Legal
Privacy Policy
Last updated: 12 August 2026 · Effective date: 12 August 2026
1. Data controller
The Kardi App mobile application (the "App") is published by:
- Legal name: Amuseemus
- Legal form: SAS (Société par Actions Simplifiée)
- Registered office: 32 Allée de la Robertsau, 67000 Strasbourg, France
- Registration number (SIRET): 100 328 616 00014
- Support / privacy contact: dev@amuseemus.com
(hereinafter "we", "our"). This policy explains how we collect, use and protect your personal data when you use the App, in accordance with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act as amended.
2. Scope
Applies to Kardi App on Google Play and the App Store, and related API services at api.kardi.website. Does not cover third-party sites we may link to.
3. Data we collect
3.1 Account & sign-in
We do not access Google/Apple contacts, photos, Drive, etc. OAuth tokens are used to verify identity; we do not store Google/Apple refresh tokens for browsing your accounts.
| Data | When | Purpose |
|---|---|---|
| Email sign-up / OAuth | Account, sign-in, service messages | |
| Password (hashed) | Email sign-up | Authentication |
| Display name | Optional / from OAuth | Profile |
| Google account identifiers | Google Sign-In | Authentication only |
| Apple identity token claims | Sign in with Apple | Authentication only |
3.2 App content you create
Flashcards, decks, review progress, language preferences, and similar learning data — to provide the core study features and sync across devices.
3.3 Purchases
Subscriptions are processed by Apple / Google via RevenueCat. We receive entitlement status (e.g. whether you have Pro), product identifiers, and expiration — not your full payment card number. Paid-plan terms, cancellation, and withdrawal are in the Terms of Service. If you request a refund from Apple, we may share limited usage information with Apple so it can decide the request.
3.4 Technical & diagnostics
We do not use advertising IDs (AAID/IDFA) for ads. The App contains no third-party advertising.
| Data | Purpose |
|---|---|
| IP address, basic request metadata | Security, abuse prevention, logs |
| Device language / locale | UI localisation |
| Crash/error reports via Sentry (when enabled) | Reliability |
3.5 What we do not collect
Precise GPS location, contacts, photos, microphone, or calendar — unless a future feature asks for explicit permission (this policy will be updated first).
4. Purposes & legal bases
| Purpose | Legal basis |
|---|---|
| Provide accounts, sync, study features | Contract (Art. 6(1)(b)) |
| Google / Apple sign-in | Contract / consent to the provider flow |
| Subscriptions & entitlements | Contract |
| Security, fraud prevention, logs | Legitimate interest (Art. 6(1)(f)) |
| Crash reporting (Sentry) | Legitimate interest |
| Legal obligations | Legal obligation (Art. 6(1)(c)) |
5. Processors / recipients
Transfers outside the EU use appropriate safeguards (e.g. SCCs) where required.
| Recipient | Role |
|---|---|
| Hosting for api.kardi.website / kardi.website | Hosting |
| Google (Sign-In, Play, optionally Cloud TTS) | Auth / store / speech |
| Apple (Sign in with Apple, App Store) | Auth / store |
| RevenueCat | Subscription status |
| Sentry | Crash/error diagnostics |
6. Retention
| Data | Retention |
|---|---|
| Account + learning content | Until you delete the account, or after a reasonable inactivity period |
| Subscription records | As needed for accounting / store obligations |
| Logs / security | Short rolling window |
| Crash reports | Per Sentry retention settings |
7. Your rights (GDPR)
Access, rectification, erasure, restriction, portability, objection, and complaint to a supervisory authority (in France: CNIL).
In-app account deletion is available in Settings. You may also email dev@amuseemus.com. Deleting the account does not cancel a store subscription — see Delete your account.
8. Children
The App is not directed at children under 13. Where local digital-consent age is higher (e.g. 15/16), that local age applies.
9. Changes
We may update this policy; the current version is always at https://kardi.website/privacy and (when linked) in the App. Material changes will be communicated in-app or by email when appropriate.
10. Contact
Email: dev@amuseemus.com
Postal: Amuseemus SAS, 32 Allée de la Robertsau, 67000 Strasbourg, France