Acard Privacy Policy
This is an English translation for convenience. If it differs from the Korean original, the Korean version (한국어 원문) prevails.
Effective date: October 24, 2026 · This policy may be revised after expert review during the beta; we will announce any change as described in section 12.
Acard ("Acard", "we") publishes this policy under Article 30 of the Korean Personal Information Protection Act (PIPA) to explain how we process and protect your personal information and to handle related complaints quickly. It covers the Acard local app (the desktop app and the open-source open-notion-acard), the public site acard.dev, the waitlist and the web app (Acard Cloud).
The short version
- Your notes and files in the local app stay on your PC. We do not receive them and cannot see them.
- The only thing the local app sends out by default is one update check. No usage statistics, crash reports or telemetry.
- The personal information we receive is mainly the email address you give when joining the waitlist.
- The web app (Acard Cloud) is currently for internal testing only and does not accept outside sign-ups.
Contents
- Information we process, purposes, legal basis and retention
- What the local app sends and receives
- Children under 14
- Destruction
- Provision to third parties
- Processors
- Transfers abroad
- Security measures
- Cookies and browser storage
- Your rights and how to use them
- Privacy officer and where to get help
- Changes and history
1. Information we process, purposes, legal basis and retention
We process only the minimum needed for the purposes below. If a purpose changes we take the steps PIPA Article 18 requires, such as asking for consent again. We do not process sensitive information, unique identification numbers or pseudonymized information.
(1) Processed with your consent
| Purpose | Items | Retention |
|---|---|---|
| Waitlist sign-up, your place in line, invitations and launch news | [Required] email [Optional] AI tools you use, what you want to use Acard for, Discord username, how you found us (the source tag of the link) | Until you cancel. If you do not, deleted one year after the official launch |
| Record of the required consents | Email, the items agreed to, the document version (effective date), time of consent | One year after the waitlist entry or account is deleted (to prove consent) |
| Account sign-up (web app, currently internal testing only) | Email, password (stored only as a hash), name, email and profile picture provided by Google when you sign in with Google, sign-in records, notes and files you create, public handle, AI feature usage records | Until you delete the account |
You may refuse consent. Without the required items you cannot join the waitlist or sign up. Leaving the optional questions unanswered has no effect on your sign-up.
(2) Processed without consent
| Purpose | Legal basis | Items | Retention |
|---|---|---|---|
| Running the site and update server, blocking abuse | PIPA Art. 15(1)6 (legitimate interest) | IP address, requested URL, time, browser/app version and OS | We do not keep separate access logs. To block too many requests in a short time we count requests per IP in server memory; the count disappears within one day. |
| Answering inquiries and requests | Art. 15(1)4 (steps taken at your request) | Email, content of the inquiry | One year after the matter is closed |
| Web app feedback (internal test accounts) | Art. 15(1)4 | Report content, screenshots you attach, environment details you leave on (page address, browser and OS, screen size, app version, time), account email | Until the account is deleted |
2. What the local app sends and receives
Checked against the local app code as of October 24, 2026.
| When | What | Where | How to turn it off |
|---|---|---|---|
| When the installed desktop app starts | An update check. The request carries your IP address, app version and OS. New versions are downloaded from GitHub. | acard.dev/releases (Cloudflare); installers from github.com | Start the app with the environment variable ACARD_NO_UPDATE=1. There is no in-app switch yet. |
| Only when you enter a license code | The license code, an account identifier and a random device number created on this PC | acard.dev/api/license/activate | Nothing is sent if you do not register. |
| Only when you connect an acard.dev account and turn on backup, sync or publishing | The connected account, and the pages, backup files and attachments you chose to upload | acard.dev | Nothing is sent once you disconnect or turn the feature off. |
The local app keeps your notes, files and settings in a data folder on your PC (for the desktop app on Windows, %APPDATA%\Acard). The local app has no AI feature that goes through Acard's servers. If you connect your own AI tool (for example Claude Code or Codex) to the local app, what you exchange with that tool is between you and its provider and never reaches Acard.
3. Children under 14
Children under 14 cannot join the waitlist or create an account, and we do not collect their personal information. We ask you to confirm you are 14 or older when you sign up, and if we learn we have information from a child under 14 we delete it right away.
4. Destruction
- When the retention period ends or the purpose is achieved, we destroy the information without delay. If another law ever requires us to keep something, we will list the basis and items here and keep it separately. There is no such information now.
- Electronic files are deleted from the database so they cannot be restored. We do not handle personal information on paper.
- When you ask us to cancel your waitlist entry or delete your data, we do so within 7 days.
5. Provision to third parties
We do not provide your personal information to third parties, except where a law specifically requires it or an investigative authority requests it through legal procedure, and then only to that extent. We never use it for advertising or sell it.
6. Processors
We entrust the following companies with processing to run the service. If a company or task changes we update this policy right away.
| Processor | Task |
|---|---|
| Supabase Pte. Ltd. | Database storage of waitlist entries, consent records, account, sign-in and profile data, feedback and AI feature usage records |
| Cloudflare, Inc. | Running and securing the site, downloads and update server (abuse blocking), storing web app notes, edit history, images and attachments, running some web app AI features (polishing text, asking your notes, reading text in photos and similar), forwarding mail sent to hello@acard.dev |
| InferHub (individual operator) | Running web app AI features (agent chat and tasks, inline writing, folder suggestions, work log summaries) |
| Plus Five Five, Inc. (Resend) | Sending invitations, sign-in link and code emails, and service alerts |
If you sign in with Google, you authenticate with Google directly and we receive only the name, email and profile picture Google provides.
