What the connection does
With your permission, Reworded reads your private Reworded library in Apple CloudKit and returns requested information to your connected AI client. Additional permissions let it create decks and cards or save review results and update review schedules. The permission screen identifies what you are authorizing; an existing read-only grant does not automatically gain write access.
Your Apple sign-in takes place on Apple’s website. We do not receive your Apple password. Connecting Reworded does not give us access to unrelated iCloud files, photos, or other apps’ data.
Information we process
- Library information: deck names and identifiers; card text, languages and identifiers; and saved due dates, review state, and scheduling information. The server processes these to answer requests. It may fetch additional cards from the selected deck to filter or limit the result.
- Write requests: deck names, card text, and language information that your client asks us to create, plus review ratings and the card identifiers needed to save study results. Successful writes are stored in your Reworded iCloud library.
- Operation records: information needed to recognize repeated write requests, avoid creating duplicates or recording a review twice, and report their results.
- Connection information: a pseudonymous CloudKit user record identifier, the permissions you approved, sign-in state, and expiration and revocation information.
- Credentials: an encrypted Apple CloudKit web session token, plus hashes of the OAuth credentials issued to your AI client. These allow the connection to work without asking you to sign in for every request.
- Operational information: network requests necessarily include information such as an IP address and client headers. The service uses request information for security and rate limits and records limited diagnostic events, such as error categories.
- Support messages: if you email us, we receive your address and the information you choose to include.
We do not maintain a full mirror of your card library in the connection’s application database. The server processes library content to fulfill requests and retains operation records needed to handle writes safely. Our application diagnostics are designed to exclude card text and authentication secrets.
Which services receive information
- Apple hosts your iCloud library and handles Apple account authentication. Its processing is covered by Apple’s privacy policy.
- OpenAI receives the tool results returned to ChatGPT. Those results can become part of your conversation and are handled under your ChatGPT account settings and OpenAI’s privacy policy.
- Anthropic receives the tool results returned to Claude. Those results can become part of your conversation and are handled under your Claude account settings and Anthropic’s privacy policy. If you use another AI client, its provider receives the results instead.
- DigitalOcean provides the server infrastructure used to run this connection, including its credential database and temporary request processing. See DigitalOcean’s privacy policy.
Reworded uses the information to operate the connection, protect access, diagnose failures, and respond to support requests. These pages do not use advertising or analytics trackers.
Storage and retention
CloudKit web session tokens are encrypted at rest. The pseudonymous account identifier and grant metadata are stored in the connection database; they are not the same as your Apple password or email address. OAuth access and refresh credentials are stored as hashes, not as their original bearer-token values.
Access tokens issued by this service last one hour. Refresh tokens last 30 days; using one rotates it and issues a new refresh token, so an active connection can remain authorized longer than 30 days. Apple’s own session can expire separately and require another sign-in.
Temporary sign-in flows expire after 10 minutes and authorization codes after two minutes. Used refresh-token hashes are retained while their grant remains active to detect replay. Once all grants for an account are revoked or expire, the service removes its stored CloudKit token and inactive grant records during cleanup. Cleanup runs on revocation and normally once a minute.
Write-operation records are kept for 30 days. They contain an account and operation identifier, a request hash, a status, and a minimal result such as record identifiers and dates; they do not store card text. These records let the service recognize repeated requests and avoid blindly repeating a write whose outcome could not be confirmed.
These timings describe the running application database. They do not promise erasure of information already received by Apple, an AI client, or support email systems. We do not state a separate backup-deletion timetable here.
Cookies and website resources
The sign-in flow uses an essential, short-lived cookie to keep your authorization request together and protect it against forgery. It expires after 10 minutes. The public pages do not set analytics or advertising cookies, and their images, styles, and fonts do not load from external providers.
Disconnecting and requesting removal
Disconnect Reworded in your AI client’s connection settings. When the client sends a revocation request to this service, that grant is disabled. The stored Apple token is removed when no active grants remain. A client that only removes its local connection may not notify our server; contact us if you want us to verify removal.
Disconnecting does not undo completed writes, delete your cards from iCloud, or erase results already included in a ChatGPT, Claude, or other AI client conversation. Manage cards in Reworded and conversations through the relevant AI client.
For access, correction, removal of operation records, or other privacy requests, email hey@reworded.cards. We may need to verify which connection belongs to you. Do not email passwords, sign-in codes, or session tokens.
Changes and contact
Reworded is operated by Aleksandr Ilichev.
We will update this notice if the connection’s data handling changes. The version date above identifies the current text. Questions about this website or connection can be sent to Reworded at hey@reworded.cards.