Privacy Policy

1Information RecallForge Does Not Require

RecallForge does not require users to provide RightVector with a name, email address, telephone number, mailing address, or other account information in order to use the App.

RecallForge is not designed to:

• sell or rent personal information;
• serve third-party advertising;
• create advertising profiles;
• track users across unrelated apps or websites;
• maintain a centralized cloud account containing a user’s study database; or
• use a user’s study content to train RightVector-owned artificial-intelligence models.

2Locally Stored Study Data

RecallForge may store information on the user’s device, including:

• certification Tracks;
• Decks and topic names;
• flashcard questions and answers;
• review history and study schedules;
• FSRS-5 scheduling information;
• progress, readiness, and streak information;
• imported study material; and
• App settings and preferences.

This information is designed to remain locally on the user’s device unless the user affirmatively invokes functionality requiring external processing, exports or shares the information, or otherwise causes it to leave the device.

RightVector does not provide a RecallForge cloud account for centrally storing or synchronizing this study database.

3AI-Powered Flashcard Generation

RecallForge includes an optional feature that uses artificial intelligence to generate flashcards from text voluntarily selected or supplied by the user.

When a user invokes this feature, the text necessary to fulfill the request is transmitted through a server-side proxy and submitted to the OpenAI API for processing by an OpenAI model. The OpenAI API credential is maintained server-side and is not intended to be embedded in the App.

Use of this feature is voluntary. Users who do not want study content transmitted to an external AI service should not use AI-powered card generation.

RightVector does not use content submitted through this feature for advertising, profiling, sale of personal information, or training RightVector-owned AI models.

OpenAI is a third-party service provider. OpenAI currently states that, by default, it does not use inputs or outputs submitted through its API to train or improve its models unless the API customer affirmatively opts in to data sharing. OpenAI’s practices, policies, technical architecture, and terms are controlled by OpenAI and may change independently of RecallForge.

RightVector does not operate OpenAI’s infrastructure and does not have complete visibility into or control over OpenAI’s internal systems. Accordingly, RightVector cannot independently inspect, verify, represent, or guarantee the precise nature, location, duration, or manner in which OpenAI may process, log, retain, cache, back up, secure, disclose, or delete information or technical metadata associated with an API request.

This may include, depending on OpenAI’s systems and policies, prompts, outputs, request bodies, IP addresses, timestamps, network information, security or abuse-prevention information, and other technical or operational data.

To the maximum extent permitted by applicable law, RightVector is not responsible for independent acts, omissions, systems, security practices, policy changes, data-processing practices, retention practices, or other conduct of OpenAI or another third-party provider that is outside RightVector’s reasonable control.

Nothing in this Privacy Policy excludes or limits any responsibility or liability that cannot lawfully be excluded or limited.

Users who require specific assurances regarding OpenAI’s processing should review OpenAI’s then-current API, business-data, privacy, security, and retention documentation before using RecallForge’s AI functionality.

4OpenAI Data Handling

As of the effective date of this Privacy Policy, OpenAI publicly states that API inputs and outputs are not used to train its models by default unless the API customer explicitly opts in.

OpenAI also publishes data-retention practices applicable to its API services. Those practices may depend on the API endpoint, configuration, customer eligibility, legal requirements, security requirements, abuse-prevention measures, or other circumstances.

RightVector does not independently audit OpenAI and therefore does not promise that information submitted for AI processing:

• is never logged;
• is never temporarily retained;
• is never cached or backed up;
• is deleted immediately;
• is retained for any particular period;
• is processed only in a particular geographic location; or
• is immune from disclosure when disclosure is legally required.

OpenAI’s then-current contractual terms and published policies govern OpenAI’s own handling of information. Those terms and practices may change without control by RightVector.

5Information Users Should Not Submit to AI Processing

Because AI-powered flashcard generation requires information to leave the device, users should assume that text submitted to the AI feature will be transmitted to external infrastructure.

Do not submit information through the AI feature that you would not want transmitted to a third-party service provider.

In particular, users should not submit:

• passwords, authentication credentials, private keys, or API keys;
• Social Security numbers or government identification numbers;
• payment-card or financial-account information;
• protected health information or medical records;
• confidential employer, client, or customer information;
• trade secrets or proprietary business information;
• legally privileged material;
• personal information belonging to another person without appropriate authority;
• information subject to contractual confidentiality restrictions;
• export-controlled or similarly restricted information; or
• copyrighted or otherwise protected material that the user is not authorized to process.

