Privacy Policy

Information we use

• Account information. Firebase Authentication processes the email address and password submitted for email/password sign-in. It also processes Google sign-in credentials and maintains your account ID and sign-in session. PrickleMind does not receive or store plaintext passwords in Cloud Firestore. Firebase Authentication maintains email-verification status and sends verification emails for email/password accounts to confirm control of the inbox. Normal app access is blocked until Firebase confirms the email is verified; Google accounts already verified by Firebase do not receive a separate verification email. Your PrickleMind profile stores your ID, name, email, Google photo URL if available, creation and last-login times, and onboarding status. A normal profile is created only after email verification and any required Terms and Privacy acceptance are complete. For new accounts, we also record the accepted Terms of Use version, Privacy Policy version, and a server-generated timestamp when that acceptance is saved in your profile. If account setup is interrupted, the app temporarily keeps the accepted versions, name, and account email on your device to finish saving this record when you retry. This lets you sign in, recover access, and use your learning library.
• Minimum-age confirmation. During account setup, you must explicitly confirm that you are at least 13 years old. PrickleMind stores that confirmation with your versioned Terms of Use and Privacy Policy acceptance. The app does not ask for or newly store a birth date or age bracket. Older profiles may retain a previously supplied age band; it is no longer used to authorize access or select advertising treatment.
• Learning data. We save vocabulary set titles, descriptions, terms, definitions, ordering, counts, and timestamps. Recall progress includes correct, incorrect, and skipped counts, streaks, last results, and review times to adapt practice. Current quiz answers and daily quiz totals stay in app memory; they are not saved as a separate cloud quiz history.
• Image scanning. When you take or choose a photo to scan vocabulary, the selected image is resized and compressed on your device and transmitted through PrickleMind’s Firebase Cloud Function to OpenAI, where AI reads the image to extract vocabulary. AI can make mistakes; please check the results before saving. An internet connection and sign-in are required. PrickleMind does not intentionally persist the submitted image, raw extracted text, or raw model response after completing the request. The image picker may keep a temporary copy in the app’s cache, including while recovering an interrupted selection; cleanup of that cache is managed by the device and image picker. PrickleMind does not add the image to your photo library. Results appear in an editable preview, and only the terms and definitions you explicitly confirm with Save Terms are saved as learning data.
• Recall Sessions. We save session names, linked sets, schedules, days, intervals, question counts, quiz modes, Question Direction, pause status, and timestamps to run your chosen practice schedule.
• Device data. Your device keeps sign-in state, cached learning data, manual-quiz Question Direction, notification settings, pending reminders and taps, and account-cleanup markers. Local delivery records include account/session IDs, reminder content, times, and outcomes to handle reminders and avoid duplicates. Your device’s time zone is used for scheduling.
• Advertising and privacy choices. Free users may see Google AdMob banner ads during quizzes or choose to watch a rewarded ad for temporary access to another saved set. Premium users do not receive ads. PrickleMind uses Google’s User Messaging Platform to request and store privacy choices where required. The app does not request an ad until that process says ads may be requested. At launch, all eligible free accounts receive Google’s teen age-restricted treatment and non-personalized ad requests, including accounts belonging to adults. Account setup and the privacy decision must finish before advertising is initialized or requested. PrickleMind does not intentionally send vocabulary, quiz answers, email addresses, display names, or raw PrickleMind account IDs to Google Mobile Ads. Google may process device and app information, IP addresses, advertising identifiers where available, ad interactions, and security or diagnostic signals to deliver, measure, and protect ads.
• Support. If you email PrickleMind, we receive your email address and the information you send so we can respond.

Storage & service providers

Google processes cloud account information through Firebase Authentication, stores profiles and learning data in Cloud Firestore, runs account deletion and image scanning through Cloud Functions, and serves these webpages through Firebase Hosting. Google also processes Google Sign-In and serves Google profile photos. Device preferences, caches, reminder records, and an account-specific verification-email resend cooldown time are stored locally; support emails are received in PrickleMind’s Gmail inbox.

For request verification and abuse prevention, Firebase App Check uses Google Play Integrity on Android and Apple DeviceCheck on iOS. Google and Apple may process app/device attestation information and integrity tokens to verify requests from PrickleMind. See Firebase’s data processing information.

