The 528 Deck Privacy Policy
Version 2026.11.0, November 6, 2026. This version is kept word for word at /privacy/2026.11.0/.
The 528 Deck is a flashcard app for medical school entrance exam preparation on Android. It is made and sold by Conner Strategic Systems LLC ("we", "us"). The app's package name on Google Play is com.the528deck.app. This policy explains what the app and the528deck.com collect, why, who receives it, how long we keep it and how you can delete it. If you have a question, write to support@the528deck.com.
What we collect and why
| What | Why | How long |
|---|---|---|
| Your account: a user ID, your email address and how you sign in (Google, Facebook, email and password, or an emailed sign-in link). With Google or Facebook sign-in, Firebase Authentication also keeps the name, user ID and photo address that service sends; from Facebook we use only your email. | To create your account, sign you in, keep your study data with your account, and send the notices described under Purchases | For the life of your account (see Deleting your account) |
| Your profile: your exam date, target medical schools, your history of these, and your design choice | To show your own progress and, only if you join peer comparison, to place you in student groups | For the life of your account |
| School names you type when a school is not in our list | So we can add the school to the list | 180 days |
| Your self-checks ("I had it" or "I missed it"), favorites, study groups and scores | To show your progress and choose which flashcards to show you next | For the life of your account; the batches of self-checks the app uploads are removed after 100 days |
| Which category packs you downloaded, when, and a random ID for this installation | To apply the download limit and to let an interrupted download resume | Each download for 30 days; removed with your account |
| A record for this installation of the app: the platform, app version and build, and your phone's time zone With it: the Firebase installation ID, the notification token, and a one-way hash of the device's Android ID. | To keep the app working on this phone | 180 days after it was last updated |
| A record that this phone has used its first 24 hours | So the first-24-hours period applies once per phone | 24 months |
| Peer comparison figures, only if you turn peer comparison on: your own figures, and the group counts and averages they feed (see Peer comparison) | To show how your self-checks compare with student groups | Your own figures are rebuilt each night and deleted when you leave peer comparison or delete your account; group figures hold only counts and averages, never names |
| Your purchases: your plan, the store's order ID, purchase dates and the price you were shown | To give you the access you paid for and to send the purchase notice and renewal reminders | Purchase records 7 years; purchase event records 90 days |
| Your agreements: which version of the Terms, this policy and the other texts you accepted, and when | To keep a record of what you agreed to | 3 years, or 1 year after a plan ends if that is later |
| Your reminder hour, if you turn on study reminders | To schedule one reminder a day on your phone | For the life of your account; you can turn reminders off any time in You |
| What you write to support@the528deck.com, and copies of the notices we email you | To answer you, and to keep proof that the notices were sent | 3 years |
| Usage events, crash reports and performance data, through Google Analytics for Firebase, Firebase Crashlytics and Firebase Performance Monitoring | To find and fix problems and improve the app | See Deleting your account |
| Ad requests on the free flashcards after your first 24 hours: your IP address, ad interactions (app launch, taps, video views), diagnostics and other app performance data, the app set ID, and your ad consent choice | Collected by Google's ads software (the Google Mobile Ads SDK) to show and measure ads and to prevent fraud (see Ads below); never sent to our servers | Under Google's own retention |
| On your phone only: the app's database, category downloads, their keys, and a marker for a purchase in progress | To let you study offline | Until you sign out, when the app wipes them |
| On your phone only: self-checks not yet uploaded when you sign out, kept in a private file of the app | So that self-checks made offline are not lost | Until the same account signs in again and they are sent, or until you delete your account |
Any score estimate is worked out on your phone from your self-checks. The estimate itself is not stored or sent.
The app has no AI tutor in this version, so no question you write is sent to an AI service.
The data types as Google Play names them
Name; Email address; User IDs; Purchase history; Approximate location; App interactions; Other actions; Other user-generated content; Other info; Crash logs; Diagnostics; Other app performance data; Device or other IDs. The app does not collect your precise location, contacts, photos or other files, health data, messages, calendar, web history or advertising ID.
Peer comparison
Peer comparison comes with a paid plan and is off until you turn it on. When it is on, your self-check results and your target medical schools (with their MD or DO type) are combined each night with other students' into group statistics. No one sees your name, email, schools or answers: only figures for groups of at least 20 students, with group sizes rounded down to the nearest 10. Until a group has 20 students, you see no figures for it. You can turn it off at any time in the app's settings, and your results leave the figures at the next nightly update. If your plan ends and the switch stays on, your results keep counting until you turn it off. Students aged 13 to 17 use this feature on the same terms.