The user is responsible for determining whether information may lawfully and appropriately be transmitted to an external AI service.

6Photo and OCR Features

RecallForge may allow a user to use the device camera to capture text from textbooks, documents, whiteboards, or other materials.

Optical character recognition (“OCR”) is designed to occur on the device. RecallForge does not require a captured photograph to be uploaded to RightVector merely to perform OCR.

If the user subsequently chooses to submit extracted text to AI-powered flashcard generation, the relevant text may be transmitted through the server-side proxy to OpenAI as described in this Privacy Policy.

The user is responsible for ensuring that the user has the right to capture, process, reproduce, and use source material.

7Import and Export

RecallForge may permit users to import or export study information using supported formats such as JSON, CSV, or TSV.

Importing a file does not, by itself, require RightVector to maintain a server-side copy of that file.

When a user exports, saves, transmits, or shares information from RecallForge, the user controls the resulting file and its destination. Once information leaves RecallForge at the user’s direction, its subsequent handling may be governed by the receiving application, operating system, cloud-storage provider, messaging service, device, or other third party.

RightVector is not responsible for third-party handling of information after the user elects to export or share it, except to the extent responsibility cannot lawfully be excluded.

8Share Extension

RecallForge may allow users to send text or other supported content to the App using operating-system sharing functionality.

Content received through the RecallForge Share Extension is used to provide the functionality requested by the user. If the user requests AI-powered generation using that content, the necessary text may be transmitted for external processing as described above.

9PIN, Face ID, and Touch ID

RecallForge may provide an optional PIN and may support device authentication technologies such as Face ID or Touch ID.

Biometric authentication is performed through Apple’s operating-system security mechanisms. RecallForge is not designed to receive or store the user’s underlying fingerprint or facial biometric template.

Local security features are intended to help restrict access to the App on the device. They do not create a RightVector cloud account and do not guarantee that a device or its data cannot be compromised.

10Technical and Operational Data

Internet-based services inherently involve communications among devices, networks, servers, infrastructure providers, and service providers.

Although RecallForge is designed to minimize collection of personal information, infrastructure used to provide externally processed features may automatically process technical information such as IP addresses, timestamps, network requests, device or protocol characteristics, security information, error information, or server logs.

Such processing may occur for purposes including transmitting requests, providing requested functionality, maintaining security, preventing fraud or abuse, diagnosing failures, operating infrastructure, or complying with law.

RightVector does not use such information to create advertising profiles or sell personal information.

RightVector may not have complete visibility into technical information automatically generated, logged, retained, or processed by third-party infrastructure providers.

11Analytics, Advertising, and Tracking

RecallForge is not designed to serve third-party advertisements, sell personal information, or track users across unrelated applications or websites for advertising purposes.

If these practices materially change in a future version of RecallForge, this Privacy Policy will be updated as appropriate and any legally required notices or choices will be provided.

12Third-Party Services

RecallForge may rely on third-party technologies and infrastructure, including:

• Apple operating-system and device services;
• Internet, hosting, network, or server infrastructure; and
• the OpenAI API for optional AI-powered functionality.

Third-party providers operate their own systems and may have independent terms, privacy practices, security measures, retention practices, subprocessors, and legal obligations.

RightVector does not control the independent operation of third-party systems and cannot warrant their availability, security, accuracy, retention practices, or future conduct.

13Data Retention and Deletion

RecallForge’s primary study database is designed to reside locally on the user’s device.

Users generally control retention of locally stored study information through the App and the device. Removing data from the App, or removing the App and its associated local data where supported by the operating system, may remove locally stored RecallForge information.

RightVector generally does not maintain a centralized RecallForge user account containing the user’s study database and therefore generally does not possess a server-side study database that can be deleted on the user’s behalf.

Information transmitted through external infrastructure may be processed or retained according to the applicable provider’s systems, configuration, contractual terms, security requirements, legal obligations, and retention practices.

RightVector does not guarantee that information transmitted through third-party infrastructure is incapable of appearing temporarily in logs, caches, backups, security systems, abuse-prevention systems, or other operational infrastructure.

Copies that users independently export, share, transmit, or back up outside RecallForge must be managed through the applicable destination or service.

