Privacy Policy

Quiet Cards is operated by TOT Solutions, LLC, a Tennessee limited liability company (“Quiet Cards,” “we,” “us,” or “our”).

Quiet Cards is designed to help caregivers create communication cards for people they care for. Because users may choose to provide personal, health-related, and other sensitive information about themselves or a loved one, we take the privacy and security of that information seriously.

This Privacy Policy explains what information Quiet Cards collects, how we use it, when information may be processed by service providers, and the choices available to you.

Account Information

When you create a Quiet Cards account, we may collect or process:

•your name or display name;

•email address;

•account and authentication information;

•account identifiers;

•confirmation that you are at least 18 years old; and

•records of your acceptance of our Terms of Service and acknowledgment of our Privacy Policy, including the date and applicable document versions.

Quiet Cards uses Supabase Auth for account authentication. If you use Google sign-in, authentication is facilitated through Lovable's OAuth service. Quiet Cards does not store your password in its application database.

Loved One Information

You may create profiles for people you care for.

Depending on what you choose to provide, a Loved One profile may contain:

•name or preferred name;

•photograph;

•relationship to you;

•condition or diagnosis;

•structured cognitive or dementia stage;

•communication preferences;

•behaviors or tendencies;

•sensitivities;

•Card Creation Notes;

•medications;

•allergies;

•other medical conditions;

•mobility or medical equipment information;

•physician information; and

•other information you choose to provide.

Some of this information may be sensitive or health-related.

You choose what information to provide in a Loved One profile.

Card Information

When you create and save Quiet Cards, we may collect or process information including:

•the situation or custom situation description;

•the Loved One associated with the card;

•how the card should refer to that person;

•selected communication points;

•condition information;

•notes or instructions you enter;

•AI-generated card text;

•card titles;

•card design and appearance selections; and

•card and stack organization information.

Basic Pack and Marketing Information

If you request the Quiet Cards Basic Pack, we collect the name and email address you provide in connection with that request.

Consent to receive ongoing marketing communications is separate from requesting the Basic Pack. If you choose to receive occasional Quiet Cards tips, updates, or offers, we record your marketing preference and the date of that consent.

You may unsubscribe from marketing communications or request removal of your Basic Pack lead information through the provided unsubscribe/removal process.

We use information to:

•create and maintain Quiet Cards accounts;

•authenticate users;

•provide and operate Quiet Cards;

•create, save, organize, and display Loved One profiles, cards, and stacks;

•personalize card creation;

•generate card wording using information relevant to the requested card;

•maintain account and service security;

•provide materials you request;

•send marketing communications when you have separately opted in;

•respond to support, privacy, or account requests;

•troubleshoot and maintain the service;

•prevent misuse or abuse; and

•comply with applicable legal obligations.

We do not use Loved One information for targeted advertising.

Quiet Cards uses artificial intelligence to help draft communication cards.

Card-generation requests are routed through the Lovable AI Gateway and processed using Google Gemini.

When you use guided card creation, information relevant to writing the card may be sent for AI processing.

This may include:

•the situation or custom situation description;

•the wording selected to refer to the person;

•the Loved One's name and relationship;

•short condition or diagnosis information;

•structured stage information;

•saved behaviors and communication tendencies;

•Card Creation Notes;

•communication points you select for the current card; and

•free-text information you intentionally enter for the current card.

Quiet Cards is designed to avoid automatically sending medical-reference information that is not needed to generate card wording.

The following information stored in a Loved One profile is not automatically included in AI card-generation requests:

•medications;

•allergies;

•other medical conditions;

•mobility aids or medical equipment;

•physician information;

•free-text stage notes;

•photographs;

•your account email address; and

•your account identifiers.

If you intentionally enter sensitive or medical information into a card-creation field for a particular card, that information may be included in the AI request because you have provided it for that generation.

Loved One photographs are not sent to the AI for card generation.

