Privacy policy

1. Controller

The controller under the GDPR is:

For all privacy questions, write to [email protected].

2. Using the app without an account

Without an account, your topics, cards, images, voice memos, study progress, and settings are stored only on your device. Nothing of it reaches us. Reminders are scheduled locally on the device.

If you export your library, the app creates a file that only you decide where to store or share.

Apple (App Store) or Google (Google Play) process data when you download the app, as independent controllers under their own privacy policies.

3. Account and Sign in with Apple

Online features such as sync, study partners, the topic library, and AI cards need an account. You create it with Sign in with Apple. Apple then gives us a user identifier and an email address, which can be a private relay address if you choose “Hide My Email”. We store an encrypted Apple token so that we can revoke the sign-in with Apple when you delete your account.

With an account we store: your email address, the profile name you choose, your topics, cards, card images, voice memos and transcripts, your study progress and reviews, the activity you share with study partners, your sessions and the installations used for sync, the status of your subscription, and how often you used AI features and what it cost.

Legal basis: Art. 6 (1) (b) GDPR (performance of the contract for the online features).

4. Learning together

When you share a topic, its members see the topic, its cards, your profile name, and the study activity within that topic. Each member keeps their own progress. You decide whom you invite, and you can leave a topic at any time.

Legal basis: Art. 6 (1) (b) GDPR.

5. AI cards from voice memos and text

Flashcards Plus can turn a voice memo or a text into card suggestions. For this, the recording is transcribed and the text is sent to an AI provider, which returns suggestions that you review before anything is saved. Depending on our configuration, the provider is OpenAI (OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, Ireland) or OpenRouter (OpenRouter, Inc., USA), which forwards the request to the model provider. We send only the recording or text, never your name or email address.

The providers process the data on our behalf (Art. 28 GDPR). They do not use it to train their models, and they keep it for at most 30 days to detect abuse. Processing can take place in the USA; transfers rely on the EU–US Data Privacy Framework (adequacy decision, Art. 45 GDPR) or the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR).

Photos you add to cards are never sent to an AI provider.

Legal basis: Art. 6 (1) (b) GDPR.

6. Flashcards Plus purchases

Apple sells and bills Flashcards Plus. Apple processes your payment details; we never see them. We receive the purchase information signed by Apple that is needed to unlock Plus and store it with your account: product, transaction IDs, purchase and expiry dates, status, storefront, and price and currency. Apple informs our server directly about renewals, cancellations, and refunds (App Store Server Notifications).

Legal basis: Art. 6 (1) (b) GDPR.

7. Hosting and service providers

Our servers, the media volume, and the encrypted backups are operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in data centres in the European Union. A data processing agreement (Art. 28 GDPR) is in place.

Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, connects the app and this website to our servers (Cloudflare Tunnel) and protects them against attacks. Cloudflare processes your IP address and request data and terminates the TLS encryption. For transfers to the USA we rely on Cloudflare’s certification under the EU–US Data Privacy Framework (adequacy decision, Art. 45 GDPR) and additionally on the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR). Legal basis: Art. 6 (1) (f) GDPR; our legitimate interest is a secure and reliable service.

Our server logs contain no card content, images, audio, transcripts, email addresses, or tokens.

8. This website

When you visit this website, the server processes the data your browser sends (IP address, date and time, page, referrer, browser) to deliver the pages and keep them secure. Server logs are deleted after 14 days. Legal basis: Art. 6 (1) (f) GDPR.

The website loads no third-party content: fonts and images are served from our own server, and there are no analytics, ads, or social media plugins.

The website sets one technically necessary session cookie that protects the forms against misuse. It expires after two hours. Legal basis: § 25 (2) no. 2 TDDDG and Art. 6 (1) (f) GDPR.

9. Deletion and data request forms

When you use the forms on Delete your account or Data request, we store your email address, an optional Apple relay address and message (all three encrypted), a keyed hash of your email address, the language, a keyed hash of your IP address to limit abuse, and timestamps. We send you an email to confirm the request. Apple forwards mail to a “Hide My Email” address only from senders registered with Apple; until our sending domain is registered, enter an address you can read and add the relay address in the optional field.

Legal basis: Art. 6 (1) (c) GDPR in conjunction with Art. 12 and 15 to 21 GDPR. Unconfirmed requests are deleted after 48 hours. When a request is closed, we delete the email addresses and the message and keep only the keyed hash, the type, and the dates for three years, so that we can prove how we handled it (Art. 5 (2) GDPR).

10. Contact by email

When you email us, we use your message and address to answer you. Legal basis: Art. 6 (1) (b) GDPR if your message concerns the app, otherwise Art. 6 (1) (f) GDPR. We delete the conversation once your concern is resolved, unless statutory retention periods apply.

11. How long we keep data

We keep account data until you delete your account. Deleting it removes the data from our live systems immediately. Topics you shared stay with their other members, and AI usage records are anonymized.

Our backups are encrypted (AES-256) and rotate automatically: images and voice memos leave them within 14 days, database records within about 6 months. If we ever restore a backup, we repeat every account deletion made since then.

12. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21). Where processing is based on your consent, you can withdraw it at any time with effect for the future. Use the data request form or email us.

You can lodge a complaint with a supervisory authority (Art. 77 GDPR), for example the Saxon Data Protection and Transparency Commissioner (Sächsische Datenschutz- und Transparenzbeauftragte), Devrientstraße 5, 01067 Dresden, Germany.

13. Security

All connections are encrypted with TLS. Backups are encrypted before they leave the server. Access to the servers is limited to the operator.

14. Children

The offline app can be used at any age. If you are under 16, please ask a parent or guardian before you create an account.

15. Changes

We update this policy when the app or the law changes. The current version is always on this page.