Ten Cards Privacy Policy

Last updated: August 22, 2026

Ten Cards is a coding-interview study app. This policy explains what information Ten Cards processes, why it is processed, and the choices available to you.

Information Ten Cards processes

Ten Cards may process:

• account information supplied by an authentication provider, including your user identifier, name, and email address. Ten Cards displays a small local pixel-art profile picture generated from your account identifier rather than using a provider profile photo;
• profile preferences such as display name, daily goal, and time zone;
• an email address you voluntarily submit on ten-cards.com to request TestFlight access or Ten Cards launch updates;
• study content you create, including written answers, selected answers, bookmarks, solve records, and confidence ratings; and
• product-interaction data required for learning features, including study sessions, scores, response times, progress, XP, streaks, and activity history.

Ten Cards does not include advertising or cross-app tracking code and does not sell personal information.

The Ten Cards website does not use advertising, cross-site tracking, or product analytics. It does not set an analytics or advertising cookie.

How information is used

This information is used to authenticate you, synchronize your progress, personalize review scheduling, grade answers, show learning history, operate widgets, secure the service, diagnose failures, and provide support.

If you join the website waitlist, Ten Cards uses the submitted email address only to contact you about TestFlight access and the Ten Cards public launch. The waitlist does not send an automatic confirmation email and is not used for unrelated marketing.

Service providers

Ten Cards uses Supabase for authentication, database hosting, and server-side functions. If you choose Google, GitHub, or Apple to sign in, that provider also processes the information needed to authenticate you under its own privacy terms.

Ten Cards uses Cloudflare to host and protect ten-cards.com. Cloudflare D1 stores waitlist email addresses, creation times, and the applicable consent-policy version. Cloudflare Turnstile checks whether a signup appears automated before the website accepts it. Ten Cards does not add the visitor's IP address to the waitlist record.

Ten Cards uses RevenueCat to process and reconcile App Store subscription status. RevenueCat receives a random billing identifier, App Store product and transaction information, subscription status, and limited app/device metadata needed to provide purchases and restore access. Ten Cards does not use an email address or display name as the RevenueCat customer identifier. Apple processes the purchase and payment under its own terms; Ten Cards and RevenueCat do not receive your full payment-card number.

Ten Cards uses Sentry in TestFlight and production Release builds to diagnose crashes and operational failures. Sentry may receive native crash stacks, device and app-version metadata, bounded screen and operation breadcrumbs, a random support reference, and the Ten Cards account identifier. Ten Cards does not send Sentry your email, display name, authentication credentials, written answers, question text, grading prompts or responses, screenshots, view hierarchies, or network request and response bodies. The account identifier is used only to determine how many accounts encountered a failure and to correlate reports from the same account.

Free-response AI grading is optional. Ten Cards asks for permission before the first AI-graded submission. If you allow it, Ten Cards sends the question, grading rubric, curated model answer, and the answer you wrote to the configured OpenAI or Azure OpenAI service. The grading prompt does not include your name, email address, or Ten Cards user identifier. The service returns a suggested score and feedback. AI feedback can be inaccurate and should be treated as study guidance.

You can decline AI grading and reveal the curated answer instead. You can also withdraw AI grading permission at any time under Profile → Privacy & AI. Ten Cards will then stop sending new answers for AI grading unless you give permission again.

Service providers, including Supabase, RevenueCat, Sentry, and an AI provider when you opt into AI grading, process information only to provide their configured service to Ten Cards and are subject to their applicable contractual and privacy terms. Provider retention and regional processing can depend on the production account configuration and the provider terms in effect when the service is used.

Retention and deletion

Account and study information is retained while your account exists so Ten Cards can provide synchronized learning history. Operational security and error logs may be retained for a limited period under service-provider settings.

Waitlist email addresses are retained until they are used for beta access or launch updates and are deleted within 90 days after Ten Cards launches publicly on the App Store, unless you separately renew your consent. You can request earlier removal by emailing [email protected]. Removing a waitlist address does not delete an in-app Ten Cards account, and deleting an in-app account does not automatically remove a separately submitted waitlist address.

You can permanently delete your account inside the app under Profile → Delete account. Deletion removes the Ten Cards authentication account and associated profile, answers, sessions, bookmarks, progress, XP, streak, and activity data, except information that must be retained temporarily for security, fraud prevention, or legal compliance.

Deletion also requests deletion of the linked RevenueCat customer profile. Deleting a Ten Cards or RevenueCat account does not cancel an active App Store subscription. You can manage or cancel the subscription in Apple Subscriptions; access continues through the paid period subject to Apple's subscription terms.

If you used Sign in with Apple, Ten Cards asks you to reauthenticate during account deletion. Ten Cards uses the resulting one-time authorization code to revoke its Apple authorization before deleting your account and associated study data. The authorization code is not retained after deletion.

Data security

Ten Cards uses authenticated connections and server-side authorization controls to limit personal study data to the account that created it. No method of storage or transmission is completely secure, but access controls are reviewed and tested as part of release preparation.

Children

Ten Cards is intended for coding-interview preparation and is not directed to children under 13. Do not use Ten Cards if local law does not permit you to consent to this processing.

Changes

If this policy changes materially, Ten Cards will update the date above and ask again before any newly described AI data sharing occurs.

Contact

For privacy questions or to remove a waitlist email address, email [email protected]. For general support, open an issue in the Ten Cards support tracker. Do not include passwords, access tokens, private answers, email addresses, or other sensitive personal information in a public support request.