Privacy Policy

Last updated: February 24, 2026

Summary of Key Points

1. What Information Do I Collect?

Information you provide to me

I collect personal information that you voluntarily provide when you register for an account or use the Services.

Account Information:

• Email address (required for registration)
• Password (hashed and managed by Supabase; I never have access to your plaintext password)

User-Created Content:

• Flashcard content (front and back text you create)
• Deck names, descriptions, and organization
• Exam names and dates

Learning Progress Data:

• Spaced repetition scheduling data (due dates, review intervals, difficulty ratings)
• Review history (when you reviewed a card, whether you remembered it)
• Session statistics

Information collected automatically

When you use the app, certain information is collected automatically:

Device Information:

• Device type and model
• Operating system and version
• App version

Usage Analytics (via PostHog):

• Screen views and navigation patterns
• App open events
• Crash reports (error messages and stack traces, with no personal content)

Analytics data is processed on servers located in the European Union (PostHog EU instance). Session replay is enabled with text input masking to protect your content.

Information NOT collected

2. How Do I Process Your Information?

I process your personal information for the following purposes:

• To provide the Service: Creating and managing your account, syncing your flashcards and learning progress across devices, scheduling spaced repetition reviews.
• To enable deck sharing: When you share a deck, other users can access the deck content you chose to share. Your user ID is associated with decks you own.
• To improve the app: Analyzing aggregated usage patterns to understand which features are used and to identify bugs.
• To provide support: Responding to your inquiries and resolving issues.
• To ensure security: Protecting against unauthorized access, fraud, and abuse.

I do not process your information for advertising, profiling, or automated decision-making purposes.

3. What Legal Bases Do I Rely On to Process Your Personal Information?

If you are located in the EU or UK, the General Data Protection Regulation (GDPR) requires me to explain the legal bases for processing your personal information:

• Performance of a Contract (Art. 6(1)(b) GDPR): Processing your account data and learning progress is necessary to provide you the flashcard service you signed up for.
• Legitimate Interests (Art. 6(1)(f) GDPR): I have a legitimate interest in understanding how the app is used so I can improve it, and in ensuring the security of the service. These interests do not override your fundamental rights and freedoms.
• Legal Obligations (Art. 6(1)(c) GDPR): I may process your information where required to comply with legal obligations.
• Consent (Art. 6(1)(a) GDPR): Where none of the above bases apply, I will ask for your explicit consent. You can withdraw consent at any time by contacting me.

4. With Which Service Providers Do I Share Your Data?

I use the following third-party service providers to operate the app. Each acts as a data processor on my behalf:

Provider	Purpose	Data Shared	Server Location
Supabase supabase.com	Authentication, database, cross-device sync	Email, user ID, flashcard content, learning progress	See Supabase infrastructure docs
PostHog posthog.com	Product analytics, crash reporting	Device info, anonymized usage events, crash data	European Union
Expo expo.dev	Over-the-air app updates	Device info (OS, app version)	United States

I do not sell, rent, or share your personal information with third parties for their own marketing or advertising purposes.

International Data Transfers: Some service providers may process data outside the EEA. Where this occurs, appropriate safeguards are in place (such as Standard Contractual Clauses or the EU-US Data Privacy Framework) in accordance with GDPR requirements.

5. How Long Do I Keep Your Information?

I keep your personal information for as long as you maintain an active account. Specifically:

• Account data and learning progress: Retained while your account is active. When you delete your account, your data is permanently removed from my servers.
• Locally stored data: Flashcard data stored on your device is cleared when you sign out or delete the app.
• Analytics data: Retained according to PostHog's data retention policies.

When you request account deletion, a server-side process permanently deletes all your data from Supabase, including authentication records, flashcard content, learning progress, and exam data.

6. How Do I Keep Your Information Safe?

I implement appropriate technical and organizational measures to protect your data:

• In transit: All data is transmitted over HTTPS/TLS encryption.
• At rest: Authentication tokens are stored in your device's secure enclave (Expo SecureStore). The local database is protected by your device's OS-level encryption.
• Authentication: Passwords are hashed by Supabase using industry-standard algorithms. I never have access to plaintext passwords.

However, no method of electronic transmission or storage is 100% secure. While I strive to protect your personal information, I cannot guarantee absolute security.

7. Do I Collect Information from Minors?

I do not knowingly collect data from or market to children under 16 years of age (the age threshold under GDPR). If I learn that I have collected personal information from a child under 16 without parental consent, I will take steps to delete that information promptly.

If you become aware that a child has provided me with personal information, please contact me at carloflashcards@gmail.com.

8. What Are Your Privacy Rights?

For users in the European Economic Area (EEA), UK, and Switzerland

Under the GDPR, you have the following rights:

• Right of Access (Art. 15): Request a copy of the personal data I hold about you.
• Right to Rectification (Art. 16): Request correction of inaccurate personal data.
• Right to Erasure (Art. 17): Request deletion of your personal data ("right to be forgotten").
• Right to Restriction (Art. 18): Request that I restrict the processing of your personal data.
• Right to Data Portability (Art. 20): Request your data in a structured, commonly used, machine-readable format.
• Right to Object (Art. 21): Object to processing based on legitimate interests.
• Right to Withdraw Consent: Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, email me at carloflashcards@gmail.com. I will respond within 30 days.

Supervisory Authority: If you believe I am processing your data unlawfully, you have the right to lodge a complaint with your local data protection authority. For users in Baden-Württemberg, Germany, this is:

Account Management

You can manage your account at any time:

• Update your information through the app's account settings.
• Delete your account through the app's settings, which permanently removes all your data from my servers.

9. Do I Make Updates to This Notice?

I may update this Privacy Notice from time to time. The updated version will be indicated by a revised "Last updated" date at the top. If I make material changes, I will notify you through the app or by other appropriate means. I encourage you to review this Privacy Notice periodically.

10. How Can You Contact Me About This Notice?

If you have questions or comments about this notice, you may email me at:

11. How Can You Review, Update, or Delete the Data I Collect from You?

You have the right to request access to, correction of, or deletion of your personal information. To make such a request, email me at carloflashcards@gmail.com. I will respond within 30 days as required by GDPR.

You can also delete your account directly within the app, which will permanently remove all your data from my servers.