Privacy Policy

Last updated: 24.10.2026

This Privacy Policy explains what personal data Cirello ("Cirello," "we," "us," or "our") collects, why, who receives it, how long it is kept, and what choices you have.

Cirello is operated by an individual based in Ukraine, who is the data controller. For any question about this policy or your data, write to [email protected].

1. What This Policy Covers

This policy covers all of Cirello:

The Site - cirello.app, including the blog.
The App - the Cirello application at web.cirello.app and the Cirello desktop and mobile apps, together with the Cirello API they use.
The AI connector - the Cirello connector and plugin that let an AI assistant you choose (for example Claude or ChatGPT) work with your Cirello account. See section 6.

Our public feedback board at feedback.cirello.app is a separate service with its own sign-in; see section 5.

2. Data We Collect

Account data

First name, and last name if you add one.
Email address and whether it has been verified.
Password, stored only as a salted hash. We never store or see your password in readable form.
If you sign in with Google: your name, email address, profile picture address, your Google account identifier, and the sign-in tokens Google issues to us. We do not get access to your Gmail, contacts, calendar, or files.

Settings and onboarding answers

Interface language, time zone, first day of the week, and daily review goal.
Answers you give during onboarding: your learning goals, experience level, and, if you study a language, the language you are learning, your native language, and your level.
Scheduling settings: your target retention and the scheduling parameters calculated for your account.

Your content

Folders, decks, and cards you create or import, including the text on the front, back, and note of each card.
Images you attach to cards or sources, with their size, format, and any description you add.
External sources you record (for example a book or a website), including name, type, link, and notes.

Study activity

A record of each review: the card, the time, the grade you gave, the review mode, hint use, and the scheduling values before and after.
Daily review counts used for your streak and daily goal.
A daily counter of text-to-speech requests, used to limit abuse.

Sign-in sessions and security data

For each sign-in session: the IP address and browser or device description (user agent) it was created from, and when it expires.
One-time links for email verification, password reset, and email change.
IP addresses, used for a short time in memory to limit request rates and block abuse.

Connected apps

If you connect an AI assistant (section 6), we store the name and return address the assistant registered, the permissions you granted, the date, and the access tokens issued to it.

Usage data and analytics

On the Site: anonymous, aggregate usage statistics that do not identify you and do not use cookies or device storage: the pages visited, the referring page, approximate location derived from your IP address (the IP address is not stored as a profile), browser and device type, and clicks on buttons. If you accept analytics cookies in the cookie banner, we may also use more detailed measurement, such as recordings of how pages are used, with text and inputs hidden.
In the App: product analytics linked to your account (your account identifier and name) so we can understand how features are used and improve them: the screens you view, the actions you take (for example completing a review or creating a deck) with counts and settings, your device and platform, interface language, when your account was created, and approximate location derived from your IP address. We may also capture recordings of how the interface is used, with all text and inputs hidden, to improve usability and fix bugs.
What this never includes: the content of your decks, cards, notes, or sources, anything you type, or your email address.
Your choice: you can turn off usage data sharing at any time in the App under Account - Preferences - Share usage data. See sections 4 and 8.

Data stored on your device

The web App uses one strictly necessary sign-in cookie. The desktop and mobile apps store a sign-in token on the device instead.
The App stores interface preferences and onboarding progress in your browser's local storage, together with identifiers used for functional purposes: your account identifier, a random identifier where features are rolled out gradually, and a temporary per-session value used for interface recordings. The same storage remembers your usage-data choice.
The Site stores your cookie choice in local storage.

See our Cookie Policy for details.

Messages you send us

If you email us, we receive your email address and whatever you write.

What we do not collect

We do not use advertising trackers on the Site or in the App, and we do not use analytics for advertising. We do not collect precise location, contacts, or advertising identifiers. The App is currently free, so we do not collect payment details.