14Security

RightVector seeks to use reasonable safeguards appropriate to the nature and architecture of RecallForge. The App also provides or relies on device-level security capabilities where applicable.

Nevertheless, no application, device, network, API, server, transmission mechanism, authentication method, or electronic storage system can be guaranteed to be completely secure, continuously available, or free from error or unauthorized access.

Accordingly, RightVector does not warrant or guarantee absolute security.

Users are responsible for maintaining appropriate security for their devices, device credentials, exported files, source materials, backups, and information they elect to transmit to third-party services.

15AI Output and Accuracy

AI-generated flashcards and other AI-generated content may contain errors, omissions, inaccuracies, outdated information, fabricated information, or inappropriate interpretations of source material.

AI-generated content is provided as a study aid and should be reviewed by the user before acceptance or use.

RecallForge is not an official product of, endorsed by, or affiliated with any certification body merely because a user creates study materials relating to that certification.

Users remain responsible for verifying study content against authoritative sources and applicable examination requirements.

16User Responsibility and Intellectual Property

Users are solely responsible for content they create, photograph, import, export, share, or submit for AI processing and for ensuring they have all rights, permissions, licenses, and authority necessary to use that content.

RecallForge does not grant users rights to reproduce or process third-party textbooks, examination materials, proprietary training content, websites, documents, or other protected material.

Users are responsible for complying with applicable:

• copyright and intellectual-property laws;
• examination and certification-provider rules;
• employer policies;
• confidentiality obligations;
• contractual restrictions; and
• applicable laws and regulations.

17No Professional or Examination Guarantee

RecallForge is an educational and study-assistance tool.

Use of RecallForge does not guarantee examination eligibility, examination performance, certification, employment, professional competence, or any particular result.

Readiness scores, scheduling information, progress indicators, and similar features are informational estimates generated from study activity and should not be interpreted as a prediction or guarantee of examination performance.

18Children’s Privacy

RecallForge is designed primarily for people studying for professional and industry certifications and is not directed to children.

RightVector does not knowingly design RecallForge to collect personal information from children for advertising or profiling.

If you believe a child has provided personal information directly to RightVector in circumstances requiring action under applicable law, contact RightVector using the information below.

19Legal Requirements

RightVector may preserve, access, use, or disclose information to the extent reasonably necessary to comply with applicable law, regulation, legal process, governmental request, or enforceable order; protect the security or integrity of services; investigate fraud or abuse; protect rights, property, or safety; or establish, exercise, or defend legal claims.

Nothing in this Privacy Policy limits rights or obligations that cannot lawfully be limited.

20International Processing

Features involving Internet-based or third-party processing may cause information to be processed in jurisdictions other than the user’s location.

By choosing to use functionality requiring external processing, information necessary to provide that functionality may be processed where applicable service providers or their subprocessors operate, subject to applicable law and the providers’ applicable terms.

21Changes to RecallForge and This Privacy Policy

RecallForge may evolve. Features, AI models, service providers, storage methods, technical architecture, and legal requirements may change.

RightVector may revise this Privacy Policy to reflect changes to the App, service providers, practices, legal requirements, or operational considerations.

The “Last Updated” date identifies the most recent revision. Where applicable law requires additional notice or consent for a material change, RightVector will provide it as required.

22No Warranty Regarding Third-Party Services

To the maximum extent permitted by applicable law, RightVector makes no representation or warranty regarding the continuous availability, security, privacy practices, accuracy, performance, or conduct of third-party services used by or accessible through RecallForge.

This provision does not exclude warranties, rights, remedies, or liabilities that cannot legally be excluded.

23Limitation Regarding Third-Party Conduct

To the maximum extent permitted by applicable law, RightVector will not be responsible for losses or damages resulting solely from independent acts, omissions, security incidents, policy changes, processing practices, service interruptions, or other conduct of third parties outside RightVector’s reasonable control.

Nothing in this section limits liability to the extent such limitation is prohibited by applicable law.

24Applicable Rights

Depending on where a user resides, applicable privacy law may provide rights concerning personal information.

Because RecallForge is designed without a centralized user account and primary study data remains on the user’s device, RightVector may not possess information responsive to a particular request.

Where applicable law grants a right concerning personal information actually controlled by RightVector, requests may be submitted using the contact information below and will be handled as required by applicable law.