Privacy Policy

The short version

• Your files, cards and study history are yours. We use them to run FlashCardz for you, and for nothing else.
• To write cards, the text and images of your files are sent to two AI providers, Anthropic and Mistral AI; section 4 says what they may do with them.
• We don't sell your data, and there are no ads inside FlashCardz. We do advertise FlashCardz, for example on Facebook and Instagram: only if you say yes in the cookie banner does Meta learn that you came from one of our ads and signed up or subscribed (section 5).
• Cookies FlashCardz doesn't need in order to work stay off until you agree, and “Reject all” is as easy as “Accept all”. “Cookie settings”, at the foot of every page of our website and in Settings, changes your answer at any time.
• Your data is stored in the European Union (Frankfurt, Germany).
• You can export your cards with their progress, or delete your account and everything in it, at any time from Settings.

1. Who is responsible for your data

The controller of your personal data is Stefan-Sebastian Irinciuc, Radauti, Suceava, Romania, who operates FlashCardz (“FlashCardz”, “we”, “us”). For anything about your data or this policy, write to support.flashcardz@gmail.com. We answer every request, and within one month at the latest.

We have not appointed a data protection officer, because the law doesn't require one for a service of our size and kind. The contact above reaches the person responsible.

2. What we collect

We collect only what we need for the purposes in section 3:

You need an email address to have an account. Without it we can't provide FlashCardz. Everything else is your choice, though a feature may not work without the data it needs: no notifications without a device token, for example.

We never ask for special categories of data (such as health, religion or political views). Please don't upload material containing other people's sensitive data, such as patient records: see section 9.

3. Why we use it, and on what legal basis

The GDPR allows us to use personal data only with a legal basis. These are ours, purpose by purpose:

Where we rely on legitimate interest, you can object at any time (section 8). Where we rely on consent, withdrawing it doesn't affect what we did before.

There are no ads inside FlashCardz, and we don't sell your data or share it for anyone else's marketing. The one exception is yours to decide: with your consent to ad measurement, Meta receives the events described in section 5, and may also use them under its own privacy policy to improve how it delivers ads, ours included. We don't make decisions about you that have legal or similarly significant effects by automated means alone (Art. 22 GDPR). FlashCardz chooses which cards to show you automatically, but that is the study service you asked for.

4. How AI is used on your material

To turn your files into cards, the text and images of your pages are sent to AI models run by two companies: Anthropic (Claude), which reads pages and writes and checks cards, and Mistral AI, which recognises text in scans and handwriting and builds search indexes. On paid plans, the overnight run also reads the cards you made or imported, so that it can write new ones on what you're finding hard. No other AI provider receives your material. If that ever changes, we'll update this policy and tell you first.

On the web, a line beside the button says so, and adding a file, or starting a paid plan with its overnight run, is your go-ahead. On iPhone and iPad, the app asks for your permission first. You can turn this off at any time in Settings: from then on, nothing new is sent, no new cards are written overnight, and you can still make, import and study cards by hand.

Both process your material on our behalf and return the results to us. Anthropic's terms for its API don't allow it to train its models on your material. Mistral AI's terms let it use API requests to improve its models unless the customer opts out; we're opting out before FlashCardz opens to the public. Our requests carry internal identifiers only, never your name or email address, but course material can itself contain personal data, which is why section 9 matters.

Instructions hidden inside a file are treated as data, not followed. Answers the AI returns are kept as part of your account; a short-lived copy (at most 90 days) is kept to avoid processing the same page twice.

When two students upload the same file, page, passage or figure, the result of reading it may be reused for both, to save time and cost. Only content that is identical down to every character and image is reused, so nothing from your account, and nothing that isn't in the other student's own copy, ever reaches them. A shared result is deleted once no student has that content, and a page you were asked to confirm is never shared.

AI can make mistakes. That's why every AI card shows where it came from. See the Terms of Use.

