Privacy Policy

Flashcards GG (hereinafter "the App", "the Service", "We", "Us", "Our") is a flashcard application that helps you create, study, and share flashcard sets. The App is provided by flashcards.gg and is available through the Apple App Store, Google Play, and on the web at flashcards.gg.

This Privacy Policy explains what data we collect, why we collect it, how it is used and shared, how long we keep it, and the rights and choices you have. For the purposes of the EU/UK General Data Protection Regulation (GDPR), the data controller is flashcards.gg. You can reach us at support@flashcards.gg.

Information We Collect

We collect the following categories of data, depending on how you use the App:

• Account information — If you choose to sign in with Google or Apple, we receive your email address and a unique user identifier from Firebase Authentication (Google). You can use the App without signing in.
• Purchase information — If you buy Flashcards.gg Pro through Google Play, Google sends us a purchase identifier, the order number, the subscription state and renewal or expiry dates, the country and the price paid, and we store them with your account to switch Pro on and to keep its status current. We never receive your payment card or bank details; Google Play processes the payment. If you buy it on our website, Stripe sends us the subscription and customer identifiers, the plan, the subscription state and renewal or expiry dates, the country of your billing address and the price charged, and we store them with your account for the same purposes. To link the purchase to your account we create a customer record at Stripe with your account's email address and identifier. We never receive your payment card or bank details there either; Stripe and its checkout service Link process the payment. When a Google Play payment for Flashcards.gg Pro goes through — the first payment and each renewal — our servers send Google Analytics a purchase event for the device it was bought on (or, where we cannot tell, the Android device most recently used with your account): the amount and currency charged, the order number, the plan and the country, together with the identifiers Google Analytics already uses for the App on that device (the per-install analytics identifier and your account identifier). We use it to measure which of our own Google Ads campaigns lead to purchases; Google Ads receives it through the link between our Google Analytics and Google Ads accounts. Refunds are not sent. The event is only ever sent under a device on which analytics is allowed, and Google applies the advertising consent given on that device.
• Your content — Your flashcard sets and cards, your study progress (spaced-repetition scheduling data), and your test/quiz results. This is stored locally on your device and, if you are signed in, synced to our servers so you can use it across devices.
• Shared sets — When you create a share link, the set's content is stored on our servers and becomes accessible to anyone who has the link.
• Shared library — If you switch on the shared library, a copy of each eligible AI-generated set (set name, cards, language, card count, publish date) is published for all users and on public pages of flashcards.gg (flashcards.gg/lib), where search engines and other automated services, including AI assistants, may read and index it. We record your choice (your account, the version of the text you answered, your language, the time and where in the App you answered) and we keep a link between each public copy and your account on our servers, so that you can remove it and so that we can act on reports and legal notices.
• Reports you file — If you report a set in the shared library, we store your account identifier, the set, the reason you chose, your note, and the time. If you report a set from our website without an account, we store the name and email address you give us, the set, the reason, your note, a hash of your IP address and the time, and we email you a confirmation.
• Messages you send us — If you email support@flashcards.gg or info@flashcards.gg, we keep your message and our reply. An automated system sorts incoming mail before a person reads it — for example, to act promptly on a report about a public library set — and may send you an automatic confirmation.
• AI generation inputs — When you use AI generation, the text you enter (topic/description) and any documents or photos you submit are sent to Google Gemini to generate flashcards. These requests are also recorded on our servers for abuse prevention, rate limiting, and quality. When a request is refused because you reached the daily AI limit, we keep its topic so we can name it in the notice that the limit has reset. We also analyse generation topics in aggregate (for example, which subjects are popular) to improve the App; this analysis is not used to profile you. Please avoid submitting sensitive personal information you don't want processed this way.
• Usage & analytics data — Through Firebase Analytics (Google Analytics 4) and our own event log, we collect information about how the App is used: for example screens viewed, study sessions started/completed, and features used, together with a per-install identifier, device/platform type, app version, language, and coarse (non-precise) region.
