Privacy Policy
Flashy · effective 24 August 2026
The short version. Flashy stores the minimum needed to keep your cards and your progress: your email address, the display name you choose, and how you're doing on each card. There are no ads, no analytics, no tracking, and nothing is ever sold or shared with advertisers. You can delete everything from inside the app at any time.
What we collect
Account information
Your email address and password, so you can sign in and find your deck on any device. Passwords are stored only as salted hashes — we never see them.
Profile
The display name and emoji you pick when you start, and the interests you tap during setup. Interests are used once, to suggest a starting deck.
Study activity
Which packs are in your deck, how you graded each card, when each card is next due, and how long you studied. This is what makes the review schedule work; without it, Flashy would show you the same cards forever.
Create with AI
If you use "Create with AI", we keep the topics you ask for and your remaining balance of creations. Purchases of creations are handled entirely by Apple's in-app purchase system — Flashy never sees your payment details; Apple only confirms to us that a purchase happened so we can add your creations.
What we don't collect
- No advertising identifiers, and no tracking across apps or websites.
- No third-party analytics or crash-reporting SDKs. The app contains none.
- No location, contacts, camera, microphone or photo library access. Flashy never asks for these permissions, because it never needs them.
- Nothing is sold, rented, or shared with data brokers or advertisers. Ever.
How your data is used
Only to run the app: to sign you in, show your deck, schedule your reviews, and sync between your iPhone and the web app. We don't profile you, we don't build advertising audiences, and we don't email you marketing.
Who else touches it
Flashy relies on a small number of service providers, who process data on our behalf and are not permitted to use it for their own purposes:
- Supabase — hosts the database, authentication and audio files.
- Vercel — hosts the web version of Flashy and this page.
- Apple — distributes the app through the App Store and TestFlight, handles all in-app purchases, and provides Apple's own aggregate download and crash statistics. We never receive your Apple ID or payment details.
- OpenAI — writes the cards when you use "Create with AI". Only the topic you typed is sent; it is not linked to your email or name there.
Card photographs are loaded directly from Wikimedia Commons, and "learn more" links open Wikipedia. As with visiting any website, Wikimedia receives your device's IP address when an image loads. No account information is sent with those requests.
Keeping it and deleting it
Your data is kept for as long as your account exists. To remove it, open Settings → Delete account in the app and confirm. This permanently erases your profile, your deck and your entire study history. It happens immediately and cannot be undone.
If you'd rather we did it for you, email maryreds@gmail.com from the address on the account and we'll delete it and confirm when it's done.
Security
All traffic between the app and our servers is encrypted in transit. Data is protected at rest by our hosting provider, and access rules mean your rows can only be read by your own signed-in account.
Children
Flashy is not directed at children under 13, and we don't knowingly collect information from them. If you believe a child has created an account, email us and we'll remove it.
Your rights
Depending on where you live, you may have the right to access, correct, export or erase your personal data, or to object to its processing. Deletion is built into the app; for anything else, email us and we'll help. We don't charge for this and we won't treat you differently for asking.
Changes
If this policy changes in a way that materially affects you, we'll update the effective date at the top and note the change in the app's release notes.