AI-generated content can contain mistakes, omissions, or inappropriate wording. You are responsible for reviewing generated content before using, displaying, printing, or sharing a card.

Quiet Cards relies on service providers to operate the application.

Current providers include:

Supabase

Provides database services, account authentication, and private file storage. Supabase stores account information, Loved One profiles, cards, stacks, photographs, and other application data necessary to provide Quiet Cards.

Cloudflare Workers through Lovable

Provides hosting, server-side functions, and request processing. Information may pass through this infrastructure as necessary to operate the application.

Lovable AI Gateway

Routes AI card-generation requests to the AI model provider.

Google Gemini

Processes card-generation requests and produces generated card wording.

These providers may process information as necessary to provide their respective services.

Provider systems may independently maintain technical, security, authentication, or request logs according to their own practices.

We do not sell Loved One health-related information.

We do not share Loved One health-related information with third-party advertising platforms for targeted advertising.

Quiet Cards uses Google Gemini through the Lovable AI Gateway rather than through a direct Gemini account controlled through the Quiet Cards application.

Third-party AI providers may process or temporarily retain information according to the terms and configuration applicable to the services used by Quiet Cards.

We do not represent that AI requests have zero retention unless and until that can be verified for the service configuration being used.

We do not authorize the use of Loved One information for advertising.

We will update this Privacy Policy if our AI provider, routing arrangement, or material data-processing practices change.

Quiet Cards allows you to save certain medical-reference information in a Loved One profile, including medications, allergies, other medical conditions, mobility or medical equipment information, and physician information.

This information is saved to the Loved One's profile for your reference and is not automatically sent to the AI when creating cards.

Quiet Cards is not a healthcare provider, electronic medical record system, medical alert service, or emergency service.

Information stored in Quiet Cards should not be relied upon as a substitute for professional medical records, medical identification, emergency information, diagnosis, treatment, or advice from a qualified healthcare professional.

Quiet Cards allows users to enter information about another person.

By providing personal information, photographs, health-related information, or other information about another individual, you represent that you have the right or appropriate authority to provide and use that information through Quiet Cards.

You are responsible for the information you choose to provide about another person.

We encourage users to provide only information reasonably necessary for their use of Quiet Cards.

Loved One photographs are stored using private Supabase Storage.

The storage bucket is not public. Quiet Cards accesses photographs using temporary signed URLs as necessary to display them within the application. The current implementation uses signed URLs that expire after approximately one hour.

Loved One photographs are not sent to the AI for card generation.

When you delete a Loved One profile, Quiet Cards removes the associated profile photograph from active storage.

When you delete your Quiet Cards account, Quiet Cards removes photographs stored in your account's photo-storage folder from active storage as part of the deletion process.

Quiet Cards does not currently store IP addresses or device information in its application database.

IP addresses may be used temporarily in server memory to rate-limit public Basic Pack-related endpoints and help prevent abuse. Those IP addresses are not written to the Quiet Cards database as part of that process.

Hosting, authentication, database, and infrastructure providers may independently process IP addresses, device information, request metadata, authentication records, or security logs as part of operating and protecting their services.

Quiet Cards has configured its AI integration so that AI provider response bodies are not written to its application error logs. Status codes may be logged for troubleshooting.

Provider-controlled log retention periods may vary and are not controlled by Quiet Cards.

Quiet Cards keeps limited account-linked records of AI card-generation activity for service security, abuse prevention, and usage management. These records contain the time of the request, whether it was an initial generation or regeneration, and whether the request succeeded, failed, or was blocked by a usage safeguard. These usage records do not contain prompts, generated card text, Loved One profile information, Card Creation Notes, medical information, or AI responses.

Quiet Cards does not currently use:

•Google Analytics;

•Meta Pixel;

•third-party advertising pixels;

•behavioral advertising;

•session replay;

•third-party behavioral analytics; or

•advertising SDKs.

Quiet Cards currently self-hosts its application fonts rather than loading them from Google Fonts.