Signing in
You can sign in with Google, with Facebook, with an email and password, or with a sign-in link sent to your email.
If you sign in with Google, Google confirms who you are and sends us your email address, name, Google user ID and photo address. The app does not use the photo address.
If you sign in with Facebook, Meta confirms who you are and sends us your email address, name, Facebook user ID and photo address. We use only your email address. The app never stores a Facebook token.
When the app starts it may contact Meta.
If you choose Sign in with Google or Facebook Login, that company confirms who you are and Firebase Authentication keeps your account's user ID there, your name, email address and profile photo address. We use only the email address. Meta's Facebook SDK is part of the app: when the app starts it may contact Meta with technical data (the app's ID, your device model, system version and language, your IP address and an installation ID of Meta's software). We have turned off Meta's app-event logging and its collection of the advertising ID, and the sign-in token Meta returns is exchanged on your phone and not stored.
If you ask for a sign-in link, Firebase Authentication emails a one-time link to your address. Firebase also sends the email verification and password reset messages, from noreply@the528deck.firebaseapp.com.
If you signed in with Facebook, our data-deletion page at /data-deletion/ tells you how to delete your data.
Purchases
Plans are sold and billed by Google Play. Google Play handles your payment, and we never see your card details. RevenueCat, our purchase service, receives your purchase records from Google Play. We also send RevenueCat the email address and, if your account has one, the name from your account.
Google Play sends your receipt. We also email a short purchase notice and renewal reminders from support@the528deck.com: an Annual plan gets a notice 30 days before each renewal, and a monthly plan gets a reminder once a year. A Lifetime plan does not renew and gets no reminder.
If we open purchases on our website, RevenueCat Billing and Stripe will handle them.
Who receives your data
- Google (Firebase and Google Cloud), which runs our database, sign-in, files, functions, analytics, crash reports and notifications for us.
- Google Workspace (Google LLC), our email service. We send purchase notices and renewal reminders from support@the528deck.com through Gmail, and copies stay in that mailbox along with your emails to us.
- Google Play, which sells and bills the plans and sends your receipt.
- RevenueCat, which receives your purchase records, email address and name, as described under Purchases.
- Google AdMob, which shows the ads described under Ads.
- Meta, as described under Signing in.
- Cloudflare, for the web addresses of this site (the528deck.com).
Where your data is stored
Your account and study data are kept in Google's Firestore database and processed by our Cloud Functions.
Category downloads on your phone are encrypted.
The app's own database, files and functions sit in one region in the United States. The companies named in this policy work from their own locations.
Emails between you and our support address, and the notices we send you, are held by Google Workspace.
Ads
Without a plan, after your first 24 hours, the free flashcards show ads from Google AdMob. The ads are not personalized and are limited to content suitable for teens. The app does not use your phone's advertising ID. Where ads sit is set out in section 4 of our Terms of Use. If the rules where you live call for a choice about ads, the You tab shows "Ad privacy choices".
Deleting your account
You can delete your account in the app (You, then Delete account), on the web at the528deck.com/delete-account/, or by writing to support@the528deck.com from your account's email address. We confirm the request comes from you and delete the account within 30 days.
Deleting your account removes your profile, scores, favorites, typed school names, download counts and sign-in. Study data and downloads are wiped from this phone, and your results leave the group statistics at the next nightly update.
Some records stay for a set time after you delete your account: purchase records for 7 years; records of what you agreed to for 3 years, or 1 year after a plan ends if that is later; the record that a phone has used its first 24 hours for 24 months; the record that your account was deleted for 42 days; Google's sign-in record is removed within 180 days; and backups, logs, crash reports, analytics and payment event records are removed within 90 days. Emails between you and our support address, and copies of the notices we send you, stay in that mailbox for 3 years.
Deleting your account turns off renewal of your Google Play subscription. There is no refund for the current period. Deleting your account ends your Lifetime plan and it cannot be restored. Write to support before deleting if you want to ask about it.
Age
The 528 Deck is for people 13 and older. The app does not ask your age: you confirm you are 13 or older when you accept the Terms. It is not directed to children. If we learn that an account belongs to someone under 13, we delete it.
Changes to this policy
If we change this policy, the version and date at the top change. If a change needs your agreement, the app asks you again, and the earlier version stays readable at the528deck.com/privacy/ followed by its version number.
Contact
Conner Strategic Systems LLC, support@the528deck.com.