• Study activity — If analytics is allowed, our own study log records how you study: for each study session its mode, the set, when it started and ended, your time zone, the active time, your study settings at the start, the type of network connection and whether your device was offline, and for each card your rating or whether your answer was right, how long it took, how you answered (for example by swiping, with text-to-speech, or with AI answer checking), and the card's spaced-repetition state, together with a short technical summary of the session, such as how the AI features responded. It does not contain the text of your cards or what you typed. We use it to understand and improve how the App helps people learn; it is not shared or sold.
• Network diagnostics — If analytics is allowed, the App counts how its requests to our servers succeed or fail (the kind of failure, which part of our service the request was for, timing, and the type of network connection), and how many records are waiting to be sent or had to be discarded. To tell a device without internet from our servers being unreachable, it may request a tiny connectivity check page from Google (gstatic.com), at most once every five minutes and only after a request to our servers failed; like any web request, it reaches Google with your device's IP address.
• Advertising & attribution — When you install the App after clicking one of our ads, we may receive attribution data such as a Google click identifier (gclid) and install-referrer parameters, used to measure our own Google Ads app-install campaigns, and — for Google Play purchases — the purchase events described under "Purchase information", used to measure which of those campaigns lead to purchases. On iOS, if you allow tracking in Apple's "Allow Tracking" prompt, Firebase Analytics may also collect your device's advertising identifier (IDFA) and use it, together with usage events, to measure our own advertising. When you install the Android app after seeing or clicking one of our ads on Facebook or Instagram, we may receive Meta's attribution data for that install — which of our Meta campaigns, ad sets and ads it came from, whether the ad was clicked or only viewed, and when — from Google Play's install referrer or from the Facebook, Instagram or Facebook Lite app on your device. In the Android app, the Meta SDK also tells Meta when the App is installed and opened and when you sign in, create your first set, start a purchase or complete one, with basic details of that event (such as the sign-in method, the number of cards, the plan chosen, whether it starts with a trial, and its price) and your device's advertising identifier, so that Meta can measure and deliver our own install ads. The Meta SDK runs only while ad measurement is allowed on your device.
• Push notification tokens — If you enable notifications, we store a device push token (Firebase Cloud Messaging) and your time-zone offset so we can send study reminders, a notice when the daily AI limit you reached has reset, and follow-ups about a feedback chat you started.
• Email delivery data — When we send you a service email (see "How We Use Your Data"), we keep a record of the send: your address, the type of email, the time, and the delivery result (for example a bounce), plus whether you opened the App from a link in that email. We do not use tracking pixels. Addresses that unsubscribe or bounce are kept on a do-not-email list so we do not email them again.
• Diagnostics — If the App encounters an error, we may collect a diagnostic report containing the error message, a stack trace, the app version and platform, related technical context, and your IP address and user-agent. Analytics events, study activity and diagnostic reports recorded while your device is offline are kept on the device and sent when it is back online.
• Technical & log data — When the App communicates with our servers we receive standard technical information including your IP address, request headers (platform, app version, and a per-install device identifier). We keep a security audit log of key account actions and sign-ins, which includes the IP address and per-install identifier. On the public library pages we count requests per IP address to limit automated copying and, for visitors that identify themselves as a search-engine crawler, we look up the address's DNS name; these checks keep no history beyond a short-lived cache.
• Cookies & similar technologies (web only) — On our website and web app, Google Analytics may set cookies or similar identifiers, and the web app sets strictly necessary sign-in cookies. See "Cookies & Consent" below.
• Communications — If you email us or submit in-app feedback, we keep that correspondence to respond and improve the App. When you are signed in, in-app feedback may take the form of a chat with an automated AI assistant: the messages you write there are sent to Google Gemini to produce follow-up questions and a summary for our team, and a member of our team may also write to you in that chat. The assistant is also given technical context from your account (app version, platform and language, the set you had open, your recent AI generation requests and the number of AI generations you made that day, the number of sets you created, and recent error reports). If a question is left unanswered we may send up to two push notifications about it. Chat records are deleted with your account.