If we introduce analytics, advertising technologies, or materially different tracking practices in the future, we will update this Privacy Policy and provide any notice or choices required by applicable law.

Quiet Cards may store limited information locally in your browser or device as necessary for functions such as authentication, application preferences, and recently used cards.

Authentication/session tokens issued by Supabase may be stored locally in the browser to maintain your authenticated session.

When you sign out, Quiet Cards clears its locally stored recently-used-card list.

Your browser, device, or operating system may independently retain cached information according to its own settings.

We retain information as necessary to provide Quiet Cards and for legitimate operational, security, and legal purposes.

You may delete individual cards and Loved One profiles through available application controls.

When deleting a Loved One profile, you may choose to delete that person's associated cards or retain those cards without the Loved One association. The associated Loved One photograph is removed from active storage.

Account Deletion

You may permanently delete your Quiet Cards account through Settings.

Account deletion removes the account's information from the active Quiet Cards application, including:

•stored photographs;

•account profile;

•Loved One profiles;

•cards;

•stacks;

•stack memberships; and

•AI card-generation usage records.

Quiet Cards also clears its local application cache and recently-used-card history and ends the authenticated session.

Account deletion is intended to be immediate and cannot be undone.

Deleted information may remain temporarily in provider-controlled backups, recovery systems, security logs, or other systems where immediate deletion is not technically feasible. The current application configuration does not establish the retention periods for those provider-controlled systems.

Information that you have printed, photographed, screenshot, downloaded, exported, or otherwise shared outside Quiet Cards cannot be deleted by us.

Basic Pack Lead Information

Basic Pack lead records are maintained separately from registered Quiet Cards accounts.

Deleting your Quiet Cards account does not automatically delete a Basic Pack lead record associated with the same email address.

You may separately request removal of your Basic Pack lead information through the unsubscribe/removal process.

Requesting the Basic Pack does not require you to agree to ongoing marketing.

If you separately opt in to marketing communications, you may withdraw that consent using the unsubscribe mechanism provided.

Unsubscribing from marketing does not prevent Quiet Cards from sending communications necessary to provide a service you requested, administer your account, address security issues, or respond to you.

We use administrative, technical, and organizational safeguards designed to protect information processed through Quiet Cards.

Current measures include authenticated access controls, private photo storage, server-side account deletion, reduced AI data transmission, and limiting unnecessary third-party requests.

However, no electronic transmission or storage system can be guaranteed to be completely secure.

You are responsible for maintaining the confidentiality of your login credentials and securing the devices through which you access Quiet Cards.

If we become aware of a security incident involving personal or health-related information, we will investigate the incident and provide notifications when required by applicable law.

The legal requirements applicable to consumer health information can depend on the nature of the service, information, and incident.

Quiet Cards accounts are available only to individuals 18 years of age or older.

You may not create an account if you are under 18.

Quiet Cards is not directed to children and does not knowingly permit individuals under 18 to create accounts.

Depending on the feature involved, you may:

•review and update Loved One information;

•remove information from Loved One profiles;

•delete cards;

•delete Loved One profiles;

•choose whether to retain associated cards when deleting a Loved One;

•unsubscribe from marketing communications;

•request removal of Basic Pack lead information; and

•permanently delete your Quiet Cards account through Settings.

You may also contact us regarding privacy questions or requests.

We may update this Privacy Policy from time to time as Quiet Cards, our service providers, or applicable requirements change.

When we update the Policy, we will revise the “Last Updated” date above.

If we make material changes to how sensitive information is collected, used, or disclosed, we will provide additional notice or obtain consent when required by applicable law.

Quiet Cards is operated by:

TOT Solutions, LLC

A Tennessee limited liability company

Email: tiffani@totsolutions.org

Mailing Address: [BUSINESS MAILING ADDRESS]

For privacy questions, account requests, or questions about this Privacy Policy, please contact us using the information above.