Privacy

Last updated October 31, 2026

Short version: we collect as little as we can. The Cardsmith and Splitsmith plugins send no telemetry, this website sets no cookies, and we never see your notes unless you turn on Cardsmith Pro’s optional hosted generation (see below). We use Cloudflare Web Analytics, which is cookieless and doesn’t track you across sites.

The Cardsmith plugin

Cardsmith makes network requests to only two places, plus a third if you turn on hosted generation:

• The AI endpoint you choose (OpenAI, Anthropic, OpenRouter, any OpenAI-compatible endpoint, or Ollama on your own machine), and only when you ask it to generate cards. It sends the note or selection you picked plus instructions, directly from your device under your own account. That provider handles the text under its own terms and privacy policy. Mira Forge never receives your notes or your API key.
• The Cardsmith license service, run by Mira Forge, only if you enter a Pro license key, to activate and check it. It sends the license key, a random device ID created on your device (not derived from your hardware or account) and the product name. This happens once when you activate, then at most once a day, and when you remove the license. No note content, file names, vault names, names or email addresses are sent.
• Hosted generation (Pro, optional), only if you pick “Hosted (Pro, no key needed)” as the model provider and accept the consent screen Cardsmith shows before the first hosted request. Each time you ask for cards it sends the license service your license key, the device ID, the note’s title (up to 300 characters), the note or selection text (up to the first 24,000 characters), the number of cards and the card types. Custom instructions and the card language setting are not sent. The service sends the title and text to Google’s Gemini model and returns the cards. Requests go through OpenRouter with no training, only to Google Vertex, with no fallback. Google may keep them briefly for abuse monitoring. The Cardsmith service doesn’t store or log your note, its title or the cards. It keeps only usage counters. Limits: 300 generations a month, 30 an hour per license, plus a monthly AI-cost limit per license. Hosted generation isn’t included during a free trial. Switch back to your own key or Ollama any time in Settings → Cardsmith → Model provider.

There is no analytics, telemetry, crash reporting, update checking or advertising in Cardsmith. Your API key is kept in Obsidian’s secret storage on your device, not in your vault files.

The Splitsmith plugin

Splitsmith talks to no Mira Forge server and has no license check. It makes network requests to only one place: the AI endpoint you choose (Ollama on your own machine, OpenAI, Anthropic, OpenRouter or any OpenAI-compatible endpoint), and only when you run an AI split. It sends the note you picked (long notes in sections) plus instructions, directly from your device under your own account, so the model can suggest where to cut and what to call each part. That provider handles the text under its own terms and privacy policy. Splits by heading, delimiter, cursor or selection, the preview, undo and link repair work entirely on your device and make no network requests.

There is no analytics, telemetry, crash reporting, update checking or advertising in Splitsmith. Your API key is kept in Obsidian’s secret storage on your device, not in your vault files. To make undo and Inbox mode work, Splitsmith keeps the text of your last split (or last inbox batch) and a short fingerprint of each processed inbox note in its own settings file inside your vault. None of it leaves your device.

The license service

Mira Forge runs one small server for Cardsmith: the license service, hosted on Cloudflare Workers. It turns a purchase into a license key and answers the plugin’s license checks. For each subscription it stores only:

• a one-way hash of the license key (not the key itself),
• the Stripe subscription and customer IDs, the subscription status and its current end date,
• for each activated device, a one-way hash of its random device ID and when it was first and last seen,
• IDs of payment events already processed (deleted after 30 days),
• if you use hosted generation: per license, under the key’s hash, how many hosted generations were made and their AI cost this month, plus an hourly count per network under a keyed hash of the IP address (never the address itself).

It stores no names, email addresses, postal addresses, IP addresses or payment details. To limit abuse it counts requests per hashed IP address. For the plugin’s license checks, that count is kept in memory for a few minutes and never written to storage. For the key recovery page, the count is stored for up to 15 minutes under a keyed hash of your IP address (never the address itself) and then deleted. If you use the key recovery page, the email address and invoice number you type are checked against Stripe’s records for that one request and are not stored. Cloudflare may keep standard request logs under its own privacy policy.

Hosted generation (Cardsmith Pro, optional)

If you use it, the note title and text you send are processed by the license service only to build the request, then by OpenRouter and Google (Gemini on Google Vertex) to write the cards. Requests go through OpenRouter with no training, only to Google Vertex, with no fallback. Google may keep them briefly for abuse monitoring. The Cardsmith service doesn’t store or log your note, its title or the cards. Mira Forge doesn’t use them to train AI models. Nothing is sent until you accept the consent screen in the plugin, and your own key or Ollama remain available at any time.

Purchases

Cardsmith Pro ($3/month, tax included) is Sold through Link. Stripe, through its Link service, is the merchant of record: it collects the details needed to take payment and handle tax, such as your email address, billing address or country and card details, under the Link privacy policy and Stripe privacy policy, and sends your receipts. In our Stripe account we can see what we need to provide and support your subscription, such as your email address, billing country, what you bought and your subscription status. We never see your full card details. Your card statement shows LINK.COM* MIRAFORGE.

Purchases on itch.io are handled by itch.io and its payment processors under their own privacy policies.

This website

This website is a static site. It sets no cookies and loads no external fonts or third-party scripts except Cloudflare’s Web Analytics script, which counts page views (page, referrer, browser and country) without cookies and doesn’t track you across sites. It is hosted on Cloudflare Pages; like most web hosts, Cloudflare may log visitors’ IP addresses for security and operations under its own privacy policy. We do not use those logs.

Email

If you email us, we keep the conversation so we can help you and follow up. We do not add you to any mailing list.

What we don’t do

• We don’t sell or rent personal data.
• We don’t use your notes, or anything else, to train AI models.
• We don’t send marketing email unless you ask for it.

Your choices

You can ask us what data we hold about you, or ask us to correct or delete it, by emailing heymira@mail.grokbot.com. For payment records held by Stripe and Link, we will help you reach them; some records must be kept for tax and legal reasons. If you ask Stripe or Link to delete your data, they also cancel your Cardsmith Pro subscription.

Changes

If this policy changes, we will update the date above. If a change affects how the plugin uses the network, it will also be listed in the plugin’s release notes.