Privacy Policy

1. Who we are (Data Controller)

Sunbranch AS is the data controller responsible for personal data processed through Cram. We are based in Norway.

Questions or requests: support@cramaiapp.com · https://sunbranch.no

2. Information we process

We do not collect your contacts or your precise location, and the only photos we process are the ones you choose to turn into flashcards.

3. AI flashcard generation

To create your cards, the topic, text, link, PDF, photo, or scan you submit is sent to our AI provider, Google (Gemini), which generates the flashcards and returns them to your device. We send only what is needed to produce your deck, and the content is processed transiently to fulfil your request.

We do not use your content to train our own models, and we use Google's Gemini API, under which your input is not used to train Google's models. AI-generated content can be inaccurate or incomplete — always review your cards and verify important facts.

4. How we use your data, and our legal bases

Under the GDPR we must have a lawful basis for each purpose. Ours are:

5. Third-party services we rely on

We use a small number of trusted providers. Each processes data under its own privacy policy and only as needed to provide its function. We never share your study content with our analytics or crash-reporting providers.

• Supabase — account authentication and the database that stores your synced decks, hosted in the European Union (supabase.com/privacy).
• Google (Gemini API) — generates flashcards from the material you submit (policies.google.com/privacy).
• PostHog — product analytics, hosted in the European Union (posthog.com/privacy).
• Sentry — crash and error reporting (sentry.io/privacy).
• RevenueCat — subscription management (revenuecat.com/privacy).
• Apple — App Store distribution, payment processing, and Sign in with Apple (apple.com/legal/privacy).
• Google — Sign in with Google (policies.google.com/privacy).

6. Storage and security

Your decks and review history are stored on your device and synced to your account in our database, hosted with Supabase in the European Union (Sweden). Data is encrypted in transit and at rest, and authentication credentials are stored securely on your device. The other data we process (analytics, crash reports, and subscription status) is handled by the providers above, which use encryption in transit and appropriate technical and organisational safeguards. No system is perfectly secure, but we take reasonable measures to protect the data we process.

7. Data retention

• Account data, decks, and review history: kept while your account exists. Deleting your account in the App (see section 9) permanently removes them from our servers.
• Analytics and crash data: kept only as long as needed for the purposes above — no more than 14 months — then deleted or aggregated.
• AI generation: your input is processed transiently to generate your deck and is not retained by us beyond the resulting cards.
• Subscription records: kept as long as required for tax, accounting, and legal purposes.

8. International data transfers

Your account data and synced study content are hosted in the European Union (Sweden), and our analytics provider (PostHog) also processes data in the European Union. Some other providers — in particular our AI provider, Google, and our crash-reporting provider — may process data outside the European Economic Area, including in the United States. Where data leaves the EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and, where applicable, certification under the EU–US Data Privacy Framework.

9. Your privacy rights (GDPR Articles 15–22)

If you are in the EEA or UK, you have the right to access your personal data (Art. 15), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21). Where processing is based on consent, you may withdraw it at any time.

You can exercise the most important rights directly in the App: export a copy of your data (decks, cards, and review history) from Account settings, edit your profile details, and permanently delete your account — which removes your account and synced study content from our servers. For anything else, or if you'd rather we handle a request for you, email support@cramaiapp.com. We will respond within 30 days, and there is no fee for exercising your rights.

10. Complaints

If you believe we have not handled your data properly, you can lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no) or with the supervisory authority in your country of residence. We'd appreciate the chance to resolve your concern first, so please contact us before you do.

11. Children's privacy

Cram is intended for users aged 13 and older. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal data, contact us and we'll delete it.

12. The website

The cramaiapp.com website does not use analytics cookies or third-party tracking. It sets only the cookies strictly necessary to serve the site — including a session cookie if you sign in to your account on the web.

13. Changes to this policy

We may update this policy from time to time. When we make material changes, we'll revise the “last updated” date at the top and, where appropriate, note the change in the App.

14. Contact us

Questions about this policy or your data? Email support@cramaiapp.com. Sunbranch AS, Norway.