Privacy Policy

The short version

• Study, shared-deck, authentication and account pages do not send Meta advertising events. We do not use third-party session recording.
• We do not sell your study material. Optional sharing with Meta for advertising measurement is described below.
• You can browse and study any shared deck without an account at all.
• Your study data lives in your own browser first. It only reaches our server if you sign in.

What we collect

Guest use: loading pages makes ordinary web requests. Your progress in a guest study session is held in memory and is gone when you close the tab. If you submit feedback or sign up for mobile updates, we receive the information you choose to submit.

If you create an account, the account itself is an Alca Labs account, shared across our apps. We store your email address and, if you sign in with Google, the name and profile image Google returns. Passwords are hashed by our authentication provider and are never visible to us.

Your study data is stored so it can sync between your devices: your decks, cards, folders, tags, study progress and scheduling data, streaks, daily rep counts, and any cards you flag. Your public profile stores your chosen handle and may retain school, weekly rep count, and streak data from the paused leaderboard feature. If you publish a deck, the text of that deck becomes publicly readable by anyone with the link, bylined with your handle.

What we do not collect: we do not ask for your real name, date of birth, phone number, or address. We do not collect your location. We do not send your study data to advertising platforms.

Card details never reach us. If you subscribe, you enter your card on Stripe’s own checkout page. We receive only what Stripe tells us: that a subscription is active, which plan, and when it renews. We never see or store your card number.

The iOS app

Reps for iOS stores your study library in a local database on your device and your login session in the iOS Keychain. When signed in, it automatically syncs your study data with Reps so you can use it across devices. Signing out keeps that account’s local study data for your next sign-in; it does not transfer it to another account.

AI grading is off by default in the iOS app. If you enable it in Status, your written answer and the card’s question, reference answer, explanation, and keywords can be sent through Reps to the configured AI provider (Google, OpenAI, or Anthropic). You can turn it off at any time. With AI grading off, answers are graded on your device; ordinary study-data sync still operates while signed in.

The native app bundles its fonts and does not fetch them from Google or Adobe. Signing in opens the shared Alca authentication website in a system browser, where the authentication providers described below apply. The native app does not include advertising or tracking SDKs.

Status contains links to this policy and the terms, plus Delete Reps data. After confirmation, deletion removes your Reps study data and membership, cancels Reps billing, and clears that account’s local study data and login session on this device. Your shared Alca identity and other Alca products remain. If cleanup fails, the app pauses study and sync and offers a retry.

Mobile updates

If you opt in to mobile updates, we store your email address, signup date, and consent record in Neon. No Alca account is created. We use this list only for news about Reps for mobile, including early access and launch updates.

We keep your signup until you ask us to remove it or we no longer need it for mobile launch updates. To withdraw consent or request deletion, email erik@alcahq.com.

Where your data goes

We use the following service providers:

• Supabase — authentication (your email and login session).
• Neon — the Postgres database holding your synced study data.
• Vercel — hosting and standard server request logs.
• Google (Gemini API), OpenAI, or Anthropic — AI card generation and answer grading, depending on the configured provider.
• Resend — sending account emails such as your sign-up code and renewal notices.
• Stripe — payments, if you subscribe. Stripe receives your email address and the card details you enter on their checkout page.
• Cloudflare — bot protection on the sign-in and sign-up screen. It checks that a real browser is submitting the form, and sees only what it needs for that check. It is not used anywhere else in the app and never sees your study material.
• Replicate — generating cover art for a set, if you leave that switched on. It receives a short description of the subject built from the set’s title and a few of its questions, and it returns an image. It does not receive your whole deck, your answers, or your account details, and the finished image is stored by us rather than by them.
• Vercel Blob — storing set cover art and images attached to your study cards, including original images used for cropping. Images are stored at unguessable public URLs; anyone who has one of those URLs can access the image. If you upload your own image we re-encode it in your browser before it is sent, which removes embedded camera data such as GPS location.
• Google Fonts — typefaces used on the website. Your browser fetches them from Google’s font servers on every page, including before you sign in, so Google receives your IP address and which page requested them. No account data and no study material is involved.
• Adobe Fonts — one typeface used for the Reps website wordmark, loaded the same way and with the same footprint as Google Fonts.
• Sentry — error reports, so we find out when something breaks instead of waiting for you to tell us. Reports carry the technical details of the failure and an anonymous account identifier. We deliberately strip your email address, your IP address, and the contents of whatever you were working on before the report is sent. We do not use session recording or replay.

AI and your study material

When you generate cards, the material you provide — pasted text, an uploaded file, or a transcript — is sent to Google’s Gemini API to produce the deck. When you answer a free-response card, your written answer is sent to be graded. Google processes this on our behalf as an API customer; API inputs are not used to train Google’s models.

Two things worth knowing. First, plenty of grading never reaches the AI at all: if your answer matches the expected one, it is graded locally on your device and nothing is sent. Guest study sessions never call the AI. Second, do not paste material you are not allowed to share — someone else’s copyrighted content, confidential documents, or anything containing another person’s sensitive personal information.

Cookies

We use first-party cookies to keep you signed in and remember the link that first brought you here. Your browser also stores decks and preferences locally. Separately, we remember your advertising choice in local storage for up to 180 days. If you allow Meta measurement, requests to Meta may use cookies Meta already has in your browser, subject to your browser settings. You can clear local data through your browser settings.

Optional Meta advertising measurement

Only after you choose Allow Meta measurement, public marketing pages (the homepage, and pricing) send Meta page visits and fixed actions such as signup-button clicks. A click records intent, not a completed signup, trial or payment. Requests include a public page address without query parameters, the event name, a random event identifier, and technical information such as your IP address and browser. Meta may associate this information with your Meta account and use it for measurement and advertising personalization under its privacy policy.

We do not send study material, answers, deck names, account details, form contents, or private page addresses to Meta. No Meta script scans the page. This measurement is not installed in the native app or on study, shared-deck, authentication or account pages.

Choose No thanks to keep this off. Use Ad privacy on a public marketing page or this page to change your choice at any time. Withdrawal stops future events; it cannot recall information already sent to Meta. We honor Global Privacy Control and Do Not Track signals by keeping Meta measurement off.

Your choices

• Friends and leaderboards are paused. Existing records are retained but boards are unavailable.
• Publishing is opt-in and reversible. Unpublishing removes the public copy.
• Export. Your decks can be copied out of the app as plain text.
• Deletion. Settings has a Delete your Reps data button. Your shared Alca login and other Alca apps are kept. It removes your decks, progress, streaks, leaderboard row, published sets and stored images, and cancels your Reps subscriptions. New writes are paused while deletion runs. If a provider is unavailable, retry the operation to finish; your billing references are retained until cancellation and image cleanup succeed. Previously cached or downloaded copies may remain outside our control. We retain a minimal deletion record to prevent stale devices from restoring deleted data and to handle delayed billing events. If you would rather we did it, email erik@alcahq.com.

Children

Reps is built for college students. It is not directed at children under 13, and we do not knowingly collect their information. If you believe a child has created an account, contact us and we will remove it.

Changes and contact

If we change this policy in a way that materially affects you, we will say so in the app rather than quietly updating this page. Questions, requests, or complaints: erik@alcahq.com.