Privacy policy

Last updated: November 11, 2026

This policy explains what information UltimCard (“UltimCard”, “we”, “us”) collects when you use the UltimCard web app at app.ultimcard.com, the UltimCard mobile apps, browser extension and related services (together, the “Service”), how we use it, and the choices you have. Questions: support@ultimcard.com.

1. Information we collect

Account information

Your email address, first and last name and, if you add one, a profile picture.
If you sign up with an email address and password, your password is stored by our authentication provider in hashed form; we never see it.
If you sign in with Google, the information described in section 3.

Content you create

The cards you create and everything in them: titles, descriptions, fields, dates, links, classifications, comments, timers, and the pictures, videos and documents you upload or link. If you save a web page, we store its address and the title, description and picture the page publishes.

Device and technical information

For the mobile apps and devices you pair (for example a wall display): the device type, app version and, if you allow notifications, a push-notification token.
Standard server logs: IP address, browser or app identifier (user agent), requested address, referring page, date and time. We use them to run, secure and troubleshoot the Service and to measure which media files are served.
Cookies: only the cookies needed to keep you signed in and remember your settings. We use no advertising or third-party analytics cookies.

2. How we use information

To provide the Service: create your account, sign you in, store and sync your cards across your devices.
To run the features you use, such as reminders and notifications, sharing, and AI features (section 4).
To answer your requests and send messages about your account (confirmation, password reset, important changes).
To keep the Service secure, prevent abuse, fix problems and improve how it works.
To comply with the law.

We do not sell your personal information, and we do not use it for advertising.

3. Google user data

When you choose “Sign in with Google” or “Continue with Google”, Google shares with us your name, email address and profile picture (the basic “openid”, “email” and “profile” permissions). We request no other Google permission: UltimCard does not access your Gmail, Google Drive, Google Calendar, contacts or any other Google data.

Use: we use this information only to create and identify your UltimCard account, sign you in, and display your name and picture in the Service (you can replace the picture or remove it).
Storage: it is stored with your account in our authentication and database provider (section 5) for as long as your account exists.
Sharing: we do not share it with anyone except the service providers that host the Service on our behalf, and we never sell it or use it for advertising.
AI: we do not use Google user data to develop, improve or train AI or machine-learning models.

UltimCard’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. You can remove UltimCard’s access at any time from your Google Account (Security → Third-party apps and services).

4. AI features

Some features use artificial intelligence when you ask for them: identifying an object in a photo, suggesting fields or icons for a card, or filling a card from a web page. For these, the content concerned (for example the photo, the page text or the card’s fields) is sent to an AI provider (currently Google’s Gemini API) to produce the result, which we show to you and save only if you keep it. We do not use your content to train AI models.

If you connect your own AI assistant to UltimCard (for example through the Model Context Protocol), that assistant can read or change your cards within the permissions you grant, and its provider handles that data under its own terms. You can disconnect it at any time.

5. Who we share information with

Service providers that host and run the Service for us, under contracts that limit their use of the data: Supabase (database, sign-in, file storage), Vercel (web hosting), Cloudflare (domain names and delivery of media files), Google (sign-in with Google, Gemini AI features, Firebase Cloud Messaging for push notifications), Render (the service that connects AI assistants), and our email delivery provider.
People you choose: when you share a card with another user or create a public link to a card, the people you share with (or anyone with the link) can see that card.
Legal reasons: when required by law, or to protect the rights, safety and security of our users, the public or the Service.
Business transfer: if the Service is reorganised or transferred, your information may move with it, under this policy.

6. Storage and security

Your information is stored on servers in the United States. Connections are encrypted (HTTPS), access to your cards is limited to your account by database access rules, and private files are only served through short-lived links. No system is perfectly secure, but we work to protect your information and will inform you of a breach that affects you as required by law.

7. How long we keep information

We keep your account and cards for as long as your account exists. You can delete cards at any time. If you ask us to delete your account, we delete your account, cards and files within 30 days; copies in backups are erased within a further 90 days. Server logs are kept for a limited period for security and troubleshooting.

8. Your choices and rights

Access, correct or export the information in your account, and delete cards, from the Service.
Ask us for a copy of your data, its correction or deletion, or the deletion of your account, by email.
Turn notifications off on your device, and disconnect Google sign-in or a connected AI assistant at any time.

Depending on where you live (for example in the European Economic Area, the United Kingdom or California), you may have additional rights: to object to or restrict some processing, to data portability, to withdraw consent, and to lodge a complaint with your data protection authority. Where these laws apply, we process your information to perform our contract with you (providing the Service), for our legitimate interests (security and improvement of the Service), with your consent (optional features such as notifications), and to meet legal obligations. To exercise a right, write to support@ultimcard.com; we answer within the time the law requires.

9. Children

The Service is not intended for children under 13 (or under 16 in the European Economic Area), and we do not knowingly collect their information. If you believe a child has given us information, contact us and we will delete it.

10. Changes to this policy

We may update this policy. The date at the top shows the latest version; if a change is significant, we will tell you in the Service or by email before it takes effect.

11. Contact

UltimCard — support@ultimcard.com — ultimcard.com