Privacy Policy

Last updated 8 August 2026. This describes what Daily Deck actually does today. If it changes materially, the date above changes and we tell you in the app.

Daily Deck is run by Willhite Strategy Group. If you want anything below explained, or want to exercise any right described here, email hello@dailydeckai.com.

Willhite Strategy Group is a trading name of Consumer Quest LLC, which is the data controller for the purposes of UK and EU data protection law.

The short version

• We ask for your email address, because that is how you sign in. There are no passwords.
• We store what you tell us about your interests, so the cards can be relevant.
• We record which cards you open, so the app can track your streak and stop repeating cards.
• We do not sell your data, and we do not run advertising or third-party trackers.
• You can download everything we hold, or delete your account outright, from Settings.

What we collect

Things you give us

• Email address — required. It is your identity here and where the sign-in link and any digest goes.
• Name — optional. Used to greet you and to sign referral invitations.
• Your interests — the topics, AI tools you use, how you use AI, and the experience level you set. Used only to choose and pitch your cards.
• Preferences — timezone, time format, digest and reminder times, chosen narration voice and speed, and whether shared links carry our branding.
• Anything you type — notes on saved cards, card feedback, and questions you ask Deckie.
• Invitation recipients — if you invite someone, we store the address you entered so the invite can be sent and credited.

Things we record as you use it

• Your decks and activity — the cards generated for you, which you opened, completed, saved, quizzed on or reviewed, and your streak.
• Product events — a small set of named actions (deck opened, card viewed, quiz started, upgrade clicked, and similar) with a timestamp, so we can tell which parts of the app are worth keeping.
• Session records — start and end time, duration, your browser's user-agent string, and your IP address.
• Push subscriptions — if you turn on notifications, the endpoint your browser issues us. Removing notification permission or unsubscribing deletes it.

Payment details we never see

Card payments are handled entirely by Stripe. We never receive or store your card number. We keep your Stripe customer and subscription identifiers and your subscription status, which is what tells the app whether you have premium.

Why we are allowed to hold it

For readers in the UK and EU, the lawful bases are: contract (your email, preferences, decks and subscription status — without these the product cannot work), legitimate interests (session and event records, to keep the service working, secure and worth improving), and consent (push notifications and the email digest, both off unless you turn them on, and withdrawable at any time).

Who else sees it

Only these, and only for the job named:

• OpenRouter, and through it Google (Gemini) and Anthropic (Claude) — generate your cards, quizzes and answers. They receive the topic and preference signals used to build the request. They do not receive your email address or name.
• Resend — sends the sign-in links, digests and invitations. Receives the recipient address and the message.
• Stripe — takes payments and manages subscriptions.
• Hostinger — hosts the server the app and its database run on.
• Cloudflare — sits in front of the site and handles DNS and TLS.
• Google Analytics — measures which parts of the app get used, and only if you accept the cookie banner. It receives page and event names, and never your email address or name. See Analytics below.

We do not sell personal information, and we do not share it for advertising or cross-context behavioural advertising. We have never received a government request for user data; if we do, we will tell affected users unless legally forbidden.

Analytics

We use two, and they do different jobs.

Umami we host ourselves on our own server. It does not use cookies, does not fingerprint you and does not follow you to other sites. It runs for everyone.

Google Analytics tells us which parts of the app people actually use, so we know what to improve. It is set to denied until you accept the cookie banner: until then it stores nothing on your device and we see only anonymous, aggregate counts. Accept and it sets the cookies listed below. Google acts as our processor; IP addresses are truncated before storage, and we do not use Google Analytics for advertising, remarketing or ad personalisation — those signals are switched off in the tag itself. Event data is deleted after 14 months.

There is no advertising pixel and no other third-party tracker anywhere in Daily Deck.

Cookies

dd_sid is your sign-in session. It is HttpOnly and Secure, so scripts cannot read it and it only travels over HTTPS, and it lasts 60 days or until you sign out. It is strictly necessary — without it you cannot stay signed in.

If you accept the banner, Google Analytics sets _ga and _ga_<id>, which count you as the same returning visitor for up to two years. If you decline, they are never set. Your choice is remembered in your browser under dd_consent and you can change it by clearing this site's data.

There are no advertising cookies of any kind.

How long we keep it

Your account data is kept while your account exists. Sign-in links expire after 15 minutes. Sessions expire after 60 days. Delete your account and everything personal goes immediately — see below.

Your rights

Two of these are built into the app, in Settings → Your data:

• Get a copy. "Download my data" gives you everything we hold as a JSON file.
• Delete your account. "Delete my account" erases your account, decks, bookmarks, saved cards, streak, activity and notification subscriptions, and cancels any active subscription. It is immediate and cannot be undone.

The deletion route is also written up on its own page: how to delete your Daily Deck account. Google Play requires that page to exist and be reachable for any app with accounts, and linking it here is what makes it findable by someone who is not already signed in.

If you cannot reach the app, email hello@dailydeckai.com from your account's address and we will do either within 30 days.

You may also ask us to correct your data, restrict or object to how we use it, or withdraw consent for emails and notifications — the last is one click, from any digest or from Settings. Depending on where you live you may also have the right to complain to a data protection regulator; in the UK that is the ICO.

Cards generated for you may remain in our shared card library after deletion, with the link to you removed. That content is not personal data — it is general writing about AI, not about you.

Where your data is

Our server, and the database on it, are in the United States (Boston, Massachusetts). Our processors are also mostly US-based. If you are in the UK or EU, using Daily Deck means your data is transferred to the United States; those transfers rely on the UK Addendum and the EU Standard Contractual Clauses with the providers concerned.

If you are a California resident: we do not sell your personal information and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of. You still have the rights to know, delete and correct, all covered above.

Children

Daily Deck is not for children under 13, and we do not knowingly collect their data. If you believe a child has given us data, email us and we will delete it.

Security

Traffic is HTTPS-only. Sign-in is by expiring single-use link, so there is no password to steal. The database is not publicly reachable. No system is perfect, and we will not pretend otherwise — if a breach affects you, we will tell you.

Changes

If this policy changes in a way that affects you, we will update the date at the top and say so in the app before it takes effect.

← Back to Daily Deck