Privacy Policy

Flashcards GG (hereinafter "the App", "the Service", "We", "Us", "Our") is a flashcard application that helps you create, study, and share flashcard sets. The App is provided by flashcards.gg and is available through the Apple App Store, Google Play, and on the web at flashcards.gg.

This Privacy Policy explains what data we collect, why we collect it, how it is used and shared, how long we keep it, and the rights and choices you have. For the purposes of the EU/UK General Data Protection Regulation (GDPR), the data controller is flashcards.gg. You can reach us at support@flashcards.gg.

Information We Collect

We collect the following categories of data, depending on how you use the App:

• Account information — If you choose to sign in with Google or Apple, we receive your email address and a unique user identifier from Firebase Authentication (Google). You can use the App without signing in.
• Your content — Your flashcard sets and cards, your study progress (spaced-repetition scheduling data), and your test/quiz results. This is stored locally on your device and, if you are signed in, synced to our servers so you can use it across devices.
• Shared sets — When you create a share link, the set's content is stored on our servers and becomes accessible to anyone who has the link.
• Shared library — If you switch on the shared library, a copy of each eligible AI-generated set (set name, cards, language, card count, publish date) is published for all users and on public pages of flashcards.gg (flashcards.gg/lib), where search engines and other automated services, including AI assistants, may read and index it. We record your choice (your account, the version of the text you answered, your language, the time and where in the App you answered) and we keep a link between each public copy and your account on our servers, so that you can remove it and so that we can act on reports and legal notices.
• Reports you file — If you report a set in the shared library, we store your account identifier, the set, the reason you chose, your note, and the time. If you report a set from our website without an account, we store the name and email address you give us, the set, the reason, your note, a hash of your IP address and the time, and we email you a confirmation.
• Messages you send us — If you email support@flashcards.gg or info@flashcards.gg, we keep your message and our reply. An automated system sorts incoming mail before a person reads it — for example, to act promptly on a report about a public library set — and may send you an automatic confirmation.
• AI generation inputs — When you use AI generation, the text you enter (topic/description) and any documents or photos you submit are sent to Google Gemini to generate flashcards. These requests are also recorded on our servers for abuse prevention, rate limiting, and quality. We also analyse generation topics in aggregate (for example, which subjects are popular) to improve the App; this analysis is not used to profile you. Please avoid submitting sensitive personal information you don't want processed this way.
• Usage & analytics data — Through Firebase Analytics (Google Analytics 4) and our own event log, we collect information about how the App is used: for example screens viewed, study sessions started/completed, and features used, together with a per-install identifier, device/platform type, app version, language, and coarse (non-precise) region.
• Advertising & attribution — When you install the App after clicking one of our ads, we may receive attribution data such as a Google click identifier (gclid) and install-referrer parameters, used to measure our own Google Ads app-install campaigns.
• Push notification tokens — If you enable notifications, we store a device push token (Firebase Cloud Messaging) and your time-zone offset so we can send study reminders.
• Email delivery data — When we send you a service email (see "How We Use Your Data"), we keep a record of the send: your address, the type of email, the time, and the delivery result (for example a bounce), plus whether you opened the App from a link in that email. We do not use tracking pixels. Addresses that unsubscribe or bounce are kept on a do-not-email list so we do not email them again.
• Diagnostics — If the App encounters an error, we may collect a diagnostic report containing the error message, a stack trace, the app version and platform, related technical context, and your IP address and user-agent.
• Technical & log data — When the App communicates with our servers we receive standard technical information including your IP address, request headers (platform, app version, and a per-install device identifier). We keep a security audit log of key account actions and sign-ins, which includes the IP address and per-install identifier. On the public library pages we count requests per IP address to limit automated copying and, for visitors that identify themselves as a search-engine crawler, we look up the address's DNS name; these checks keep no history beyond a short-lived cache.
• Cookies & similar technologies (web only) — On our website and web app, Google Analytics may set cookies or similar identifiers. See "Cookies & Consent" below.
• Communications — If you email us or submit in-app feedback, we keep that correspondence to respond and improve the App.

How We Use Your Data & Legal Bases

We use the data above to:

• Provide and sync the App and its features, and enable sharing — necessary to perform our contract with you.
• Generate flashcards with AI at your request — performance of our contract.
• Publish the AI-generated sets you chose to share in the shared library and let other users find and copy them — performance of our contract, at your request (you switch this on and can switch it off at any time).
• Keep the link between a public copy and your account, review reports and legal notices, and hide or remove content — performance of our contract, our legitimate interest in running a safe service, and our legal obligations as a hosting provider.
• Analyse generation topics in aggregate to improve the App — our legitimate interest.
• Understand usage and improve the App (analytics) — your consent where required, otherwise our legitimate interest.
• Measure and run our own app-install advertising (attribution) — your consent where required.
• Send study reminders and other notifications you enable — your consent.
• Send you service emails about your own account and activity — a welcome message after you sign in, a notice when a flashcard set you asked our AI to generate is ready, and — only if you turn on the Daily goal feature — a note when you miss three study days in a row (you can switch that note off in the App under Settings → Daily goal) — performance of our contract / our legitimate interest. Every such email contains an unsubscribe link. We do not send marketing emails; if we ever do, we will ask for your consent where required. We also email a confirmation when you report a set from our website.
• Keep the App secure, prevent abuse, enforce limits, and diagnose problems — our legitimate interest.
• Respond to your messages and meet legal obligations — legitimate interest / legal obligation.

