Privacy Policy
badNerd is an independent project operated from Ukraine. This policy explains what the web app and the Chrome extension collect, why, and who else touches it. Last updated 11 August 2026.
What we collect
Account data. Your email address, and — if you sign in with Google — the name and profile picture on that Google account. We request only your email address and basic profile; we never receive your Google password and never read your Gmail, Drive or Calendar.
Content you create. Sources you save, decks, cards, notes, folders, drawings, uploaded files, chat messages, review history, and the settings that go with them. This is the substance of the product — it exists because you put it there.
Text you send for translation. When you translate a selection, that selection is sent to our servers and on to our translation provider. Nothing else on the page is read or transmitted.
Technical data. IP address, browser and device type, and timestamps, collected automatically when the app talks to our servers. Product analytics: which screens you open and which actions you take, tied to your account id. Crash and error reports when something breaks.
Push tokens. If you enable review reminders, we store the notification token your browser issues, so we can send them.
Why we process it
- To run the service you asked for — store your library, generate cards, schedule reviews, sync across devices. Legal basis: performance of our agreement with you.
- To keep the service working and secure — error monitoring, abuse prevention, understanding which features are used. Legal basis: our legitimate interest in a product that functions.
- To send review reminders, where you turned them on. Legal basis: your consent, withdrawable at any time in settings.
We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We do not run ad networks on the app.
Who processes it besides us
A small number of external providers process data on our instructions, each under contract and each with access only to what its own job needs:
- Hosting, database and file storage — the account and the library themselves.
- Authentication — signing you in, including Google Sign-In if you choose it.
- Push delivery — sending review reminders, if you turn them on.
- Product analytics and crash reporting — which screens are used and what breaks.
- Machine translation — the text you select for translation.
- AI model providers — generating summaries, cards and chat replies from the content you save.
Content sent to translation and AI providers is used to produce your result and nothing else. We do not permit it to be used to train their models, and we do not train models of our own on your content. Your chat history and generated cards are stored in your account so you can come back to them; delete them and they go.
We will tell you which company sits behind any of those roles if you ask — write to support@badnerd.app.
We may also disclose data where the law requires it, or to establish or defend a legal claim. If the project is ever transferred to another operator, your data moves with it under this policy, and you will be told before that happens.
The Chrome extension specifically
Everything above applies to the extension too. It reaches into pages you are reading, so it gets its own account of what that means: it does not track your browsing, and it has no continuously running content script reading pages in the background. It reads page data only at the moment you act.
- activeTab, scripting — read the text you selected, or the address and title of the page you chose to save, at the moment you invoke badNerd. Not before, not after.
- identity — sign you in with Google.
- storage — keep your session and preferences on your device.
- contextMenus, sidePanel — put badNerd in the right-click menu, and open the side panel next to the tab you are on.
- offscreen — keep study-session sounds and the timer chime playing while the side panel is closed.
badNerd's use and transfer of information received from Google APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.
Your rights
Wherever you live, you can ask us to give you a copy of your data, correct it, delete it, or export it. Under the GDPR you may also object to or restrict processing, withdraw consent, and lodge a complaint with your national data protection authority. Under California law you may request disclosure and deletion, and you will not be treated differently for asking.
Most of it needs no request: the app exports everything to Markdown, and deleting your account removes your content. For anything else, write to support@badnerd.app and we will answer within the period the applicable law allows.
How long we keep it
Your content stays while your account exists. Delete an item and it is removed; delete your account and your content is removed from our live systems and disappears from encrypted backups as those rotate out. Aggregated analytics that no longer identify you may be kept. Where the law requires us to retain something, we retain that and nothing more.
Where it is stored
Our providers operate in the European Union and the United States, so your data may be transferred outside your country. Where that involves the EEA or the UK, transfers rely on the European Commission's Standard Contractual Clauses or an adequacy decision.
Security
Data is encrypted in transit and at rest, access is restricted to what is needed to operate the service, and every request is authenticated against your account. No system is perfectly secure, and we will not claim otherwise.
Children
badNerd is not intended for anyone under 16. We do not knowingly collect data from children under 16; if we learn that we have, we delete it. If you believe a child has given us data, write to us.
Changes
When this policy changes we update the date at the top, and for material changes we notify you in the app or by email before they take effect.
Contact
support@badnerd.app — privacy requests, questions, or anything in this document that reads wrong.