Start straight away
You download the app and begin, with no sign-up, no address and no password. Offline everything works exactly as it does with a network.
Your cards stay where you put them
Qardbox has no server, no account and no analytics. This page shows what that means in detail, and how you can check every statement here yourself without having to take my word for it.
Three sentences up front
Only your cards
The app processes only what you type in yourself, with no analytics, no tracking and no advertising identifier. That is also in the app's privacy manifest, where anyone can read it.
Your device, your storage
The only route outwards leads into your own iCloud, and you switch that on yourself. There is no Qardbox server for anything to go to.
Dein Gerät
Karten, Fächer und Lernstände liegen hier. Offline vollständig nutzbar.
iCloud, wenn du willst
Ab Werk aus. Eingeschaltet gleicht Qardbox über deine private CloudKit-Datenbank ab. Karteninhalte liegen dort als verschlüsselte Felder.
Kein Qardbox-Server
Es gibt keine dritte Stelle. Der Entwickler hat keinen Zugriff auf deine Daten.
Where your cards live
Your cards live on your device and iCloud sync is off by default. You turn it on once under Settings, Study, iCloud sync, and you can turn it off there again at any time. What has already been synced then stays on both devices.
What happens when you turn sync on
Your subjects, cards and progress then sync between your Apple devices, through CloudKit in a private database on your own Apple ID. The developer has no access to it and could not obtain any.
The contents of your cards, that is question, answer, categories, note and the subject name, are set up as encrypted fields. And if you additionally turn on Advanced Data Protection under Apple ID, iCloud, then not even Apple can read them.
Your ratings and study timestamps, by contrast, stay unencrypted. From those someone can read that you studied, but not what you studied. Without the matching card contents these are just timestamps and two possible values, no more.
Qardbox never deletes anything through sync. What you removed on one device stays on the other until you delete it there too.
Why there is no built-in AI
A built-in card generator would have to send your material to an outside provider, and Qardbox sends nothing to servers. Instead you get a text block for an AI of your choosing. What goes out that way is your decision alone, with the same awareness as for any other app on your device.
Do not just take my word for it. Check it yourself.
iOS keeps its own record of this and you can read it at any time. In the iOS settings, under Privacy & Security, turn on App Privacy Report. After a few days you will see, for every app on your device, which addresses it contacted and how often.
For Qardbox at most two addresses appear, and both belong to Apple:
| Address | What is behind it |
|---|---|
| gateway.icloud.com | Apple's iCloud. Appears only if you have turned sync on. Without sync everything stays on the device. |
| mzstorekit-sb.itunes.apple.com | Part of the App Store. iOS contacts the address on the app's behalf, for example to check whether a review prompt may be shown. No study data goes with it. |
If nothing is listed there, then nothing happened, because the report only records what actually took place.
Backing up and deleting
Under Settings, Privacy you create a copy of your data and restore it again. Under Study, Reset you remove your progress and reviews while the cards themselves stay. And if you uninstall the app, all local data is gone, without your having to cancel an account anywhere.
When your material must not leave the house
Some content is not secret and still nobody else's business. Internal procedures belong there, as do names from work and exam material under lock and key. Anyone studying that has a problem with every app that sends content to a provider for processing.
With Qardbox the question does not arise, because there is no place for anything to go to. Your cards live in your device's storage, iCloud sync is off by default, and AI card generation deliberately takes place outside the app. What you write in stays there until you decide otherwise yourself.
Whether that is enough for your own case is something only you can judge, and public bodies and companies usually have their own rules for it. This page therefore describes only what technically happens, and draws no conclusions for you.
The legal side
The full privacy policy is available in twelve languages at Privacy policy, word for word identical to the version inside the app. I am glad to answer your questions about it, and the address for that is in the legal notice.