Privacy Policy

1. Who this policy covers

This Privacy Policy applies to the NeuroDeck website, study app and related support communications. “NeuroDeck”, “we”, “us” and “our” refer to the operator providing this service. For questions about our use of your information, contact neurodeck.mlm@gmail.com. This is also the contact for privacy requests and information about the operator responsible for your data.

The policy explains our purposes for processing information, the services involved and the controls available to you. It is a privacy notice, not a request for blanket consent. Using the app, accepting the Terms of Service or acknowledging the cookie popup does not waive your data protection rights.

3. Account, profile and sign-in information

When you register or sign in, Firebase Authentication processes your account credentials and authentication identifiers. Depending on your sign-in method and profile choices, information available to NeuroDeck includes your account ID, email address, display name, profile image and linked sign-in providers. If you choose Google sign-in, Google supplies the profile information authorised through that sign-in flow.

Passwords are handled through Firebase Authentication. They are not included in your study-library or chat records. We use authentication tokens to verify requests to the app’s backend. Do not send a password, access token or recovery code when contacting support. Information required for sign-in is necessary to provide an account; without it, account-based features cannot operate.

4. Study materials, documents and activity

We process the subjects, folders, decks, questions, answers, notes, document text and other materials you add or edit. Original uploaded documents can also be stored so that you can reopen them. File information can include the filename, format, size and storage identifier. Uploading a document may make its contents available for the study features you choose to use.

Study records include your answers and ratings, review schedules, checkpoints, settings, study time, streaks, activity dates, planned sessions and progress statistics. These records support revision and resuming a session. A progress score is a learning aid, not an official assessment or an independently verified measure of ability.

5. Axon, AI processing and web search

Axon uses Groq’s API to generate responses and flashcards. An AI request can include your current message, recent conversation messages, instructions and relevant context from your study library or documents. Some context can be shortened to fit request limits. Information may therefore be sent to the AI provider even when you have not pasted that information into the latest message.

Axon can also use a browser-search tool supplied through the AI service. Search queries derived from a request may be processed by that tool and its providers. Avoid including confidential or sensitive information in material you ask Axon to search or explain.

We do not promise that AI processing has zero retention or that every provider setting prevents all storage. Provider handling depends on the applicable service terms, account configuration and processing purpose. See Groq’s data information. Deleting an in-app chat does not itself recall a request already processed by an external provider.

6. Google Calendar and optional connections

If you connect Google Calendar, the Google authorisation flow requests calendar-events permission. The permission is broader than simply displaying a calendar icon: it can permit reading and changing events. NeuroDeck’s implemented integration uses it to create planned study events, remove linked events when requested, and check the status of known linked events. We do not use the integration to advertise to you.

Event details can include a title, description, study date, start and end times, time zone and linked event ID. Access and refresh tokens are stored on the backend to maintain the connection. Disconnecting in NeuroDeck removes its saved connection credentials. You can also revoke access in your Google Account. Disconnecting does not automatically delete events already saved in Google Calendar.

7. Technical information, support and sources

Hosting, authentication and network services process technical information required to serve requests, such as IP addresses, browser or device information, request times, response status and security or error records. Some information is generated automatically when the service operates. If you email us, we also receive your address, message and any attachments you choose to send.

Our sources are you, the devices and browser you use, the study activity you perform, the sign-in providers you select, and any optional integration you authorise. We do not require your contacts, precise device location or access to unrelated personal files to provide the current app. You choose the files to upload.

8. Purposes and lawful bases

An authorisation screen for an optional connection gives you control over that connection; it does not automatically determine every lawful basis for subsequent processing. Where consent is our basis, you can withdraw it without affecting processing lawfully carried out beforehand. We do not treat this notice as permission to use data for unrelated purposes.

9. Who receives information

Google Firebase provides authentication and Firestore storage. Vercel provides app hosting and backend execution; Firebase Hosting may also serve supported deployments. Groq processes AI requests, with tool providers involved when web search is used. Google processes sign-in and calendar information when you use those features. These providers receive information needed for their respective roles, rather than every provider automatically receiving the whole of your account.

Provider personnel, infrastructure and subprocessors may be involved in delivering their services. A provider may act as our processor for some activities and as an independent controller for its own account, security or legally required activities. We may also disclose necessary information where legally required or to investigate a concrete security incident or defend a legal claim. We do not sell your personal information or license your private study content for advertising.

10. Processing outside the UK

Our service providers operate international infrastructure. Information, including AI requests, may be processed outside the United Kingdom, including in the United States. Do not assume that all data remains in your country or that an account’s location controls every provider’s processing location.