Cookies & Consent

On the web, we use Google Analytics, which relies on cookies and similar identifiers. Where required by law (including the EU/EEA, the UK, and Switzerland), we ask for your consent before setting non-essential analytics/advertising cookies and before running analytics and advertising measurement, using a consent mechanism (Google Consent Mode). You can change or withdraw your consent at any time, and where consent has not been given these technologies are disabled or run in a cookieless mode. Strictly necessary technologies used to deliver the Service do not require consent.

Third-Party Services

We share data with the following service providers ("processors"), who act on our behalf, and with the sign-in providers you choose:

• Google — Firebase Authentication (sign-in), Firebase Analytics / Google Analytics 4 (analytics, exported to Google BigQuery for our analysis), Google Gemini (AI generation), Google Cloud (hosting and data storage), Firebase Cloud Messaging (notifications), and Google Ads (our install advertising and measurement). Subject to Google's Privacy Policy.
• Apple — Sign in with Apple, if you choose it. Subject to Apple's Privacy Policy.
• Hetzner Online GmbH — hosting of our own email server (EU data centers), used to deliver the service emails described above. Subject to Hetzner's Privacy Policy.

We do not sell your personal data, and we do not share it with third parties for their own marketing. Shared-set content is accessible to anyone who has the corresponding share link. We may disclose data if required by law or to protect our rights, users, or the public.

Public pages and search engines. Our public library pages are indexable: search engines (such as Google) and other automated services may index and cache them. A removed set answers with a "gone" status and leaves our sitemap at once. When a set is removed from the library, the page is removed from our site promptly and marked for removal from search engines, but cached copies can persist for some time; we cannot delete them ourselves.

International Data Transfers

Our providers (including Google and Apple) may process and store data in the United States and other countries. Where personal data is transferred out of the EEA, the UK, or Switzerland, it is protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses and applicable data-transfer frameworks.

Data Retention

• On-device data is kept until you delete it or uninstall the App.
• Synced content (sets, study progress, test results) is kept until you delete it or delete your account.
• Shared sets are kept while the share link is active.
• Public copies in the shared library are kept until you remove the set, switch the library off, or delete your account. Copies that other users have already added to their own libraries remain with them.
• Your shared-library choice is kept while your account exists, together with the version of the text you answered.
• Report records (reports you file, and reports and decisions about your published sets) are kept as our record of notices and moderation decisions and for abuse prevention; if you delete your account, your identifier is removed from them.
• Analytics event logs on our servers are retained for a limited period (approximately 90 days); Google Analytics retains its own data per its settings.
• Diagnostics and security/audit logs are kept for a limited period for troubleshooting and abuse prevention.
• Account information is kept until you delete your account.
• Email send records are deleted with your account. Unsubscribe and bounce records keep the email address only (no account link) so we can honor them even after your account is deleted.

Your Rights & Choices

Depending on your location, you have the right to access, correct, delete, export (portability), restrict, or object to the processing of your personal data, and to withdraw consent at any time. You can:

• Delete individual flashcard data by removing sets within the App.
• Delete your account and all associated server-side data using "Delete Account" in the App's menu.
• Sign out to stop syncing data to our servers.
• Turn notifications off in the App or your device settings.
• Stop service emails at any time using the unsubscribe link in any email we send.
• Decline or withdraw analytics/advertising consent where offered, and use your device's ad-personalization controls.
• Remove any set from the shared library from the set's screen, or switch the shared library off in Settings to remove all your sets.
• Dispute a moderation decision from the set's screen or by email.
• Contact us at support@flashcards.gg to exercise any of these rights.

If you are in the EEA, the UK, or Switzerland, you also have the right to lodge a complaint with your local data-protection supervisory authority.

Notice for California & Other U.S. States

We do not sell your personal information for money. However, our use of Google Analytics together with Google Ads for measuring our own install campaigns may qualify as "sharing" for cross-context behavioral advertising under the California Consumer Privacy Act (CCPA/CPRA) and similar U.S. state laws. You have the right to opt out of this. You can:

• decline or withdraw analytics/advertising consent where our consent controls are offered;
• enable a recognized opt-out preference signal (such as Global Privacy Control) in your browser, which we honor where required;
• use your device's ad-personalization settings; or
• email us at support@flashcards.gg with the subject "Do Not Sell or Share My Personal Information".

We do not knowingly sell or share the personal information of consumers we know to be under 16 years of age. California residents also have the rights to know, access, correct, delete, and not be discriminated against for exercising these rights.

Children's Privacy

The App is not directed to children under the age of 13 (or the minimum age required in your country), and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact us and we will delete it promptly. The shared library is available only to users who confirm they are 16 or older.

Data Security

We use industry-standard measures to protect your data, including encrypted connections (HTTPS) for all transfers between the App and our servers, and access controls on our systems. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Changes to This Policy

We may update this Privacy Policy from time to time. The revised date will be shown at the top of this page, and material changes will be communicated as appropriate. We encourage you to review this policy periodically.

Contact Us

If you have any questions about this Privacy Policy or your data, please contact us at support@flashcards.gg.