Privacy

Last updated October 25, 2026

Short version: we collect as little as we can. The Cardsmith plugin sends no telemetry, this website has no analytics or cookies, and we never see your notes.

The Cardsmith plugin

Cardsmith makes network requests to only two places:

• The AI endpoint you choose (OpenAI, Anthropic, OpenRouter, any OpenAI-compatible endpoint, or Ollama on your own machine), and only when you ask it to generate cards. It sends the note or selection you picked plus instructions, directly from your device under your own account. That provider handles the text under its own terms and privacy policy. Mira Forge never receives your notes or your API key.
• The Cardsmith license service, run by Mira Forge, only if you enter a Pro license key, to activate and check it. It sends the license key, a random device ID created on your device (not derived from your hardware or account) and the product name. This happens once when you activate, then at most once a day, and when you remove the license. No note content, file names, vault names, names or email addresses are sent.

There is no analytics, telemetry, crash reporting, update checking or advertising in Cardsmith. Your API key is kept in Obsidian’s secret storage on your device, not in your vault files.

The license service

Mira Forge runs one small server for Cardsmith: the license service, hosted on Cloudflare Workers. It turns a purchase into a license key and answers the plugin’s license checks. For each subscription it stores only:

• a one-way hash of the license key (not the key itself),
• the Stripe subscription and customer IDs, the subscription status and its current end date,
• for each activated device, a one-way hash of its random device ID and when it was first and last seen,
• IDs of payment events already processed (deleted after 30 days).

It stores no names, email addresses, postal addresses, IP addresses or payment details. To limit abuse it counts requests per hashed IP address. For the plugin’s license checks, that count is kept in memory for a few minutes and never written to storage. For the key recovery page, the count is stored for up to 15 minutes under a keyed hash of your IP address (never the address itself) and then deleted. If you use the key recovery page, the email address and invoice number you type are checked against Stripe’s records for that one request and are not stored. Cloudflare may keep standard request logs under its own privacy policy.

Purchases

Cardsmith Pro is Sold through Link. Stripe, through its Link service, is the merchant of record: it collects the details needed to take payment and handle tax, such as your email address, billing address or country and card details, under the Link privacy policy and Stripe privacy policy, and sends your receipts. In our Stripe account we can see what we need to provide and support your subscription, such as your email address, billing country, what you bought and your subscription status. We never see your full card details. Your card statement shows LINK.COM* MIRAFORGE.

Purchases on itch.io are handled by itch.io and its payment processors under their own privacy policies.

This website

This website is a static site. It sets no cookies and uses no analytics, trackers, external fonts or third-party scripts. It is hosted on Cloudflare Pages; like most web hosts, Cloudflare may log visitors’ IP addresses for security and operations under its own privacy policy. We do not use those logs.

Email

If you email us, we keep the conversation so we can help you and follow up. We do not add you to any mailing list.

What we don’t do

• We don’t sell or rent personal data.
• We don’t use your notes, or anything else, to train AI models.
• We don’t send marketing email unless you ask for it.

Your choices

You can ask us what data we hold about you, or ask us to correct or delete it, by emailing heymira@mail.grokbot.com. For payment records held by Stripe and Link, we will help you reach them; some records must be kept for tax and legal reasons. If you ask Stripe or Link to delete your data, they also cancel your Cardsmith Pro subscription.

Changes

If this policy changes, we will update the date above. If a change affects how the plugin uses the network, it will also be listed in the plugin’s release notes.