Privacy Policy

Pictocards is a flashcard app for young children, made to be used together with a parent, teacher, or carer. We’ve tried to keep this policy short and in plain language. It explains what we collect, why, who we work with, and the choices you have.

In short: we don’t sell your data, we don’t use advertising trackers, and no personal information is collected from children. On the website an adult account (just an email) is required; in the mobile apps an account is optional. We keep only what we need to run the service and meet our legal obligations. What exactly we collect depends on where you use Pictocards, so the details are split by platform: Website, iPhone and iPad app, and Android app.

1. Who we are

Pictocards is created by Pictocards (Jonathan Mathisen), Ärstavägen 10, 633 53 Eskilstuna, Sweden, and we are the controller of the personal data described here. For any privacy question, contact us at privacy@pictocards.app.

2. Children

Pictocards is designed for children aged 1 to 6, used with parental or therapist guidance, and the account belongs to an adult. We don’t let children create accounts or make purchases, and the app isn’t designed to collect any information directly from a child. Before reaching the shop, purchases, or settings, the app shows a “parent gate”: a quick interactive checkpoint meant to confirm an adult is present.

Because the app is used by children, we follow children’s-privacy rules including the EU and UK GDPR and the US Children’s Online Privacy Protection Act (COPPA). In practice this is straightforward for us: the app is built so that no personal information is collected from a child, and the only account is the adult’s. We do not knowingly collect personal information from a child under 13. If you add photos or recordings of your child to a custom deck on the website, they stay on your own device and are never sent to us (see Website). If you believe a child has given us personal information, email us at privacy@pictocards.app and we’ll delete it.

3. Why we use data

We use account data to create and run your account, give you access to what you’ve bought, record purchases, respond to you, and, on the website, send service emails and improve the app. Under the GDPR our legal bases are: providing the service you asked for (contract), meeting legal duties such as keeping tax and accounting records (legal obligation), and our legitimate interest in improving Pictocards and replying to you.

4. Your rights and choices

You can ask to see, correct, export, or delete your data, and object to or restrict certain uses.

• Export: on the website, when signed in, you can request a machine-readable copy of your data, sent to you by email. In the mobile apps, email us at privacy@pictocards.app and we’ll send you a copy. It does not include custom-deck photos or recordings, because we do not hold them.
• Delete: delete your account from Settings on the website or in the iPhone, iPad or Android app. This removes your profile and consent records. We keep only the purchase and accounting records the law requires (see section 5).

For anything else, email privacy@pictocards.app. You can also complain to a data protection authority. In Sweden, that is the Swedish Authority for Privacy Protection (IMY). If you are in the US, certain state laws may give you additional rights; contact us and we’ll help you exercise them.

5. Retention and deletion

We keep account data for as long as your account exists, and delete it when you delete your account. Even though our model is “pay once,” we’re legally required to keep certain purchase and accounting records for a period set by law, even after you delete your account. We keep these for 7 years, as required by the Swedish Bookkeeping Act (Bokföringslagen), and then delete them.

6. Who we share it with

We don’t sell your data. We share it only with the providers that help us run Pictocards, and only as much as they need. These apply on every platform:

• Supabase: database and login for the accounts and purchase records described below. Hosted in the EU (Ireland). It does not hold your custom-deck photos or recordings.
• Apple (App Store) and Google (Google Play): process purchases made in the mobile apps and may receive technical information (like your device’s IP address) as a normal part of that. This is handled under their own policies.

The providers used only on the website are listed under Website.

Your data is mainly stored in the EU/EEA. Some providers are based in the United States and may process limited data there. Where that happens, we rely on approved transfer safeguards, such as the European Commission’s Standard Contractual Clauses, to protect it.

7. Security

We take the security of your data seriously and use appropriate technical and organisational measures to protect it, including strict access controls so each account can only reach its own data, and EU-region hosting. Your custom decks are as safe as the device they are on, so please keep your device locked and up to date. No system is perfectly secure, but we work to keep risk low and to respond quickly if a problem arises.

8. Changes

If we make important changes, we’ll update the “Last updated” date above and, where appropriate, let you know by email or in the app.

