Privacy Policy

Effective date: 15 October 2026

1. Who we are and what this Policy covers

1. Ringostat LTD, a company incorporated under the laws of the Republic of Seychelles with a company registration number 177057, is the holder of the Apple App Store developer account through which the mobile application "Stickdeck" (the "App") is distributed. Ringostat LTD does not collect, access, control or process any personal data of users of the App and is neither a data controller nor a data processor with respect to such data.
2. NarrativeLab OÜ, a company incorporated under the laws of the Republic of Estonia with a company number 17007093, develops the App and is the controller of personal data processed in connection with the App. In this Policy, "we", "us" and "our" refer to NarrativeLab OÜ.

This Privacy Policy explains what data we collect, why we collect it, on what legal grounds we process it, with whom we share it, how long we keep it, and which rights you have. It applies to the App, to the website at stickdeck.com and to any support communications you exchange with us.

Stickdeck is a study app in which you create flashcards yourself or generate them with artificial intelligence from your notes or documents, and review them on a spaced repetition schedule.

This Policy is a notice about how we process personal data. Where we rely on your consent, we ask for it separately in the App.

1a. How the App stores your data

The decks, cards, study progress and settings you create in the App are stored on your device. If iCloud is turned on for the App, a copy may also be kept in your own iCloud account so that it can be restored, for example after you reinstall the App. This copy is controlled by Apple and by you under the terms of your Apple Account.

We do not keep a database of your decks, cards or study progress and have no access to them or to other data stored on your device or in your iCloud account at any point, including when you contact support. The only exception is the content you submit to generate cards with artificial intelligence: it is sent through our server to our AI provider, which returns the result to your device, and is kept only as described in Section 8 (see also Sections 2 and 6). To apply the limits on generation, to confirm your subscription and to decide whether a free trial is available, our server keeps records of how many generations have been used and of the status of your subscription, linked to a random identifier of your installation of the App or to your purchase, and Apple keeps for us a flag showing that a free trial has already been used on your device (see Section 4); these records contain none of your decks, cards or submitted content and may remain after you delete the App.

The App does not require you to create an account, and no registration, login or account credentials are collected or processed by us.

2. Categories of data we process

The content of your decks and cards, the content you submit for generation and data from device permissions are never included in analytics or crash reports. We do not collect advertising identifiers, we do not track you across apps or websites owned by other companies, and we do not use your data to serve you targeted advertising.

3. Sources of data

Data you create in the App and the content you submit for generation come from you. Data from device permissions comes from your device, and only if you grant the permission. Other data is provided by Apple (in-app purchases, App Store Server Notifications, the DeviceCheck flag described in Section 4, iCloud and, if enabled, crash reports), by Google Firebase while analytics and crash reports are on (see Section 4), and by you when you write to us or visit our website.

4. Purposes of processing and legal bases

We process data you create in the App and data from device permissions solely to provide the features you use, such as creating, importing and reviewing cards, scheduling reviews, reminding you to study and keeping a copy in your iCloud account. This processing takes place on your device, except for AI generation, described below. Where the General Data Protection Regulation ("GDPR") applies, the legal basis is the performance of the contract with you under the Terms of Use (End User License Agreement) (Article 6(1)(b) GDPR).

Studying, decks, manual cards and imports are free. Generation with artificial intelligence is available only with an active subscription or free trial; there is no free generation.

Before your first generation, the App asks your permission to send the pages you select to our server and to OpenAI, and nothing is sent until you tap "Agree". You can withdraw this permission at any time in the App under Settings › Privacy › AI data sharing ("Withdraw consent"); after that, the App sends no content for generation until you agree again. Sharing your content with our server and OpenAI is based on your consent (Article 6(1)(a) GDPR). Once you have agreed, we process AI generation data when you use generation: to generate the cards you request and to apply the usage limits of your plan, on the basis of the performance of the contract with you (Article 6(1)(b) GDPR), and to protect the service against abuse, on the basis of our legitimate interest in keeping it secure (Article 6(1)(f) GDPR).

Our server also processes data when you do not generate cards. When the subscription screen opens, when the App restores or synchronises your purchases, and when it shows your AI pages in Settings, the App sends our server the purchase information signed by the App Store, an Apple DeviceCheck token and an App Check token, which shows that the request comes from a genuine copy of the App. Our server uses them to determine whether a free trial is available to you and to confirm your access to paid features; no content you submit is sent with these requests, and they do not reach OpenAI. The free trial is available once per device: our server sets a flag for your device through Apple DeviceCheck, which remains after you delete the App or change your Apple Account, so a device that has already had a free trial gets no trial or a reduced one. The legal basis is the performance of the contract with you (Article 6(1)(b) GDPR) and our legitimate interest in preventing abuse of free trials and protecting the service (Article 6(1)(f) GDPR).

We use Google Firebase Analytics and Firebase Crashlytics to understand how the App is used and to find and fix errors. The App works in the same way whether or not these tools are active.