7. Transfers abroad
The processors above are overseas companies, so personal information is stored and processed outside Korea (PIPA Art. 28-8). Notes in the local app are not transferred.
| Recipient (contact) | Country | Items | When and how | Purpose and retention |
|---|---|---|---|---|
| Supabase Pte. Ltd. (privacy@supabase.com) | Singapore (AWS Singapore region) | Waitlist email and optional answers, consent records, account, sign-in and profile data, feedback, AI feature usage records | Sent over an encrypted connection when you join, sign up or use the service | Database storage / periods in section 1 |
| Cloudflare, Inc. (privacyquestions@cloudflare.com) | United States and the countries of Cloudflare data centers (storage is requested in Asia-Pacific but cannot be pinned to one country) | IP address and request details, web app notes, edit history, images and attachments, text and images you give AI features, mail sent to hello@acard.dev | Sent over an encrypted connection when you visit, save, run an AI feature or send mail | Running the site, storage, AI processing, mail forwarding / web app data until the account is deleted, the rest while it is processed |
| InferHub (inferhub.dev/privacy) | The operator does not disclose a country. Requests may be passed on to the countries of upstream model providers (GLM, DeepSeek) | Page text you give web app AI features | Sent over an encrypted connection when you run an AI feature in the web app | Generating AI answers / while processed (request logs and some request content for the periods in InferHub's policy) |
| Plus Five Five, Inc. (Resend, support@resend.com) | United States (sending servers in Japan, AWS Tokyo region) | Recipient email address, content of the email | Sent over an encrypted connection when an email is sent | Sending mail / until delivered (Resend's own policy governs its send logs) |
- Basis: for the waitlist and sign-up we ask for separate consent to the transfer on the sign-up form (Art. 28-8(1)1). For site access and mail forwarding, the transfer is processing and storage needed to provide the service you asked for and is disclosed in this policy (Art. 28-8(1)3(a)).
- How to refuse and what happens: leave the transfer box unticked on the form, or withdraw a given consent by writing to hello@acard.dev. Waitlist entries and accounts cannot be kept without this transfer, so refusing or withdrawing cancels the entry or account and we delete it. Web app AI features send nothing to InferHub or Cloudflare AI unless you run them. Site access information is required to reach the site, so the only way to refuse it is to stop using the site.
8. Security measures
These are the measures we actually take today.
- All traffic between your browser and our servers is encrypted with HTTPS. Stored data is encrypted with AES-256 by Supabase and Cloudflare.
- Passwords are stored only as hashes.
- Row-level security (RLS) is on for every table in the database, and waitlist entries and consent records can be read and written only with the service key held by the server. The key exposed to browsers cannot read or write these tables. The service key stays on the server.
- Access to personal information is limited to the operator, and the admin screens work only for signed-in admin accounts.
- Bursts of too many requests are blocked to limit unauthorized access and abuse.
9. Cookies and browser storage
- The site uses only cookies for staying signed in (acard_at, acard_rt), handling Google sign-in (acard_pkce, acard_next, acard_gauth, kept for 10 minutes) and the display language (acard_lang, one year), plus browser storage that helps pages draw faster.
- We use no advertising, analytics or tracking cookies and no third-party analytics tools.
- You can block cookies in your browser settings (for example Chrome Settings > Privacy and security > Third-party cookies / Delete browsing data). Features that need sign-in will not work if you do.
10. Your rights and how to use them
- You may ask to see, correct or delete your personal information, ask us to stop processing it, and withdraw consent. A legal representative or someone you authorize may ask on your behalf.
- How: write to hello@acard.dev from the email you used. After confirming the request came from that address we reply with the result within 10 days. If a legal reason prevents us from doing what you ask, we tell you why.
- To cancel your waitlist entry or delete your account, ask the same way; we delete it within 7 days. Deleting an account removes the account, web app notes and files, and its waitlist, feedback and AI usage records. Local app data is on your PC, so you delete it yourself.
11. Privacy officer and where to get help
- Privacy officer name: Yu Sungjin (Representative)
- Contact: hello@acard.dev (privacy questions, complaints and requests for remedy)
If you need help with an infringement of your personal information, you can report it to or consult these Korean agencies.
- Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
- Personal Information Infringement Report Center (KISA): 118, privacy.kisa.or.kr
- Korean National Police Agency: 182, ecrm.police.go.kr
12. Changes and history
- This policy applies from October 24, 2026.
- We announce changes on the site 7 days before they take effect. Changes that are unfavorable to you, such as new items or purposes, are announced 30 days ahead with a before-and-after comparison.
| In effect | Summary |
|---|---|
| October 24, 2026 - | Rewritten around the local app: what the local app sends, items, basis and retention per purpose, destruction, processors and transfers abroad, security measures, cookies, your rights, privacy officer, help agencies, history |
| October 16 - 23, 2026 | First version (see the previous version, Korean and English) |