What it talks to
- Cards sync only with the place you chose: Anchor Cloud, or the GitHub repository you named
- With GitHub, connecting also calls GitHub’s authorisation and account endpoints, and nothing else
- The demo reads a public repository unauthenticated
- Purchases talk to the App Store / Google Play and the billing provider, purely to process the purchase. Only purchase and entitlement information is sent; there is no behavioural tracking
- No analytics SDK and no crash reporter are included
What Anchor Cloud holds, and what it does not
Anchor Cloud is a storage server for your cards, run by the app’s maker (Zen Article) on Cloudflare.
| What it holds | Your cards’ Markdown, review log, weak-card snapshot and FSRS settings. Nothing else |
| What it never stores | Your name, email address, device ID or IP address. The server keeps no request logs either |
| Account | None. No sign-up, no email. A vault is identified only by a random ID and keys |
| Keys | The server keeps only a hash of each key |
| Use | Sync, and nothing else. Never used for ads, never sold, never used to train AI |
| Automatic deletion | A vault unused for 430 days is deleted automatically |
| Deleting it yourself | Delete vault in the app removes it completely, at any time. Every device and AI key stops working, and it cannot be undone |
| Removing one device | Disconnect this device removes only that device. The vault stays, and your other devices keep working |
What each key can do
| Cards | Review log (data/) | |
|---|---|---|
| The AI’s key | Can write | Cannot write |
| The app (device key) | Does not write (except to add new cards when you paste an AI reply) | Writes |
An AI agent cannot rewrite your study history. And because the app does not write cards, an ordinary sync cannot damage them.
Where the GitHub token lives
- GitHub tokens are stored in the keychain only. They never leave the device and are never synced to iCloud keychain
- Settings shows a masked string. Nothing is written to logs
- Device settings hold only the repository name, branch, new-cards-per-day, and — for display — your account name and the token’s expiry (neither of which is secret)
How the GitHub permission is bounded
With GitHub, Anchor installs as a GitHub App. You choose which repositories it can see at install time, and repositories you did not pick are invisible to the app.
That is why the “read and write every repository you own” style of access was not used.
Your data stays yours
- Your cards live outside the app, in Anchor Cloud or your repository. They stay there if you delete the app
- The review log lives in the same place, readable as plain JSON Lines
- The app writes three files under
data/and does not touch your cards (the one exception is adding new cards when you paste an AI reply into Anchor Cloud) - Everything on the device can be erased from settings (nothing changes in Anchor Cloud or on GitHub)
- To remove the Anchor Cloud vault itself, use Delete vault