How We Use Your Data & Legal Bases

We use the data above to:

• Provide and sync the App and its features, and enable sharing — necessary to perform our contract with you.
• Generate flashcards with AI at your request — performance of our contract.
• Activate and manage your Flashcards.gg Pro subscription — performance of our contract.
• Publish the AI-generated sets you chose to share in the shared library and let other users find and copy them — performance of our contract, at your request (you switch this on and can switch it off at any time).
• Keep the link between a public copy and your account, review reports and legal notices, and hide or remove content — performance of our contract, our legitimate interest in running a safe service, and our legal obligations as a hosting provider.
• Analyse generation topics in aggregate to improve the App — our legitimate interest.
• Understand usage and improve the App (analytics) — your consent where required, otherwise our legitimate interest.
• Measure and run our own app-install advertising, including which campaigns lead to purchases (attribution) — your consent where required.
• Send study reminders and other notifications you enable — your consent.
• Send you service emails about your own account and activity — a welcome message after you sign in, a notice when a flashcard set you asked our AI to generate is ready, a notice when the daily AI limit you reached has reset, and — only if you turn on the Daily goal feature — a note when you miss three study days in a row (you can switch that note off in the App under Settings → Daily goal) — performance of our contract / our legitimate interest. Every such email contains an unsubscribe link. We do not send marketing emails; if we ever do, we will ask for your consent where required. We also email a confirmation when you report a set from our website.
• Keep the App secure, prevent abuse, enforce limits, and diagnose problems — our legitimate interest.
• Respond to your messages and meet legal obligations — legitimate interest / legal obligation.

Cookies & Consent

On the web, we use Google Analytics, which relies on cookies and similar identifiers. Where required by law (including the EU/EEA, the UK, and Switzerland), we ask for your consent before setting non-essential analytics/advertising cookies and before running analytics and advertising measurement, using a consent mechanism (Google Consent Mode). You can change or withdraw your consent at any time, and where consent has not been given these technologies are disabled or run in a cookieless mode. Strictly necessary technologies used to deliver the Service do not require consent.

Sign-in cookies (web app). When you sign in to the web app at flashcards.gg/app, we set two strictly necessary first-party cookies: fgg_s keeps you signed in — it holds a random session identifier signed by our server, cannot be read by scripts and is sent only to our own API — and fgg_in only tells our pages that you are signed in, so they can offer "Open the app". Both expire after 60 days without use and are removed when you sign out or delete your account. fgg_web remembers which version of the web app you use. These cookies are needed to provide the Service and are not used for analytics or advertising. The Google sign-in button comes from Google Identity Services and is loaded only on the sign-in page.

In the iOS app, advertising measurement is controlled by Apple's App Tracking Transparency. We ask through the system "Allow Tracking" prompt, and advertising measurement stays switched off in the App unless you allow it there. You can change your choice at any time in iOS Settings → Privacy & Security → Tracking.

Third-Party Services

We share data with the following service providers ("processors"), who act on our behalf, and with the sign-in providers you choose:

• Google — Firebase Authentication and Google Identity Services (sign-in), Firebase Analytics / Google Analytics 4 (analytics, exported to Google BigQuery for our analysis), Google Gemini (AI generation and the feedback assistant), Google Cloud (hosting and data storage), Firebase Cloud Messaging (notifications), Google Play Billing (subscription purchases), and Google Ads (our install advertising and its measurement, including which campaigns lead to purchases). Subject to Google's Privacy Policy.
• Meta (Meta Platforms Ireland Ltd.) — our install advertising on Facebook and Instagram and its measurement, through the Meta SDK in the Android app and Meta's install attribution described under "Advertising & attribution". Meta also uses this data for its own purposes, such as delivering and improving ads, under its Business Tools Terms and Meta's Privacy Policy.
• Apple — Sign in with Apple, if you choose it. Subject to Apple's Privacy Policy.
• Stripe — payment processing for Flashcards.gg Pro bought on our website. Those purchases are sold through Link, Stripe's checkout service, which handles your payment details, taxes and receipts under its own terms. Subject to Stripe's Privacy Policy.
• Hetzner Online GmbH — hosting of our own email server (EU data centers), used to deliver the service emails described above. Subject to Hetzner's Privacy Policy.

We do not sell your personal data, and we do not share it with third parties for their own marketing, except for the install and app-event data Meta receives for our own ads as described above. Shared-set content is accessible to anyone who has the corresponding share link. We may disclose data if required by law or to protect our rights, users, or the public.

Public pages and search engines. Our public library pages are indexable: search engines (such as Google) and other automated services may index and cache them. A removed set answers with a "gone" status and leaves our sitemap at once. When a set is removed from the library, the page is removed from our site promptly and marked for removal from search engines, but cached copies can persist for some time; we cannot delete them ourselves.