5. Who else sees your data

We use carefully chosen service providers (“processors”) who handle data only on our instructions. Art. 28 GDPR requires a data processing agreement with each: most include one in their standard terms, and we're signing the rest before FlashCardz opens to the public. Every third party we share your data with must give it the same or equal protection as this policy, and as the App Store's rules require:

Some parties act on their own responsibility, under their own privacy policies: Apple, when you buy through the App Store, sign in with Apple, receive push notifications on an iPhone or iPad, or use Siri, Spotlight or the App Store rating prompt; Google, when you sign in with Google; and your browser's push service (for example Google, Mozilla or Apple) when you allow browser notifications. If you sign in with Google or Apple, we never receive your password for that account.

Meta Platforms Ireland Limited, only if you agree to ad measurement in the cookie banner. Meta's Pixel then runs on our website and in the web app, and our servers tell Meta about the sign-up, trial or first payment that followed (its Conversions API), with the identifiers in section 2, so that Meta can tell us which ads worked without counting anything twice. Renewals are never sent, and nothing about your files, cards or studying ever is. For collecting these events and passing them on, Meta and we are joint controllers (Art. 26 GDPR), under Meta's Controller Addendum: we are responsible for asking your consent and for what we send, and Meta for what it does with the events afterwards, under Meta's Privacy Policy. You can use your rights with either of us, and we'll give you the essence of the arrangement on request.

If we advertise elsewhere, for example on TikTok, Google or Snapchat, and want to measure those ads the same way, we'll name the platform here and in the Cookie Policy first, and its tools run only after the cookie banner has asked you again.

If you join FlashCardz through an organisation, such as a university, a school, an employer or a partner that pays for your plan or gives you a code, we'll show you before you join what it will learn: at most whether you joined and figures about your use, never your files, cards or answers.

Other students see only what you choose to share. If you turn on friends or leaderboards, your friends see your nickname, daily rings, streak and weekly score, and other students in your field may see your nickname, score and rank. Your files, cards, real name and email are never shown to other students. A student you block isn't told, and a report goes only to us.

We don't look through your files or cards. The people who run FlashCardz see a card's text only when you report it, rate it or comment on it, shown with your nickname and what you wrote, so that we can act on it. The same goes for what you write in the feedback form.

We may disclose data where the law requires it (for example to a court or authority), to protect the rights and safety of our users or of FlashCardz, or, if FlashCardz or part of it is transferred to a new owner, for example in a merger, an acquisition or a sale of its assets, to that owner and its advisers, who would remain bound by this policy. We'll tell you before such a transfer.

6. Transfers outside the EU

Your account, files and cards are stored in the EU. Some providers above are based in the USA or process data there. We transfer data to them only with a safeguard the GDPR recognises: the provider's certification under the EU–US Data Privacy Framework, or the European Commission's Standard Contractual Clauses, together with extra measures such as encryption in transit and sending identifiers rather than names. With your consent to ad measurement, Meta may transfer data to Meta Platforms, Inc. in the USA, which is certified under the Data Privacy Framework. Write to us for a copy of the relevant safeguards.

7. How long we keep it

When you delete your account, everything in it goes at once: files, pages, cards, reviews, profile, friends, blocks and devices, and your customer record at our subscription provider. A subscription bought on the web ends with it. One bought through Apple doesn't: cancel it in your Apple Account, or Apple keeps charging you. A report another student made about you stays for its period, no longer naming you. What you agreed to when you bought, and any withdrawal, stay for their period too, as proof of the contract. Records kept for statistics stay only under a random identifier that can't be linked back to you. If you started a free trial or redeemed a promotional code, we keep a one-way code made from your email address, only so that each goes to a person once; it can't be turned back into your address. Deleted data can survive in encrypted backups for up to 7 days, until they are overwritten.

8. Your rights

Under the GDPR you have the right to:

• access your data and get a copy of it (Art. 15);
• have it corrected if it's wrong (Art. 16);
• have it deleted (Art. 17);
• restrict how we use it (Art. 18);
• receive it in a portable format, or have it sent to another service (Art. 20);
• object to uses based on our legitimate interest (Art. 21);
• withdraw consent at any time, as easily as you gave it (Art. 7(3)).

