Privacy Policy

This Privacy Policy explains what information the AI Flashcard Maker browser extension (“the extension,” “we,” “us,” “our”) collects, how it is used, where it is stored, and the choices you have. AI Flashcard Maker is an independently developed extension, not operated by a separate legal entity; “we” refers to the individual developer who publishes and maintains it. This policy is written to match the data disclosures we file in the Chrome Web Store.

The short version

• Your flashcards and decks stay on your device. They live in your browser’s local storage and are never uploaded to us. They only leave your device if you export them to an Anki or Quizlet file.
• We only send the text you deliberately select. When you create a card or request a translation, the extension sends the selected word or phrase plus the sentence around it (for context) — not the page you are reading.
• No accounts, no sign-in, no email required. The extension identifies your install with a random, anonymous device token, not with your identity.
• No analytics, no advertising, no trackers, no cookies. We do not profile you.
• We never sell or rent your data.

Who this applies to

AI Flashcard Maker is a Chrome / Chromium extension (Chrome, Edge, Brave, Arc, and an in-page panel fallback for Opera and Vivaldi). This policy covers the extension and the project backend it talks to at https://api.flashcard-maker.com.

What data we collect

The extension collects data only when you actively use a feature that requires it. Selecting text alone sends nothing — a network request happens only when you act (tap Create Flashcard, use the right-click menu, generate a card, or submit feedback).

1. Text you select, for card generation and translation

When you tap Create Flashcard in the popover, use the “Create flashcard from selection” right-click item, or generate a card in the manual flow, the extension sends the following to the project backend:

• The word or phrase you selected (up to 100 characters for a word, 250 for a phrase).
• The surrounding sentence (“source context,” up to 200–250 characters), extracted from the page so the generated card is accurate in context. This is the sentence containing your selection — not the full page.
• The source and target language codes for the card.

The backend uses this to produce the card fields (translation, lemma, part of speech, register, CEFR level, an example sentence, and language-specific metadata). For a quick popover translation, the extension first tries your browser’s built-in on-device translator and only falls back to the backend when the browser cannot translate the language pair (see How card generation and translation work).

2. An anonymous device identity

On first use, the extension generates, locally on your device:

• A random device ID, and
• An ECDSA P-256 signing key pair (the private key is non-extractable and never leaves your device).

It exchanges the public key with the backend for a device token. The device ID and token are then sent with backend requests so the backend can authenticate the device and apply per-device rate limits. None of this is linked to a user account, an email address, or a name — it is an anonymous token, not an identity.

3. Anonymous device metadata at registration

The one-time device-registration request also includes lightweight, non-identifying metadata used for compatibility and diagnostics:

• Your browser’s user-agent string, truncated to 256 characters.
• Your browser’s language (e.g. en-US), truncated to 32 characters.
• The extension version.

4. Support / feedback you choose to submit

If you open the in-app feedback form and press Send, the extension transmits:

• The message you wrote (up to 500 characters).
• Lightweight diagnostics: extension version, browser family (e.g. “Chrome 132”), operating system family (e.g. “macOS”), your interface language, the in-app screen you contacted us from, and an anonymous install ID (a random identifier used only to de-duplicate repeat submissions). For devices that have already registered, the anonymous device ID is also included so we can correlate support requests with backend logs.

The feedback form does not ask for, and does not collect, your name or email address. It never includes your device token, your signing key, any device fingerprint, or any flashcard/translation content. Nothing is sent unless you submit the form.

What we do not collect

• The pages you browse. We do not read, log, or transmit page content beyond the specific word/phrase and its surrounding sentence when you generate a card.
• Your browsing history, bookmarks, or search queries.
• Your IP address or precise location — the extension never reads, derives, transmits, or stores these. (For abuse prevention, your country is determined server-side at the Cloudflare edge purely to block a small set of high-abuse regions; the extension itself does not see or store it. As with any web service, the backend connection carries the standard network metadata inherent to HTTPS.)
• Your name, email address, or any account credentials — there are no accounts.
• Analytics or telemetry. The extension embeds no Google Analytics, Sentry, Mixpanel, Segment, or similar SDKs.
• Cookies or advertising trackers.
• Synced storage. The extension does not use chrome.storage.sync, so none of your data is uploaded to Google’s account-sync servers.

How card generation and translation work

To build a card, the backend processes the text you submit (the selection and its surrounding sentence) using OpenAI’s language models (currently gpt-4o-mini) and returns the translation, example, level, and other card fields. That text is used solely to fulfil your request; it is not used to show you advertising or to build a behavioral profile.

For the quick popover translation, the extension first uses your browser’s built-in on-device Translator API whenever the language model is already available locally — in that case no text leaves your device. Only when the browser cannot translate the pair does it fall back to the backend, which then uses Google Translate as the primary engine and DeepInfra (model Qwen/Qwen3-32B) as a fallback if Google Translate is unavailable.

Each provider’s privacy policy is linked under Third-party services below.