If the region set on your device is in the European Economic Area or the United Kingdom, or is not set, the App asks for your choice before these tools are activated. Until you answer, nothing is sent: usage events are kept only in the App's memory and crash reports only on your device; if you agree, they are sent, and if you do not, they are deleted. In this Policy, «in the European Economic Area and the United Kingdom» refers to this region setting. The legal basis is your consent (Article 6(1)(a) GDPR). Withdrawing your consent stops further collection and does not affect processing carried out before.

Elsewhere, these tools are active from the first launch and you can turn them off at any time in the App under Settings › Privacy › Share usage data. The legal basis is our legitimate interest in understanding how the App is used and in keeping it working (Article 6(1)(f) GDPR). You may object to this processing at any time, and turning the setting off is the simplest way to do so.

In both cases the choice is a single setting in the App (Settings › Privacy › Share usage data), it applies to analytics and crash reports together, and it takes effect immediately. Turning it off also resets the analytics and crash reporting identifiers of your installation of the App and deletes reports not yet sent.

We use de-identified crash reports from Apple, if you enable "Share with App Developers", and website technical data to keep the App and the website stable and secure. The legal basis is our legitimate interest in operating a functioning and secure product (Article 6(1)(f) GDPR). We use Google Analytics on our website only if you accept it in the cookie banner, to understand how the website is used; the legal basis is your consent (Article 6(1)(a) GDPR), which you can withdraw at any time through the cookie settings on the website.

We process subscription and support data to manage paid features and to answer your requests. The legal basis is the performance of the contract with you under the Terms of Use and, for keeping support records, our legitimate interest in answering follow-up questions and in establishing, exercising or defending legal claims (Article 6(1)(f) GDPR).

We process data to comply with legal obligations, including accounting, consumer protection, sanctions and export control obligations, and to establish, exercise or defend legal claims, on the basis of those obligations and our legitimate interests.

You are not required by law or by contract to provide personal data to use the App. If you do not grant a permission, only the related feature will not work. Generation with artificial intelligence works only if you agree to send the content you submit to our server and to OpenAI; if you do not agree or do not use it, this content is not sent. We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you. Your data is never used for credit or insurance decisions and is never sold.

5. Device permissions and Apple platform commitments

Data obtained through device permissions is used only to provide the related feature to you. It is never used or disclosed for advertising, marketing or data mining, is never sold, and is not shared with any third party, except for content you submit for generation, as described in Section 2. You can review or withdraw any permission at any time in iOS Settings.

Deleting the App removes its data from your device, including decks and cards kept only in the App, except for the server records and the DeviceCheck flag described in Section 1a, which may remain, and a random identifier of your installation of the App and your choice about sharing usage data, both kept in the iOS keychain, which may also remain. A copy kept in your iCloud account may remain there and is managed under your iCloud settings and Apple's terms.

6. Disclosure of data / third-party services

Data you create in the App and data from device permissions are not transmitted to us or to our service providers, except for the content you submit for generation, which is sent through our server to our AI provider. They are sent to Apple only if iCloud is turned on for the App, to keep a copy in your own iCloud account, as described in Sections 1a and 2. The recipients involved in the operation of the App and of our website are:

Each third party with whom we share personal data, as listed in this Section, provides the same or equal protection of that data as stated in this Policy and as required by the App Store Review Guidelines. Our processors act under written data processing terms that oblige them to do so. Apple provides the App Store and iCloud to you under its own terms and privacy policy.

Should we integrate additional third-party tools, we will update this Section before they are activated.

We may also disclose data where we are legally required to do so, in response to a valid request from a competent authority or court, to comply with sanctions and export control rules, to protect our rights, the safety of users or the security of the App, or to establish, exercise or defend legal claims. If our business or the App is transferred, for example in a merger or sale of assets, data may be transferred to the acquirer, which will remain bound by this Policy.

We do not sell your personal data and do not share it for cross-context behavioural advertising.

7. International transfers

Some recipients listed in Section 6 process data in the United States and in other countries. For transfers from the European Economic Area, the United Kingdom and Switzerland, we rely on the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework, under which Google LLC and Cloudflare, Inc. are certified. Apple states that its transfers of personal data from those regions are governed by the European Commission's Standard Contractual Clauses. Where a transfer is not otherwise covered, we rely on the Standard Contractual Clauses or, for the United Kingdom, the International Data Transfer Addendum. You can contact us for more information (see Section 14).

8. Retention

Data you create in the App stays on your device until you delete it or the App, and in your iCloud account under your iCloud settings. A deck you delete stays in Recently Deleted in the App for 30 days, where you can restore it or delete it at once, and is then deleted automatically. Because we do not hold this data, we cannot delete it remotely.

On our server:

• content you submit for generation (text and page images) is not stored; it is processed only while the request is handled;
• generated cards are kept until your device collects them, and for no longer than 24 hours;
• records of each generation contain no content, only numbers (such as pages, cards and the AI model used) and the identifier of the installation or subscription that made the request, and are kept for 30 days;
• daily counters used for usage limits are kept for 7 days after the end of the day;
• App Store Server Notifications are kept for 90 days;
• the status of your subscription and its usage counters are kept while the subscription is active and for 30 days after it ends;
• aggregated daily totals of the service, with no identifiers, are kept for 90 days;
• server logs contain numbers and technical data only, identify the subscription or installation solely by a keyed hash (HMAC), and are kept for 30 days.