Restricted transfers must satisfy applicable data protection requirements. Depending on the provider and arrangement, relevant mechanisms can include adequacy regulations or approved contractual safeguards with the required UK provisions. This notice does not itself establish a transfer safeguard. Contact us to request details of the locations and safeguards applicable to your information, including how to obtain relevant safeguards. Provider privacy and contractual information is linked below.

11. Retention and deletion

Account, library, chat, document and study-session records are kept to provide your account and the content you choose to retain. The current app does not apply a single automatic expiry period to every saved record. Retention depends on whether an account or feature still needs the information, whether you delete it or request deletion, and whether a specific legal or security reason requires limited further retention.

Support messages are retained for the enquiry and any reasonably related follow-up or dispute. Technical and security records depend on the provider’s logging configuration and operational requirements. A longer retention period must have a relevant purpose; the existence of an account is not permission to keep unrelated information indefinitely.

Deleting an item, clearing a browser cache, signing out and closing an account are different actions. Copies may exist in browser storage, cloud records or a provider’s recovery systems. A completed erasure request can require work across those locations; limited records may remain where the law permits or requires it. Ask us about a particular category if you need a more specific retention explanation.

12. Cookies and local copies

The app uses browser storage for authentication, cached study data, session checkpoints, chats and acknowledgement of the cookie notice. An installed service worker caches an offline page. Some browser records have no automatic time-based expiry and can remain after you close a tab or sign out.

Our Cookie Policy lists the current storage names, purposes, durations and browser controls. Clearing local storage does not erase the cloud account, and deleting cloud content does not guarantee that every previously used device has already cleared its local copy. Keep access to shared devices secure.

13. Security and sensitive information

Account authentication, backend token verification and account-scoped storage are used to restrict access to saved data. No internet service can guarantee perfect security, uninterrupted availability or recovery of every lost record. Contact us promptly if you suspect unauthorised access, and secure your email or Google account as well as your NeuroDeck account.

The service is not designed to collect special-category information such as health, biometric, political or religious information, or criminal-offence records. Do not upload such information or other people’s private data unless you have a proper reason and the necessary authority. A study document can still contain personal information even if it is uploaded only for revision.

14. Younger users

NeuroDeck is intended for users aged 13 and over, including school-age students. We do not treat a minimum age statement as removing our responsibilities towards children who use the service. Younger users should ask a trusted adult to help if they do not understand how an AI feature or integration uses their information.

If you believe someone under 13 has supplied personal information through an account, contact us so we can investigate and take appropriate action. A parent or guardian does not automatically receive unrestricted access to a child’s private account; requests must be assessed in light of identity, authority, the child’s interests and applicable law.

15. Access, correction and other rights

Depending on the processing and applicable law, you can request access to your personal data, correction of inaccurate information, erasure, restriction of processing, and a portable copy of information where the portability right applies. You can withdraw consent where processing relies on consent. Rights can be subject to conditions and exceptions; we will explain a restriction relevant to a request.

Your right to object: you can object to processing based on legitimate interests on grounds relating to your circumstances. You can object to direct marketing at any time if it is introduced. Contact the privacy email above to exercise these rights; you do not need to use legal terminology.

We may request proportionate information to verify your identity and avoid disclosing someone else’s data. Do not send identity documents unless requested through an appropriate process. We will respond within the applicable statutory time limits and explain any lawful extension or reason a request cannot be fulfilled.

16. Automated study features

Scheduling, progress calculations and Axon responses involve automated processing. They personalise learning or provide feedback. NeuroDeck does not use these features to make admission, employment, credit or other decisions intended to have legal or similarly significant effects. Study recommendations may be wrong or incomplete; you remain able to choose how you study and should check important answers against authoritative course materials.

17. Complaints and provider information

If you have a concern, contact neurodeck.mlm@gmail.com. You can also complain to the UK Information Commissioner’s Office through ico.org.uk/make-a-complaint/. Contacting us first is helpful but does not remove your right to approach the regulator or use other remedies available under law.

Further provider information: Firebase privacy, Google Privacy Policy, Vercel Privacy Policy and Groq data information. External policies describe those services and do not replace our responsibility for our own processing.

18. Changes to this notice

This version takes effect on 19 October 2026. We may update it when features, providers or legal requirements change. Material changes should be brought to users’ attention through an appropriate notice, and additional consent will be requested where required. Updating a page does not retrospectively authorise incompatible processing or remove rights relating to earlier activity.