Please do not select text you consider confidential for card generation, since the selection and its surrounding sentence are transmitted for processing.

How and where data is stored

• Your decks and flashcards are stored locally in your browser’s IndexedDB (extension origin). Each saved card also records, locally only, the URL and a short label of the page you captured it from, so you can trace a card back to its source. None of this is uploaded to us; it leaves your device only if you export.
• Your settings (language pair, interface language, theme, popover on/off, active deck, Anki export options), the cached language-metadata definitions, and the anonymous device credentials are stored in chrome.storage.local on your device. The non-extractable signing key is held in a separate local IndexedDB store.
• Backend requests are sent over HTTPS to https://api.flashcard-maker.com. The backend uses card-generation and translation payloads transiently — to produce the response and to enforce per-device rate limits and abuse prevention — and does not persist them to a user-facing data store.
• Feedback submissions are delivered to an off-platform Google Apps Script endpoint that appends them to a private Google Sheet in the developer’s own Google account (see Third-party services).
• On first install, the extension opens a one-time welcome page hosted on the project’s own domain. This is a normal page visit and involves no special data collection.

Third-party services

• Project backend (api.flashcard-maker.com), fronted by Cloudflare. Operated by the developer of AI Flashcard Maker. Receives the selection/context and language codes for card generation and fallback translation, and the anonymous device registration data described above. Cloudflare provides the edge layer used for abuse prevention and region blocking.
• AI and translation providers used by the backend. The extension never contacts these directly — the backend relays the text you submit to them:
  • OpenAI — generates flashcard content (translation, example, level, metadata) from the text you submit for a card; model gpt-4o-mini. OpenAI states that data submitted through its API is not used to train its models by default. Privacy policy: openai.com/policies/privacy-policy.
  • Google Translate — the primary engine for the quick popover translation when your browser cannot translate the language pair on-device. Privacy policy: policies.google.com/privacy.
  • DeepInfra — the fallback engine for that popover translation; model Qwen/Qwen3-32B. DeepInfra states that it does not store, sell, or train on API inputs and outputs without consent (it may retain them briefly for debugging). Privacy policy: deepinfra.com/privacy.
• Google Apps Script and Google Sheets. When you submit the feedback form, your message and the diagnostics listed above are sent to a Google Apps Script web app, which records them in a Google Sheet in the developer’s own account. This is the only third-party destination for user-submitted content, and it is used solely to receive and triage support requests. See Google’s privacy policy: policies.google.com/privacy.
• Chrome built-in Translator API. Runs on your device; contacts no external translation service when used.
• Anki and Quizlet are export destinations you choose. The extension builds the export file locally; you import it into those apps yourself. The extension does not transmit your data to Anki or Quizlet.

Data sharing

We do not sell, rent, or trade your data. We do not share it with third parties for advertising or any purpose unrelated to the extension’s core functionality. The only parties that receive data are the service providers named above (the project backend, and the AI/translation providers it relays to — OpenAI, Google Translate, and DeepInfra — to generate cards and translations; plus Google Apps Script/Sheets, to receive support requests you submit). We may disclose information if strictly required by law or to protect the rights, safety, or security of our users and the service.

Data retention and deletion

Data on your device

• Settings → Danger Zone → “Clear All Data” removes every locally stored deck and flashcard. It preserves your settings, onboarding state, cached metadata, and the anonymous device credential so the extension keeps working without re-registration.
• Uninstalling the extension removes everything the extension stored on your device, including your decks and cards. Export first if you want to keep them.

Data on the backend

• Card-generation and translation payloads are transient and used only to produce the response and enforce rate limits.
• Anonymous device tokens persist until the device record is wiped (on request, or automatically after extended inactivity).

Feedback submissions

• Messages recorded in the feedback sheet are retained for up to approximately 12 months and then purged.

Your choices and rights

• Turn the popover off. Disable the on-selection popover entirely in Settings → Behavior; you can still capture via the right-click menu.
• Export your decks to Anki or Quizlet at any time to keep your own backup.
• Delete your data locally at any time via “Clear All Data” or by uninstalling.
• Depending on where you live (e.g. the EEA/UK under GDPR, or California under CCPA), you may have rights to access, correct, or delete personal data we hold. Because the extension holds no account or contact data about you, most such data never exists on our side; for any request, contact us at the address below.

Children

AI Flashcard Maker is not directed to children under 13 (or under 16 where a higher age of digital consent applies), and we do not knowingly collect their personal information.

International data transfers

The backend and the support/feedback services described above are operated on cloud infrastructure (including Google Cloud, Cloudflare, and Google’s services) that may process data in countries other than your own. By using the online features, you acknowledge that the limited data described in this policy may be processed in those locations, with appropriate safeguards.

Changes to this policy

We may update this policy as the extension evolves. Material changes will be reflected in the extension’s release notes, and the “Last updated” date above will be revised. We encourage you to review this page periodically.

Contact

Questions about this Privacy Policy or your data? Email aiflashcardmaker@gmail.com.