The flag showing that a free trial has been used on your device is stored by Apple through DeviceCheck and remains after you delete the App.

OpenAI keeps the content only for the periods set out in its API data usage policy; in particular, logs used to monitor for abuse are kept for up to 30 days, unless longer retention is required by law or is reasonably necessary to protect OpenAI's services or others from harm.

Usage data in Firebase Analytics is kept in accordance with the retention setting of the linked analytics property, currently 14 months, after which it is deleted or retained only in aggregated form that cannot be linked to you or your device, and crash reports in Firebase Crashlytics for 90 days. Support correspondence is deleted within 6 months after the request is closed, unless we need a specific message to establish, exercise or defend a legal claim. Sales and transaction records are kept for the period required by accounting and tax law. Website technical data is kept by Cloudflare for the short period needed for delivery and security. Website analytics data in Google Analytics is kept in accordance with the retention setting of the property, currently 2 months, after which it is deleted or retained only in aggregated form, and the Google Analytics cookies expire after up to 2 years.

9. Security

We apply technical and organisational measures appropriate to the nature of the data, including encryption in transit and restricted access to our server, our support mailbox and our analytics consoles. Data on your device is protected by the security features of iOS, including your device passcode, and your iCloud copy by Apple's security measures. No method of transmission or storage is completely secure. If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority and, where required, you, within the deadlines set by law.

10. Your rights

Subject to the law applicable to you, you may have the right to access, rectify or erase personal data we hold about you, to restrict or object to its processing, to data portability, and to withdraw your consent at any time without affecting processing carried out before.

Where we rely on our legitimate interests (see Section 4), you have the right to object at any time, on grounds relating to your particular situation.

Data you create in the App stays on your device and, if iCloud is turned on for the App, in your iCloud account. Data from device permissions is used on your device (see Section 2). You control this data directly in the App, in iOS Settings and in your iCloud settings. You can turn analytics and crash reports off at any time in the App under Settings › Privacy › Share usage data; this withdraws your consent where we rely on consent, gives effect to your objection where we rely on our legitimate interest, and resets the analytics identifiers of your installation of the App. You can withdraw your consent to sending content for generation at any time under Settings › Privacy › AI data sharing. Analytics and crash data are linked only to random identifiers, so we may be unable to find data relating to you.

To exercise a right, contact us (see Section 14). Where the GDPR applies, we will respond without undue delay and in any event within one month, which we may extend by two further months for complex requests, informing you of the reasons. We may ask for information needed to verify your request and will use it for no other purpose. Exercising your rights is free unless a request is manifestly unfounded or excessive. You may use an authorised agent where the law allows it. If we deny your request, you may appeal by writing to us with the subject line "Privacy Appeal".

If you are in the European Economic Area or the United Kingdom, you may lodge a complaint with the supervisory authority of your habitual residence, place of work or place of the alleged infringement. The supervisory authority of NarrativeLab OÜ is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee). In the United Kingdom, you may also complain to the Information Commissioner's Office.

11. Children's privacy

Stickdeck is intended for users aged sixteen and over and is not directed at children under sixteen. We do not knowingly collect personal data from children under the age of sixteen, or under the higher minimum age required in the user's jurisdiction. In the European Economic Area and the United Kingdom, analytics and crash reports stay off unless you turn them on; elsewhere they can be turned off at any time in the App under Settings › Privacy › Share usage data. If you are below the age at which you can consent yourself under the law of your country, turn them on only with the agreement of a parent or guardian. If you believe that a child has provided us with personal data, contact us and we will delete, without undue delay, any such data that we can identify.

12. Geographic availability and restrictions

Stickdeck is distributed worldwide through the Apple App Store with the exceptions set for the App in the App Store and those required by applicable law, and it is not offered in mainland China, in the territories of Ukraine temporarily occupied by the Russian Federation, in the Russian Federation, or in countries and territories subject to comprehensive sanctions or embargoes administered by the Office of Foreign Assets Control of the United States Department of the Treasury, the United States Department of Commerce, the European Union, the United Kingdom or the United Nations. Availability in each country is determined by the App Store storefront associated with your Apple Account.

13. Changes to this Policy

We may update this Policy to reflect changes in the App, in our processing or in applicable law. We will inform you of material changes before they take effect, in the App where technically possible and otherwise on our website, and, where the law requires it, ask for your consent again. The current version is always available in the App and at https://stickdeck.com/privacy-policy.

14. Contact

For any question about this Policy or to exercise your rights, contact us through https://stickdeck.com/#support or at support@stickdeck.com.

Company name: NarrativeLab OÜ

Post address: Estonia, Harju maakond, Tallinn, Lasnamäe linnaosa, Valukoja tn 8/2, 11415

Phone: +372 (61) 04186