OpenAI processes submitted vocabulary images through its Responses API. PrickleMind requests that responses not be stored as persistent API responses. OpenAI API data is not used to train models unless the developer opts in. Under OpenAI’s default controls, API content may be retained in abuse-monitoring logs for up to 30 days, unless longer retention is legally required or reasonably necessary to protect people or services from harm. Images flagged as potential child sexual abuse material may be retained for manual review. This feature does not promise immediate deletion or Zero Data Retention. See OpenAI’s API data controls.

For safety, PrickleMind sends OpenAI a stable pseudonymous identifier derived from your authenticated account ID. It does not send your raw account ID, email address, or display name as this identifier, and PrickleMind does not log it. Only submit vocabulary material you want processed; avoid photos containing personal information.

To limit abuse, PrickleMind stores a scan-attempt count and UTC calendar month linked to your account ID, with an expiry time, separately from learning data. These records contain no image or vocabulary content. PrickleMind’s scan logs contain only operational information such as duration, result category, number of validated pairs, and token counts, not images, extracted text, or account IDs.

PrickleMind does not sell personal information. It includes Google Mobile Ads and Google’s User Messaging Platform for the limited advertising described above, but does not include a separate general-purpose analytics or crash-reporting SDK and does not make app-owned file uploads to Cloud Storage. Google’s use of data is governed by its partner-sites privacy information and the choices available through the consent message.

This privacy page uses no scripts or tracking cookies. The deletion page uses Firebase sign-in with a temporary in-memory session and a tab-session flag to remember successful deletion; the flag contains no account information.

Notifications

Recall reminders are scheduled locally on your device through its notification system. PrickleMind requests notification permission where required; you can decline or change it in device settings. Reminders can show a vocabulary set’s title on your lock screen, depending on your settings. You can pause or delete Recall Sessions. In-app Recall prompts can still appear while you use PrickleMind, even when system notifications are off.

Retention & account deletion

Cloud account data stays stored until you delete the relevant content or your account. Signing out or uninstalling the app does not delete your cloud account.

Use Profile → Delete Account in the app or the account deletion webpage, which works without the app installed. After sign-in verification and confirmation, deletion removes your Firestore profile and all nested account data, including sets, terms, Recall progress and Sessions, then your Firebase Authentication account. It does not delete your Google account. Deletion is permanent; interrupted requests may need a retry.

A security record linked to your account ID remains to prevent old sessions from recreating data. It holds a random operation ID and expiry times, with no profile, vocabulary, email, or credentials. It is marked for expiry 24 hours after deletion starts; actual removal depends on the database’s automatic cleanup setting and is not immediate. We do not guarantee a fixed deletion time.

Scan-limit records are marked for expiry one day after the scan’s UTC calendar month ends. Actual removal depends on the database’s automatic cleanup setting and is not immediate. These content-free records may temporarily remain after account deletion to limit abuse.

The app clears account-related local preferences, caches, and reminders after deletion or when it next detects the deleted account. The website cannot clear devices directly; offline devices may retain data and reminders until that detection. Installation-wide settings, including notification permissions, remain. Support correspondence is retained only as reasonably necessary to respond, prevent abuse, resolve disputes, and meet legal obligations. Account deletion does not automatically delete prior support correspondence.

Security & your choices

PrickleMind uses authenticated access and account-specific database rules, and requires recent sign-in verification for account deletion. No storage or transmission system is completely secure, and device cleanup is not a guarantee of forensic erasure.

You can review, edit, or delete vocabulary content and Recall Sessions in the app, change Question Direction, control device notification permissions and previews, or delete your account. When Google requires an in-app privacy-options entry point, use Profile → Privacy choices to review or change the choices presented by Google. Contact PrickleMind with privacy questions or requests for help; please do not email your password.

Ages 13 and older

PrickleMind is for users ages 13 and older and is not intended for children under 13. The account-setup flow requires an explicit confirmation that you are at least 13 before you can use the app. We do not knowingly collect personal information from children under 13. All eligible free accounts receive teen age-restricted and non-personalized ad treatment at launch. If you are a parent or guardian and believe your child under 13 has provided personal information, contact support.pricklemind@gmail.com so we can investigate and arrange removal of that information.

Updates & contact

We will communicate policy updates by posting the revised policy on this page and changing the effective date above. Please review this page for the current policy.

PrickleMind is the developer responsible for this policy. For privacy or support questions, email support.pricklemind@gmail.com.