Much of this you can do yourself in the app: edit your profile in Settings, export your cards as CSV or as an Anki package with your progress, turn friends, leaderboards, notifications and reminder emails on or off, change your cookie choices, and delete your account. To withdraw consent, turn the feature off in Settings, including AI reading what you add; use “Cookie settings”, at the foot of every page of our website and in Settings, for cookies; or turn notifications off in your device's or browser's settings. Waitlist emails carry a link to leave the list. To object to our keeping which campaign brought your account, write to us and we'll delete it. For anything else, write to support.flashcardz@gmail.com from the address on your account. We may ask you to confirm it's you. We answer within one month, free of charge.

You also have the right to complain to a data protection authority. Ours is the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, Romania, www.dataprotection.ro. You can also complain to the authority where you live or work. We'd be grateful for the chance to put things right first.

9. Personal data inside your files

Course material sometimes names people: authors, lecturers, historical figures, parties to a court case. We process such names only as part of your material, to make your cards, and show them to you alone.

Please don't upload material containing other people's private data that you have no right to share, and never patient records, clinical notes or case files that identify real people. If you do, you are responsible for having the right to, and we will delete such material when we learn of it.

10. Children

FlashCardz is for students aged 13 and over: by signing in you confirm you are, and we don't knowingly keep accounts for anyone younger. Friends and leaderboards rest on consent, so please turn them on only if your country lets you consent yourself at your age (between 13 and 16 in the EU). If you're under 18, please make sure a parent or guardian agrees before buying a subscription. If you believe a child under 13 has an account, write to us and we'll delete it.

11. Cookies, your device and permissions

Every cookie our website and web app use is listed, with what it's for and how long it lasts, in the Cookie Policy. In short: the ones FlashCardz needs to work are always on, such as the one that remembers your answer to the cookie banner and the one that remembers the language you picked. Our own analytics cookies, and Meta's for measuring our ads, are set only after you agree, and are deleted when you withdraw. To count visits and measure speed we also use Vercel Web Analytics and Speed Insights, which work without cookies, don't follow you across sites, and receive page addresses with everything after the path removed.

The apps store only what they need to work, in your browser's or device's storage: your sign-in session, so you stay signed in; your chosen language, theme and similar preferences; and, so you can study with no connection, a copy of your day's cards and course details, with any answers still waiting to be sent. The web app also keeps its own code in your browser, never anything of yours. The iOS app keeps recent answers from our servers and the figures and pages you opened, protected by the system's file protection and left out of device backups. All of this is strictly necessary for the service you asked for, so it doesn't need consent. Signing out removes these copies, and clearing your browser's storage signs you out.

On iPhone and iPad, FlashCardz asks for a permission only when you use what needs it: the camera to scan pages, and notifications. Photos you add come through the system's picker, so the app sees only the ones you choose. Refusing a permission turns off only that feature. Widgets show numbers (your rings and streak), never a card's or a course's words. The app doesn't use Apple's advertising identifier and doesn't track you.

12. How we protect your data

• All traffic is encrypted in transit (HTTPS), and stored data is encrypted at rest by our providers.
• Every student's data is walled off at the database level, and automated tests check that one student can't read another's.
• Uploaded files are opened in an isolated sandbox with no network access.
• Logs, analytics and error reports are built to carry identifiers and numbers, never the content of your files or cards, your email or your name.
• Access to production systems is limited to the people who run FlashCardz, with separate keys for each environment.

No system is perfectly secure. If a breach puts your rights at risk, we'll tell the authority within 72 hours and you without undue delay, as the GDPR requires.

13. Changes to this policy

FlashCardz is growing: we may add features, plans, apps for other devices, ways to study with others, partners such as universities, new providers or new places to advertise. When a change concerns your data, we update this policy, and the date at the top, before it happens. If it brings a new purpose, a new kind of recipient or a new AI provider, we'll tell you in the app or by email before it takes effect, and where the law requires your consent, nothing starts until you give it. A new kind of cookie, or a new ad partner, makes the cookie banner ask again.

We may invite you to a survey or an interview about FlashCardz. Taking part is always your choice, and the invitation says what we'll do with your answers.