9. Website (pictocards.app)

This section applies when you use Pictocards in your browser. You need an adult account to buy and access decks. We only collect what relates to the adult account holder:

• Email address: to sign you in (we email you a one-time code instead of using a password) and to send service messages like login codes, receipts, and replies.
• Name: optional, only if you choose to enter one. This is the adult account holder’s name, not a child’s.
• Language preference: the language you pick for the app.
• Purchase records: what you bought, the amount, the status, and a payment reference from our payment provider. We never see or store your card or bank details. Purchase records are kept as described in section 5.
• Custom deck slots: if you buy custom decks, the number of deck slots your account has. This is just a number.
• Consent records: a dated log of what the account has agreed to, so we can show it later.
• Basic usage: anonymous counts of which cards are tapped and in which language, so we can understand engagement and improve the website. These records contain no account, no identifier, and no timestamp, and cannot be traced back to you or to a child, so there is nothing in them to identify or delete. We don’t use advertising or cross-app tracking.
• Aggregate visit statistics: we use Cloudflare Web Analytics to count visits and page views, and to see which country and which referring site visitors come from, plus page-speed measurements. It uses no cookies, does not fingerprint your browser, does not track you across sites, and does not create a profile of you or your child.

Your custom decks stay on your device. Photos, voice recordings, deck names, and card names that you add to custom decks are saved only in your browser on your own device. They are never sent to us, so we cannot see, access, back up, or recover them. To erase them, use “Remove custom cards from this device” in Settings (this also happens automatically on the device where you delete your account).

We do not collect card or bank numbers (these go straight to our payment provider), and we don’t store passwords (there aren’t any; we use one-time email codes).

On the website we also work with these providers:

• Stripe: payment processing. Handles your card details directly; we only receive a payment reference.
• Resend: sending our emails (login codes, receipts, confirmations).
• Vercel: hosting and serving the website.
• Cloudflare: domain, email routing, basic security, and cookieless website analytics (aggregate visit counts and page-speed data).

Cookies and storage. We use only the essential cookies and local storage needed to log you in and keep the website working, plus on-device storage in your browser to keep your custom decks. That storage stays on your device and is never read by us or sent to us. We don’t use advertising or tracking cookies. See our Cookie Notice for more.

10. iPhone and iPad app

This section applies to the Pictocards app for iPhone and iPad.

• No statistics: the app collects no usage, tap or analytics data.
• No ads, no tracking: it contains no advertising and no third-party analytics, advertising, tracking or crash-reporting tools. It does not track you or your child across other apps or websites, and it does not use the advertising identifier (IDFA) or App Tracking Transparency.
• Optional adult account: an account is optional. The app works fully without one, including buying and restoring purchases (Restore works from your Apple ID). If you choose to create an account, we store your email address, name (optional), user ID and list of purchased decks, only for sign-in and for restoring your decks across devices. We email you a one-time code instead of using a password.
• Where it is stored: account data is stored with our processor Supabase in the EU (Ireland). We do not sell it or share it for advertising, analytics or marketing.
• Purchases: purchases are handled by Apple through the App Store (StoreKit). We never receive your payment details. Purchase records are kept as described in section 5.
• Bundled content: card images and sounds are bundled in the app. The app does not download content or send card interactions.
• Children: the app is made for young children to use together with a parent. No personal information is collected from children. Settings and the shop are protected by a parent gate.
• Account deletion: if you have an account, you can delete it in the app under Settings → Delete account. This deletes your account email, user ID and purchase record from our systems (except the records we must keep by law, see section 5). The purchases themselves stay with your Apple ID and can be restored there.
• Questions and requests: to ask about your data, or to request access or deletion, email privacy@pictocards.app.

11. Android app

This section applies to the Pictocards app for Android.

• No statistics: the app collects no usage, tap or analytics statistics.
• No tracking tools: it contains no third-party analytics, advertising, tracking or crash-reporting tools and does not track users across apps.
• Optional adult account: if you choose to sign in, we store your email address, user ID and list of purchased decks with our processor Supabase in the EU (Ireland). We use them only for sign-in and restoring purchases. We email you a one-time code instead of using a password. The app works without an account.
• Purchases: purchases are processed by Google through Google Play. We do not see payment details. To unlock what you bought, the app sends the purchase confirmation from Google Play to our Supabase service for verification. Purchase records are kept as described in section 5.
• Bundled content: card images and sounds are bundled in the app. The app does not download content or send card interactions.
• Parent gate: a parent gate protects purchases and settings. No personal information is collected from children.
• Account deletion: available in the app under Settings.

12. Contact

Questions about your privacy? Email privacy@pictocards.app, or write to us at Ärstavägen 10, 633 53 Eskilstuna, Sweden.