Effective Date: September 11, 2026

1. Information We Collect

None. CardLoom does not collect any personal information, usage statistics, crash reports, or analytics of any kind. The app has no server of ours and runs offline on your device. Its only network activity is iCloud sync on Apple devices, which goes to your own Apple Account and never to us (Section 3), and the optional deck downloads you choose to start yourself (Section 4).

2. Local Data Processing

CardLoom stores your decks, cards, study history, streaks, and preferences on your device. Specifically:

• Your decks and study progress are stored locally in the app’s database.
• Application preferences are stored locally on your device.
• No data is uploaded to, processed by, or stored on any server we operate.
• Spaced-repetition scheduling, statistics, and streaks are all computed on your device.
• On Apple devices, a copy of that same data is also kept in your own iCloud while sync is on, so your other Apple devices can read it. That copy is yours, inside your Apple Account (Section 3).

3. iCloud Sync on Apple Devices

CardLoom has no sign-in of ours and no account system. We never issue you a username, a password, or a profile, and we never upload your decks or progress to any server we operate. On Apple devices, CardLoom can keep your decks and study progress in step across the iPhone, iPad, and Mac signed in to your Apple Account, using Apple’s iCloud.

• It is your iCloud, not our server. Synced data is held in the private area of your own Apple Account, reachable only by your devices. Lacy Digital Labs runs no server in this process, receives no copy of your data, and has no ability to read, browse, or recover it.
• It is on by default. Sync is enabled the first time you run CardLoom on an Apple device, because it is the feature our users asked for most. You can turn it off at any time in CardLoom’s Settings.
• What syncs. Your decks and cards, including any images you add to them; your study history, scheduling, streaks, goals, and test dates; and your app preferences.
• What happens when you turn it off. CardLoom stops sending and receiving changes. The copy on that device stays put and keeps working exactly as before. Anything already in your iCloud remains yours until you remove it, which you can do from your device’s iCloud settings.
• If you have no Apple Account signed in on the device, or iCloud Drive is turned off, CardLoom simply runs locally with no sync and no prompting.
• Other platforms. The Windows, Android, and Linux versions do not sync at all. Their data stays on that device.

Because iCloud is Apple’s service, Apple’s handling of that data is governed by the Apple Privacy Policy and your iCloud terms — including Apple’s encryption in transit and at rest, and any Advanced Data Protection setting you have chosen for your account.

Apart from sync, your data does not leave your device unless you choose to share a deck, as described next.

4. Sharing and Deck Downloads

CardLoom lets you move decks in and out of the app. These actions are always initiated by you:

• Saving & opening decks — you can save a deck as a file to share, and open a deck that you or someone else created. This stays on your device; your study progress is never included in a deck you share.
• Deck links — if you open a CardLoom deck link (for example, one a teacher posts on a website), the app downloads that deck from the web address in the link. The download goes directly between your device and whatever site hosts the deck; it is not routed through, logged by, or sent to Lacy Digital Labs.

With sync turned off, and if you never open a deck link, CardLoom makes no network connections at all.

5. Telemetry and Analytics

CardLoom does not include any telemetry, analytics, or crash-reporting frameworks. We do not track how you use the application, which decks you study, how often you use it, or any other behavioral data.

6. Tracking and Advertising

CardLoom does not use cookies, tracking pixels, advertising identifiers, fingerprinting, or any other tracking technologies. We do not display advertisements and we do not participate in any advertising networks.

7. Purchases & Payment Processing

If you purchase CardLoom through the Apple App Store, Microsoft Store, Google Play, or any other distribution platform, that platform may collect transaction and account information as part of the purchase process. The same applies to any optional in-app purchases that may be offered in the future for additional features — those transactions are processed entirely by the platform's billing system, not by us. This data is collected and managed by the respective platform, not by us. Please refer to the applicable platform's privacy policy for details:

• Apple Privacy Policy
• Microsoft Privacy Statement
• Google Privacy Policy

We do not receive, store, or have access to your payment information, Apple ID, Microsoft account, Google account, or any other account credentials. Purchase or restore of in-app purchases is handled by your platform using receipts that are validated locally on your device — no purchase data is sent to any server we operate.

Direct purchases of the Linux version. The Linux edition of CardLoom is sold directly from our own online store rather than through a platform app store. When you buy it this way, a few commerce partners are involved and a limited amount of information is handled off your device:

• Merchant of Record — Lemon Squeezy. Our store is operated by Lemon Squeezy, which acts as the Merchant of Record for the sale. To meet tax and Know-Your-Customer (KYC) requirements, Lemon Squeezy collects your name, billing address, and email address during checkout.
• Payment processing — Stripe. The financial transaction is processed by Stripe, which handles your payment-card details. We never see or store your card information.
• What we keep. From this process Lacy Digital Labs receives and retains only your email address. We use it solely to reach you about the app you purchased — for example, to let you know when a new version, patch, or feature is available. We do not use it for marketing, and we will never sell or rent it to any third party.

You can ask us to delete your email address at any time (see “Your Data Rights” below). For how these partners handle your information, see the Lemon Squeezy Privacy Policy and the Stripe Privacy Policy.

8. Third-Party Services

CardLoom does not integrate with, send data to, or receive data from any analytics service, advertising network, or cloud platform of ours. There are exactly two kinds of outbound network activity, and neither involves a server we operate:

• iCloud sync on Apple devices, which goes to your own Apple Account (Section 3) and can be turned off in Settings.
• Deck downloads you start yourself by opening a deck link (Section 4), which go directly to the site hosting that deck.

9. Children's Privacy

Because CardLoom does not collect any data from any user, it does not knowingly or unknowingly collect information from children under the age of 13 (or any other age). The application is safe for users of all ages.

If a child studies on a device signed in to an Apple Account, iCloud sync keeps their decks and progress in that account, under the parent’s or guardian’s existing arrangement with Apple — including Family Sharing and any Screen Time or child-account controls. It still reaches no server of ours. A parent, guardian, or teacher who would rather keep everything on one device can turn sync off in CardLoom’s Settings; on school-managed devices it is often disabled or unavailable already.

10. Your Data Rights

Because CardLoom does not collect, process, or store any personal data, there is no personal data for us to access, correct, delete, or transfer. Your decks and study data exist on your own devices, and in your own iCloud if sync is on, under your full control. You can save your decks to share them at any time, or delete your data by removing decks in the app.

To remove the synced copy as well: delete the decks in the app while sync is still on, so the deletion propagates, or turn sync off and then clear CardLoom’s data from your device’s iCloud settings. Because we never hold that data, these are things only you can do — we could not delete it on your behalf even if you asked.

The one piece of personal data we may hold is the email address collected when you buy the Linux version directly from our store (see “Purchases & Payment Processing” above). You may ask us to access or delete that email address at any time by contacting our support center; we will delete it promptly, after which you will no longer receive our update notices for the app.

If you have any questions about your data, please contact us using the information below.

11. Data Security

Since we operate no server and hold none of your study data, there is no database of ours that could be breached and expose it. On your device, your data is protected by the device’s built-in security and any encryption you have set up at the device level. When sync is on, the copy in your iCloud is protected by Apple’s encryption in transit and at rest, under whatever protections apply to your Apple Account — including Advanced Data Protection, if you have enabled it.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, regulatory, or operational reasons. Any changes will be posted on this page with an updated effective date, and we encourage you to review this page periodically.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy, please contact us at:

Lacy Digital Labs LLC
Contact us through our support center