacy

Effective September 21, 2026 · applies to crammed.study and the Crammed mobile apps

What we collect

• Your email address, when you make an account. It is how we know an account is yours. With Google or Apple sign-in, we take only your verified email (Apple may give us a private relay address instead, which is fine).
• A username and password. The password is stored as a hash, never as text. Sign in with Google or Apple needs no password.
• Your avatar, if you set one, including a Google profile photo if you choose to use it.
• Your study data: decks, cards, folders, and review history. It is stored so it can sync across your devices. As a guest, it lives only in your browser and never reaches our servers.
• Product usage events, tied to a random device id. Things like "a set was imported" with a count, which page you landed on, which button you pressed (by its name, never its text), and where you came from (a referring site or a campaign tag). An allowlist blocks anything else, so events can never contain your card text or anything you wrote. We use no third-party analytics and no advertising trackers.

The app keeps a sign-in token and a random device id in your browser's local storage. Sessions last 60 days. The only cookie is a short-lived one set while an email sign-in link is open, to prove the link was opened in the same browser that asked for it. It tracks nothing.

Our database stores no IP addresses. Our host keeps ordinary server logs for a short time, like any website.

How Learn chooses answer options

When you use Learn while signed in, Crammed sends the current question and candidate cards to TypeSafe's Jev through OpenRouter to rank plausible wrong answers. We send card text, not your email, username, or review history. Every displayed answer comes from your deck; Jev does not write cards or generate answer text. Rankings are reused until the deck changes. Offline and guest sessions use choices selected on your device.

Our ranking cache contains scores and hashed content references, not plaintext cards or an account identifier. Those cache entries expire after 30 days. Your device also saves rankings for offline reuse, and signing out clears them with the rest of your local study data.

When you import a set from a Quizlet print-out, the file is read inside your browser and never uploaded. Anything you paste is turned into cards on your device. What reaches our servers is the finished cards, and only when you are signed in so they can sync.

What is public

• Every set has a public page at a fixed link, like Quizlet. Anyone with the link can open it. The link is long and random, so nobody finds it by guessing. It shows the set, your username, and your avatar.
• That link is permanent. Deleting a set removes it from your library and nothing else. The page keeps serving the set's last content, so a link you gave your class keeps working. This is a deliberate promise.
• Share links you make on top of that can be revoked any time, from the same place you made them.

If a set should never have been public, delete it from your library and email us; we will take the page down by hand.

Deleting your account

Delete it from inside the app, no email, no waiting. Deletion removes your email, username, password, avatar, decks, cards, folders, review history, share links, public set pages, sign-in tokens, and device records from our servers. If you had a paid plan, it is cancelled first, and deletion refuses if that fails, so nothing keeps charging you.

Anonymous usage events keep existing, with the link to your account removed: a device id and counts, no content and no identity. Without them, deleting and remaking an account would reset every limit.

Payments

Crammed charges nothing today. If a paid plan ever launches, payments run through Stripe as merchant of record, and card numbers never touch our servers. We would keep only a payment reference.

How cards are read aloud

When you open a set while signed in, Crammed sends a sample of each side's card text to Google Cloud Translation to detect its language, so the right voice reads it. When you press the speaker, it sends that side's text and language to Google Cloud Text-to-Speech, which returns the audio. We send card text, not your email, username, or review history. The voice reads exactly what the card says. We keep the audio, keyed by a hash rather than the text itself, so the same side is not sent again. Signed out or offline, your browser's own voice reads the card on your device.

Where your data lives, and who touches it

Servers are hosted on Railway in the United States. The services that see any of your data, each only for its one job: Resend (delivers sign-in and password emails), Google and Apple (optional sign-in), OpenRouter and TypeSafe (ranking Learn answer choices), Google Cloud (reading cards aloud), and Stripe (payments, only if a paid plan exists). We do not share data for advertising. We sell data to no one, ever.

Odds and ends

• Crammed is not directed at children under 13.
• Signing out wipes your study data from that device. Signing back in restores it from the server.
• Deleting your account ends your sessions everywhere.
• If this policy materially changes, the date above changes and we say so in the product, not bury it.

Contact

Questions, or anything this page should answer and doesn't: hello@crammed.study.