International Data Transfers

Our providers (including Google and Apple) may process and store data in the United States and other countries. Where personal data is transferred out of the EEA, the UK, or Switzerland, it is protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses and applicable data-transfer frameworks.

Data Retention

• On-device data is kept until you delete it or uninstall the App.
• Synced content (sets, study progress, test results) is kept until you delete it or delete your account.
• Shared sets are kept while the share link is active.
• Public copies in the shared library are kept until you remove the set, switch the library off, or delete your account. Copies that other users have already added to their own libraries remain with them.
• Your shared-library choice is kept while your account exists, together with the version of the text you answered.
• Report records (reports you file, and reports and decisions about your published sets) are kept as our record of notices and moderation decisions and for abuse prevention; if you delete your account, your identifier is removed from them.
• Analytics event logs on our servers are retained for a limited period (approximately 90 days); Google Analytics retains its own data per its settings.
• Study activity records are kept for 13 months after the study session. They are deleted with your account, including those your device sends after you have signed out, together with the records made while signed out on devices that no other account has used. Network diagnostics are kept for 90 days.
• When you delete your account, we keep its identifier and the identifiers of the devices that only it was used on for 90 days, only so that study, analytics and diagnostic records from before the deletion, which a device may still send later, are discarded instead of stored again.
• Diagnostics and security/audit logs are kept for a limited period for troubleshooting and abuse prevention.
• Account information is kept until you delete your account.
• Purchase records are deleted with your account. A subscription bought on our website is cancelled, and its customer record at Stripe deleted, when you delete your account; Stripe may keep its own transaction records as required by law, under its own policy.
• Feedback and feedback chat records linked to your account are deleted with your account.
• Email send records are deleted with your account. Unsubscribe and bounce records keep the email address only (no account link) so we can honor them even after your account is deleted.

Your Rights & Choices

Depending on your location, you have the right to access, correct, delete, export (portability), restrict, or object to the processing of your personal data, and to withdraw consent at any time. You can:

• Delete individual flashcard data by removing sets within the App.
• Delete your account and all associated server-side data using "Delete Account" in the App's menu.
• Sign out to stop syncing data to our servers.
• Turn notifications off in the App or your device settings.
• Stop service emails at any time using the unsubscribe link in any email we send.
• Decline or withdraw analytics/advertising consent where offered, and use your device's ad-personalization controls.
• Remove any set from the shared library from the set's screen, or switch the shared library off in Settings to remove all your sets.
• Dispute a moderation decision from the set's screen or by email.
• Contact us at support@flashcards.gg to exercise any of these rights.

If you are in the EEA, the UK, or Switzerland, you also have the right to lodge a complaint with your local data-protection supervisory authority.

Notice for California & Other U.S. States

We do not sell your personal information for money. However, our use of Google Analytics together with Google Ads, and of the Meta SDK and Meta's install attribution, for measuring our own install campaigns and the purchases they lead to may qualify as "sharing" for cross-context behavioral advertising under the California Consumer Privacy Act (CCPA/CPRA) and similar U.S. state laws. You have the right to opt out of this. You can:

• decline or withdraw analytics/advertising consent where our consent controls are offered;
• enable a recognized opt-out preference signal (such as Global Privacy Control) in your browser, which we honor where required;
• use your device's ad-personalization settings; or
• email us at support@flashcards.gg with the subject "Do Not Sell or Share My Personal Information".

We do not knowingly sell or share the personal information of consumers we know to be under 16 years of age. California residents also have the rights to know, access, correct, delete, and not be discriminated against for exercising these rights.

Children's Privacy

The App is not directed to children under the age of 13 (or the minimum age required in your country), and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact us and we will delete it promptly. The shared library is available only to users who confirm they are 16 or older.

Data Security

We use industry-standard measures to protect your data, including encrypted connections (HTTPS) for all transfers between the App and our servers, and access controls on our systems. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Changes to This Policy

We may update this Privacy Policy from time to time. The revised date will be shown at the top of this page, and material changes will be communicated as appropriate. We encourage you to review this policy periodically.

Contact Us

If you have any questions about this Privacy Policy or your data, please contact us at support@flashcards.gg.