ComCards privacy policy
ComCards is a local-first communication-card board. Your boards, pictures and recordings stay on the device you use.
Last updated: 5 October 2026
What stays on your device
ComCards stores the following locally, using your browser's storage. None of it is uploaded to us, and we cannot see it:
- your boards, cards, card sets and their layout;
- personal photographs and pictures you place on cards;
- voice recordings you make, including recordings saved from Google voice generation;
- your editor PIN and your scan-mode settings;
- the email address you enter in the account dialog, and a SHA-256 hash of your password. The password itself is never stored;
- the history of words you have added.
What leaves your device, and only when you ask
The optional Google features work by sending a request to a server, which then contacts Google. Nothing is sent automatically. Each of these happens only when a person deliberately chooses that button in the editor:
| Feature | What is sent | To whom |
|---|---|---|
| Translate | The text on the cards you are translating | Google Cloud Translation |
| Generate and save Google voice | The words to be spoken | Google Cloud Text-to-Speech |
| Dictate | The short audio recording you made | Google Cloud Speech-to-Text |
| Scan board | The photograph of the board you chose to scan | Google Cloud Vision |
The Google API credentials are held on the server and are never included in the app. Text, audio and images are sent only for the single request you trigger. Google's own handling of that data is governed by the Google Cloud terms you accepted when creating the project.
Symbol libraries
When a person searches for a symbol, ComCards may contact ARASAAC and OpenMoji to retrieve symbol images and to search their symbol catalogues. Those requests are made directly to arasaac.org and openmoji.org, which will see the search term and the usual technical details of the request, such as your device's IP address. ComCards bundles its Mulberry symbols locally and does not contact a third party for those.
What we do not do
- No advertising, and no advertising identifiers.
- No analytics, tracking or crash-reporting software.
- No cookies.
- No account server. In this release the account dialog is a local convenience only; nothing is synced to a server, and we cannot reset or recover an account.
Children
ComCards is designed to be used by children, including children who rely on it to communicate. We do not knowingly collect personal information from children, because we do not collect any personal information at all. If a child uses Google dictation, translation or board scanning, the relevant text, audio or image is sent to Google at that moment, as described above, and is handled under Google's terms. Parents and carers should supervise these optional features.
Deleting your data
To remove everything ComCards has stored, delete the site's data in your browser settings, or use the app's own reset and delete controls, then delete any backup file you exported. Because this data never leaves the device, there is nothing for us to delete on a server.
Security
Data is transferred over HTTPS. The development server binds to the local machine only, so boards are not exposed on your home network. Exported backups are ordinary files: store them somewhere protected and treat them as sensitive.
Changes and contact
If this policy changes, the updated date at the top of this page will change too. For questions about privacy, contact the developer at eliasripley@gmail.com.