3. How We Use Data

We use personal data to:

Create and secure your account, sign you in, and keep you signed in.
Store and show your decks and cards and sync them across your devices.
Schedule reviews. Your review history is used to calculate scheduling parameters for your own account only.
Generate audio when you use the listening feature (section 5, Google Cloud Text-to-Speech).
Send service emails: email verification, password reset, and email change confirmation. We do not send marketing email.
Carry out the requests of an AI assistant you connected, within the permissions you granted.
Understand how the Site and the App are used, and improve them (section 2, Usage data and analytics).
Prevent abuse, limit request rates, investigate errors, and keep the service secure.
Answer your messages and handle your privacy requests.
Comply with legal obligations.

We do not sell personal data, we do not share it for advertising, and we do not use your content to train AI models.

4. Legal Bases (EEA and UK)

If you are in the European Economic Area or the United Kingdom, we rely on:

Performance of a contract - to provide the App under our Terms of Service: your account, your content, review scheduling, sync, and service emails.
Consent - when you connect an AI assistant and approve its permissions, and for the optional detailed measurement on the Site and any other non-essential cookies. You can withdraw consent at any time (sections 6 and 8).
Legitimate interests - keeping the service secure, preventing abuse, fixing errors, answering your messages, and understanding and improving how the Site and the App are used (anonymous statistics on the Site, and product analytics in the App, which you can turn off at any time). You may object to this processing; see section 8.
Legal obligation - where the law requires us to keep or disclose data.

5. Service Providers and Other Recipients

We share personal data only with the providers needed to run Cirello, and only as far as each one needs:

Provider	What it does for us	Data involved
Railway (Railway Corp.)	Hosts the Site, the App, the API, and the database	All data described in section 2, plus server logs
Tigris Data, provided through Railway	Object storage	Images you upload and generated audio files
Resend	Sends service emails	Your email address and the content of the email (for example a verification link)
Google - Sign in with Google	Sign-in, only if you choose it	The account details listed in section 2
Google - Cloud Text-to-Speech	Creates audio for the listening feature	The text of the card side being spoken and its language. No name, email, or account identifier is sent

Audio created by text-to-speech is cached and reused: the same text in the same language produces the same audio file for every user. The cache stores the audio and a one-way fingerprint of the text, and it is not linked to your account.

Analytics. Usage analytics (section 2) is run on infrastructure we control. We do not sell this data, do not use it for advertising, and do not share it with third parties for their own purposes.

AI assistants you connect. When you connect an AI assistant, data from your account is sent to the company that provides that assistant, at your direction. That company is not our service provider; see section 6.

Feedback board. feedback.cirello.app runs on Fider, a third-party service, and uses its own sign-in. What you post there is public. Fider's privacy policy applies to that board.

Legal and safety. We may disclose data if the law requires it, or to protect the rights, safety, or security of users or of Cirello.

Business transfer. If Cirello is transferred to another operator, your data may be transferred with it under this policy, and we will tell you beforehand.

6. AI Assistants and the Cirello Connector

Cirello offers a connector (built on the Model Context Protocol, MCP) and a plugin that let an AI assistant read and change your Cirello library when you ask it to.

It is off until you turn it on. Nothing is shared with any AI assistant unless you start a connection from the assistant, sign in to Cirello, and approve it on the Cirello consent screen. The assistant never receives your Cirello password, and we never receive your password for the assistant.

You choose the permissions. On the consent screen you decide what the assistant may do: view your folders, decks, and cards; view due cards, statistics, and streak; create and edit cards; create and edit decks and folders; merge and split cards; delete cards. Permission to delete cards is off unless you switch it on.

What is sent to the assistant. Only what is needed to answer the assistant's request, within the permissions you granted. Depending on the request this can include folder and deck names and descriptions, card text (front, back, and note), whether a card has an image, each card's learning state and due date, your review queue, and your statistics and streak.

What is never sent. Your password, your email address, your account settings, your sign-in sessions, and your images.

What we receive from the assistant. The requests it makes on your behalf, including any text it asks us to save, such as new cards. Changes made by the assistant are saved to your account exactly as if you had made them in the App.

What we store about the connection. The assistant's registered name and return address, the permissions you granted, the date, and access tokens. Access tokens last one hour. Refresh tokens are replaced every time they are used and expire 30 days after they were issued. We do not keep a separate record of the content of the assistant's requests; technical error logs are covered by section 7.

The AI provider's own handling. Once data reaches the AI assistant, it is processed by the company that provides it (for example Anthropic for Claude, or OpenAI for ChatGPT) under that company's terms and privacy policy, including its rules on retention and model training. We do not control that processing. Review the provider's settings before connecting.

Disconnecting. You can remove a connected app at any time in the App under Account - Security - Connected apps. Access ends immediately and the tokens are deleted. You can also disconnect from the assistant's side, but only removal in Cirello guarantees that the access is revoked on our side.

7. How Long We Keep Data

Account, settings, content, and study activity - kept for as long as your account exists. We do not automatically delete inactive accounts.
Items you delete - a deleted card, deck, folder, source, or image is removed from our database at the time you delete it. Deleting a card or an image also removes the image file from storage. When you delete a whole deck or folder, image files attached to its cards can remain in storage, not visible in the App, until you delete your account.
Account deletion - when you delete your account in the App (Account - Security - Delete account), your profile, settings, content, images, study history, sign-in sessions, and connected-app permissions and tokens are deleted immediately and cannot be restored. We do not keep separate database backups, so no backup copy remains afterwards.
Sign-in sessions - expire 7 days after they were last used, and are removed when you sign out.
Verification, password-reset, and email-change links - expire shortly after they are issued and are then no longer valid.
Connected-app tokens - access tokens expire after one hour, refresh tokens after 30 days; both are deleted at once when you remove the app.
Server logs - technical logs, which can contain IP addresses and request details and are not intended to contain your card content, are deleted within 30 days.
Usage analytics - kept only as long as needed for the purposes in section 3, then deleted or aggregated. Interface recordings are kept for a short, limited period.
Text-to-speech audio cache - kept indefinitely. It is not linked to any account (section 5).
Service emails - our email provider keeps delivery records (recipient address, subject, delivery status) according to its own retention settings.
Messages you send us - kept for as long as needed to handle your request, and deleted on request.

8. Your Rights and Choices

In the App. You can:

View and edit your profile, settings, and content at any time.
Download a full copy of your data: Account - Security - Export your data.
Delete your account and all its data: Account - Security - Delete account.
Remove a connected AI assistant: Account - Security - Connected apps.
Turn off usage data sharing: Account - Preferences - Share usage data. It takes full effect after you reload the App.

By email. Depending on where you live, you also have the right to access, correct, delete, or receive a copy of your personal data, to restrict or object to certain processing, and to withdraw consent. Write to [email protected]. We reply within one month, or sooner where the law requires it. We may need to confirm that the request comes from the account owner.

EEA and UK residents. You have these rights under the GDPR and the UK GDPR, and you may lodge a complaint with the data protection authority of your country.

California and other US state residents. You have the right to know what personal information we collect, to request its deletion or correction, and not to be treated differently for using these rights. We do not sell personal information and do not share it for cross-context behavioral advertising, and we have not done so in the past 12 months.

9. Children

Cirello is not intended for children under 13, and we do not knowingly collect personal data from them. If you are older than 13 but below the age at which you can consent to data processing in your country (up to 16 in parts of the EEA), use Cirello only with the permission of a parent or guardian. If you believe a child has given us personal data, write to [email protected] and we will delete it.

10. International Transfers

Cirello is operated from Ukraine, and our service providers process data in other countries, including the United States. Where the law requires it, transfers are protected by appropriate safeguards such as standard contractual clauses offered by the provider. You can ask us for more information at [email protected].

11. Security

We protect your data with measures that include encrypted connections (HTTPS), hashed passwords, access checks that limit every request to the account it belongs to, short-lived and permission-limited tokens for connected apps, and request rate limits. No system is completely secure. If a breach affects your personal data, we will notify you and the authorities as the law requires.

12. Changes to This Policy

We may update this policy. The new version will be posted here with a new "Last updated" date. If a change materially affects how we use your data, we will tell you in the App or by email before it takes effect.

13. Contact

Questions about this policy or your data: [email protected]. General help: see our Support page.